Re: [PATCH 2/2] scsi: fnic: free the NVMe port template from the delete callback

[Linmao Li]

Resending: this reply went to the review thread and linux-scsi on Aug 19
but not to any of you directly, so you may not have seen it.  Please drop
2/2.  The bot's two findings are quoted below; the rest of its mail is
trimmed.

On Wed, Aug 19, 2026 at 11:52 AM +0000, sashiko-bot@xxxxxxxxxx wrote:
> New issues:
> - [Critical] Relocating `kfree(iport->nv_tmpl)` to the asynchronous
> `nvfnic_local_port_delete()` callback introduces a severe arbitrary free
> and memory corruption vulnerability if the unregister process times out.
>
> Pre-existing issues:
> - [Critical] The driver's bounded timeout design for NVMe FC
> unregistration leaves the `fnic` structure vulnerable to a Use-After-Free
> when deferred callbacks execute.

The bot is right.  Please drop this patch; 1/2 is independent and still
stands on its own.

If the wait times out, fnic_remove() continues and eventually frees fnic,
which also frees the embedded iport still referenced by lport->private.
A later ->localport_delete() callback would therefore read nv_tmpl from
freed memory before passing it to kfree().

The underlying problem is that the bounded wait allows fnic to be freed
while the NVMe/FC transport still holds pointers into it.  I will revisit
that teardown separately.

Sorry for the noise on 2/2.


Thanks,
Linmao