Re: [PATCH v2] scsi: lpfc: Fix buffer free/clear order in deferred receive path

[Martin K. Petersen]

On Thu, 28 Aug 2025 12:40:08 +0800, John Evans wrote:

> Fix a use-after-free window by correcting the buffer release sequence in
> the deferred receive path. The code freed the RQ buffer first and only
> then cleared the context pointer under the lock. Concurrent paths
> (e.g., ABTS and the repost path) also inspect and release the same
> pointer under the lock, so the old order could lead to double-free/UAF.
> 
> Note that the repost path already uses the correct pattern: detach the
> pointer under the lock, then free it after dropping the lock. The deferred
> path should do the same.
> 
> [...]

Applied to 6.17/scsi-fixes, thanks!

[1/1] scsi: lpfc: Fix buffer free/clear order in deferred receive path
      https://git.kernel.org/mkp/scsi/c/9dba9a45c348

-- 
Martin K. Petersen