From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51A5F2F0673 for ; Mon, 29 Jun 2026 19:01:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782759674; cv=none; b=Fk99WL2aLkNvAriDbz/7IQq+f4tQK+mVw9eHb8tQ8sncWf1FzLkLBpmzlQtkc2+r0QR6HeG909e4xNmdThkc0pSI9j53Nb4/Sz94iMb2TOt9n0Jn3+2cCq79QetYcuDlZnfdQFO4yHsLDVRgyU8UhNIpmzCtek81hltlPZZ/SQQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782759674; c=relaxed/simple; bh=OiMr6873tVpbe4uhJZNJ0HQTqhp+3DTr3MZK/Boqnj8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Fz5HJknKF/CA6Yc90lRE4o0yiAibz1icn7GMPQUfBjsyynkv+MMMYjsLUHO3AAm3q399r5o/75c5A1B5PSPPWs5ieFvRY2Nk5Y8r4Rbsj8yJwBkw1+bz+Ffmmu3XRVM2ZMjwY8eAkIKQAntrRler+S+ok7nn+kR9q8sVcgLFPoI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SLqrwKTa; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SLqrwKTa" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2ca265d6ca1so3768735ad.1 for ; Mon, 29 Jun 2026 12:01:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782759672; x=1783364472; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=MdfvxNsaLAGa/pG9tGmiFkHkaCQnRszMYhn1DEf3toE=; b=SLqrwKTazGx+XgHDB8I5bLWZd4pyf8JaxuZM+cstS4TDQ4wsY40SUUcaruawS7c18W p64GQb8RNd9oFqGHvN9OfIKtPv9VhOXOGqgfg8W4Gqv9IxJ/dQNc9LoWdH7L1SKSrY+Y Pz2+ySyxl44oNNNXGMPtH3kCt8Puu/7e98WEZaK7ofazIfgIJyQgyhJwe6NoPzxy/2kB FEjou6LF4g2LvMdfIlSHMj25M7E9XMjF8xZYJxx/ch08JulPEUltVPf3An48jetICKwe SbB1/YmFpVV33+Z6H7K78OtAy0zkW7gYCPbbyP5A+BJYG+WlIWi3pElYlpxbSIbj1iOr YWHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782759672; x=1783364472; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=MdfvxNsaLAGa/pG9tGmiFkHkaCQnRszMYhn1DEf3toE=; b=WNVvcn4zVgcFweZ+tJpeT9r2v6jGFGyXmFFdYu0ezhSOSCqhg3GQo5pEsZhOnLo0Lf vxRnzm+ZhiMx6VHkadCnPvZv4zPW2U/nYjYkvliEWkOzQJ9IBCGTh5OZykt72vd5XaiL JAiz3g4wblqlzUvFx9N/e63CiCi4/u4rjLB4RSjHepJjdETLE/BBATxbLcOv04Wt1QR/ mCYBrBi4ED7v/wVw2yydxA+fz/Q/r06jWcEUxe8kBbD/C429tJatOimo7o30QZddR0mj Vbxi9PZjiGls8RkhJzHqJFeT/B+mJQcKDub1SUajJ6iPBKObaPtHa2nmbr9EbPdACASW Hkbw== X-Forwarded-Encrypted: i=1; AHgh+RrFJa1y4Vhg9r6zO1WzE3RNDbgOH6lLfNHoV7dvxiUmChUGExP0jLUuyaBv6xRqy8SOJxVjcVXE+iAOr5k=@vger.kernel.org X-Gm-Message-State: AOJu0Yz1XioHEeBfEoZ7BmiKSDUg2neA3BoKGk3iOKqjzoWclUqP1A11 EeNEJecV+IKJ5P93r4Lq8VPVKsHWHuj8zJqC2X4iTOZG/Ay66R8m4eUJ X-Gm-Gg: AfdE7cmm367HGk1a6QCiLCwtduvDLrSSI2SIdgfJPkLGWYjsfZKwNLKQ0RNTebQHBD/ +ER6haHwAFNLmRGW7Do4Nx9iJJQCWY6lMLyVg/x8mcuoHm8oUe+tp7rand3j1yHC8eNxJfqOryq ukXonUsEjVogz9RnmDdmztvpLfmuO0Iax1ELqBSGI/IyCcFFVjyr+UeCMcdG1fQXuZFx1WudykH N6mCpggx8Wbl/qGuRLsqIO+AgsJDHH0t04p2x2InjTo3yf3yVaD9KsaD4goxMG6LJsXE1iq2mks pSCBr7jk+Pju9iSqfqC5Wx+eR23MXosCZkHdDfRpPnawDr3ifghOqZviVeLoPQtOI2xU1Duzc5F AkNyDojvYVs+yOFD4sW3jFekXVv0RI+6Zqn2AulGqrh2tz6EnnnvDqowS8AM5DbShOR1FDDbR4j cHga35YKBd2lyIW3qXP/0= X-Received: by 2002:a17:903:1ce:b0:2c9:d27b:af11 with SMTP id d9443c01a7336-2ca2ea353bcmr3474955ad.11.1782759672450; Mon, 29 Jun 2026 12:01:12 -0700 (PDT) Received: from localhost ([2402:e280:3e0d:544:91b3:77c4:f31d:d706]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c9a2a2522csm55461925ad.18.2026.06.29.12.01.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 29 Jun 2026 12:01:12 -0700 (PDT) From: Vaibhav Nagare X-Google-Original-From: Vaibhav Nagare To: justin.tee@broadcom.com Cc: James.Bottomley@HansenPartnership.com, martin.petersen@oracle.com, linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org, Vaibhav Nagare Subject: [PATCH v2] scsi: lpfc: Add rport validation in lpfc_dev_loss_tmo_callbk Date: Tue, 30 Jun 2026 00:31:08 +0530 Message-ID: <20260629190108.601212-1-vnagare@redhat.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Fix a kernel NULL pointer dereference in lpfc_dev_loss_tmo_callbk() when ndlp->vport is NULL during FC remote port deletion. The crash occurs during fc_rport_final_delete() when the vport has already been cleared on the ndlp structure, but the dev_loss_tmo callback is still invoked. The driver already has lpfc_rport_invalid() which validates rport, rdata, ndlp, and vport. The function lpfc_terminate_rport_io() uses this validation, but lpfc_dev_loss_tmo_callbk() does not, leading to a NULL pointer dereference when accessing vport->phba. Crash signature observed on RHEL 8.10 (4.18.0-553.125.1.el8_10.x86_64): BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 RIP: lpfc_dev_loss_tmo_callbk+0x54 Call Trace: fc_rport_final_delete+0xea/0x1d0 [scsi_transport_fc] process_one_work+0x1d3/0x390 worker_thread+0x30/0x390 Preceding kernel log message: lpfc_rport_invalid: Null vport on ndlp xffff9c36d412bc00 Add a call to lpfc_rport_invalid() at the start of lpfc_dev_loss_tmo_callbk() to validate all required pointers before dereferencing them, consistent with lpfc_terminate_rport_io(). Signed-off-by: Vaibhav Nagare --- drivers/scsi/lpfc/lpfc_hbadisc.c | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c index b8649c40b537..af56c32708c6 100644 --- a/drivers/scsi/lpfc/lpfc_hbadisc.c +++ b/drivers/scsi/lpfc/lpfc_hbadisc.c @@ -163,27 +163,15 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport) unsigned long iflags; bool drop_initial_node_ref = false; + /* Validate rport, rdata, ndlp, and vport before proceeding */ + if (lpfc_rport_invalid(rport)) + return; + ndlp = ((struct lpfc_rport_data *)rport->dd_data)->pnode; if (!ndlp) return; vport = ndlp->vport; - if (!vport) { - /* - * Vport is NULL - this can happen during teardown when the - * vport has been destroyed but the rport final delete is - * still processing. Clear the association and return. - */ - pr_err("lpfc: Null vport on ndlp %p, DID x%06x rport %p\n", - ndlp, ndlp->nlp_DID, rport); - - spin_lock_irqsave(&ndlp->lock, iflags); - ((struct lpfc_rport_data *)rport->dd_data)->pnode = NULL; - ndlp->rport = NULL; - spin_unlock_irqrestore(&ndlp->lock, iflags); - return; - } - phba = vport->phba; lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_RPORT, -- 2.54.0