Hello James Smart,
The patch fcd427303eb9: "scsi: elx: libefc: SLI and FC PORT state
machine interfaces" from Jun 1, 2021, leads to the following Smatch
static checker warning:
drivers/scsi/elx/libefc/efc_nport.c:710 efc_nport_vport_del()
warn: 'nport' was already freed.
drivers/scsi/elx/libefc/efc_nport.c
680 int
681 efc_nport_vport_del(struct efc *efc, struct efc_domain *domain,
682 u64 wwpn, uint64_t wwnn)
683 {
684 struct efc_nport *nport;
685 struct efc_vport *vport;
686 struct efc_vport *next;
687 unsigned long flags = 0;
688
689 spin_lock_irqsave(&efc->vport_lock, flags);
690 /* walk the efc_vport_list and remove from there */
691 list_for_each_entry_safe(vport, next, &efc->vport_list, list_entry) {
692 if (vport->wwpn == wwpn && vport->wwnn == wwnn) {
693 list_del(&vport->list_entry);
694 kfree(vport);
695 break;
696 }
697 }
698 spin_unlock_irqrestore(&efc->vport_lock, flags);
699
700 if (!domain) {
701 /* No domain means no nport to look for */
702 return 0;
703 }
704
705 spin_lock_irqsave(&efc->lock, flags);
706 list_for_each_entry(nport, &domain->nport_list, list_entry) {
707 if (nport->wwpn == wwpn && nport->wwnn == wwnn) {
708 kref_put(&nport->ref, nport->release);
^^^^^^^^^^^^^^
The release function can free "nport".
709 /* Shutdown this NPORT */
--> 710 efc_sm_post_event(&nport->sm, EFC_EVT_SHUTDOWN, NULL);
^^^^^^^^^^
Use after free.
711 break;
712 }
713 }
714
715 spin_unlock_irqrestore(&efc->lock, flags);
716 return 0;
717 }
regards,
dan carpenter
