kernel.git/drivers/scsi/lpfc, branch linux-6.16.y

scsi: lpfc: Fix buffer free/clear order in deferred receive path

2025-09-09T17:02:33Z

commit 9dba9a45c348e8460da97c450cddf70b2056deb3 upstream. Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same. Fixes: 472e146d1cf3 ("scsi: lpfc: Correct upcalling nvmet_fc transport during io done downcall") Cc: stable@vger.kernel.org Signed-off-by: John Evans Link: https://lore.kernel.org/r/20250828044008.743-1-evans1210144@gmail.com Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman

scsi: lpfc: Remove redundant assignment to avoid memory leak

2025-08-20T16:41:33Z

[ Upstream commit eea6cafb5890db488fce1c69d05464214616d800 ] Remove the redundant assignment if kzalloc() succeeds to avoid memory leak. Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20250801185202.42631-1-jiashengjiangcool@gmail.com Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure

2025-08-20T16:41:25Z

[ Upstream commit 6698796282e828733cde3329c887b4ae9e5545e9 ] If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a null pointer dereference when attempting to take the abts_io_buf_list_lock for the first hardware queue. Fix by adding a null ptr check on phba->sli4_hba.hdwq and early return because this situation means there must have been an error during port initialization. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-4-justintee8345@gmail.com Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk

2025-08-20T16:41:25Z

[ Upstream commit 1cced5779e7a3ff7ec025fc47c76a7bd3bb38877 ] For SLI3, the HBA_SETUP flag is never set so the lpfc_dev_loss_tmo_callbk always early returns. Add a phba->sli_rev check for SLI4 mode so that the SLI3 path can flow through the original dev_loss_tmo worker thread design to lpfc_dev_loss_tmo_handler instead of early return. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-9-justintee8345@gmail.com Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37Z

Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com

Merge patch series "Update lpfc to revision 14.4.0.9"

2025-04-29T01:38:51Z

Justin Tee says: Update lpfc to revision 14.4.0.9 This patch set contains fixes related to handling of WQE commands, PCI function resets, firmware eratta events, ELS retries, a smatch use-after-free warning, and the creation of a new VMID information entry. The patches were cut against Martin's 6.16/scsi-queue tree. Link: https://lore.kernel.org/r/20250425194806.3585-1-justintee8345@gmail.com Signed-off-by: Martin K. Petersen

scsi: lpfc: Copyright updates for 14.4.0.9 patches

2025-04-29T01:38:15Z

Update copyrights to 2025 for files modified in the 14.4.0.9 patch set. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250425194806.3585-9-justintee8345@gmail.com Signed-off-by: Martin K. Petersen

scsi: lpfc: Update lpfc version to 14.4.0.9

2025-04-29T01:38:14Z

Update lpfc version to 14.4.0.9 Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250425194806.3585-8-justintee8345@gmail.com Signed-off-by: Martin K. Petersen

scsi: lpfc: Create lpfc_vmid_info sysfs entry

2025-04-29T01:38:14Z

A vmid_info sysfs entry is created as a convenience designed for users to obtain VMID information without having to log into fabrics for similar info. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250425194806.3585-7-justintee8345@gmail.com Signed-off-by: Martin K. Petersen

scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk

2025-04-29T01:38:14Z

Smatch detected a potential use-after-free of an ndlp oject in dev_loss_tmo_callbk during driver unload or fatal error handling. Fix by reordering code to avoid potential use-after-free if initial nodelist reference has been previously removed. Fixes: 4281f44ea8bf ("scsi: lpfc: Prevent NDLP reference count underflow in dev_loss_tmo callback") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-scsi/41c1d855-9eb5-416f-ac12-8b61929201a3@stanley.mountain/ Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250425194806.3585-6-justintee8345@gmail.com Signed-off-by: Martin K. Petersen