lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()

Commit Message

James Smart April 26, 2022, 6:14 p.m. UTC

If no handler is found in lpfc_complete_unsol_iocb() to match the rctl
of a received frame, the frame is dropped and resources are leaked.

Fix by returning resources when discarding an unhandled frame type.
Update lpfc_fc_frame_check() handling of NOP basic link service.

Co-developed-by: Justin Tee <[e-mail]>
Signed-off-by: Justin Tee <[e-mail]>
Signed-off-by: James Smart <[e-mail]>
---
 drivers/scsi/lpfc/lpfc_sli.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Comments

Martin K. Petersen April 26, 2022, 10:34 p.m. UTC | #1

James,

> If no handler is found in lpfc_complete_unsol_iocb() to match the rctl
> of a received frame, the frame is dropped and resources are leaked.
>
> Fix by returning resources when discarding an unhandled frame type.
> Update lpfc_fc_frame_check() handling of NOP basic link service.

Applied to 5.19/scsi-staging, thanks!

Martin K. Petersen May 3, 2022, 12:51 a.m. UTC | #2

On Tue, 26 Apr 2022 11:14:19 -0700, James Smart wrote:

> If no handler is found in lpfc_complete_unsol_iocb() to match the rctl
> of a received frame, the frame is dropped and resources are leaked.
> 
> Fix by returning resources when discarding an unhandled frame type.
> Update lpfc_fc_frame_check() handling of NOP basic link service.
> 
> 
> [...]

Applied to 5.19/scsi-queue, thanks!

[1/1] lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp()
      https://git.kernel.org/mkp/scsi/c/646db1a560f4

Patch

diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index f7815fe0da82..71e7d209bd0b 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -18123,7 +18123,6 @@  lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
 	case FC_RCTL_ELS_REP:	/* extended link services reply */
 	case FC_RCTL_ELS4_REQ:	/* FC-4 ELS request */
 	case FC_RCTL_ELS4_REP:	/* FC-4 ELS reply */
-	case FC_RCTL_BA_NOP:  	/* basic link service NOP */
 	case FC_RCTL_BA_ABTS: 	/* basic link service abort */
 	case FC_RCTL_BA_RMC: 	/* remove connection */
 	case FC_RCTL_BA_ACC:	/* basic accept */
@@ -18144,6 +18143,7 @@  lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
 		fc_vft_hdr = (struct fc_vft_header *)fc_hdr;
 		fc_hdr = &((struct fc_frame_header *)fc_vft_hdr)[1];
 		return lpfc_fc_frame_check(phba, fc_hdr);
+	case FC_RCTL_BA_NOP:	/* basic link service NOP */
 	default:
 		goto drop;
 	}
@@ -18955,12 +18955,14 @@  lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *vport,
 	if (!lpfc_complete_unsol_iocb(phba,
 				      phba->sli4_hba.els_wq->pring,
 				      iocbq, fc_hdr->fh_r_ctl,
-				      fc_hdr->fh_type))
+				      fc_hdr->fh_type)) {
 		lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT,
 				"2540 Ring %d handler: unexpected Rctl "
 				"x%x Type x%x received\n",
 				LPFC_ELS_RING,
 				fc_hdr->fh_r_ctl, fc_hdr->fh_type);
+		lpfc_in_buf_free(phba, &seq_dmabuf->dbuf);
+	}
 
 	/* Free iocb created in lpfc_prep_seq */
 	list_for_each_entry_safe(curr_iocb, next_iocb,