[PATCH] scsi: lpfc: Fix potential VMID resource leak during vport cleanup

[Guangshuo Li <liguangshuo@mail.sdu.edu.cn>]

lpfc_vmid_vport_cleanup() frees the VMID array without freeing the
per-CPU timestamps owned by its entries. It also traverses the embedded
hash nodes after freeing the array.

Free the timestamps in every slot, including those retained after VMID
reinitialization, and clear the hash table before freeing the array.
Clear last_io_time when registration fails so cleanup cannot free it
again.

This issue was found by our static analysis tool under development.

Fixes: 5e633302ace1 ("scsi: lpfc: vmid: Add support for VMID in mailbox command")
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
 drivers/scsi/lpfc/lpfc_scsi.c | 11 +++++------
 drivers/scsi/lpfc/lpfc_vmid.c |  1 +
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index 3f39cc065029..75c5b4bfd0f5 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c
@@ -5475,20 +5475,19 @@ static enum scsi_qc_status lpfc_queuecommand(struct Scsi_Host *shost,
  */
 void lpfc_vmid_vport_cleanup(struct lpfc_vport *vport)
 {
-	u32 bucket;
-	struct lpfc_vmid *cur;
+	u32 i;
 
 	if (vport->port_type == LPFC_PHYSICAL_PORT)
 		timer_delete_sync(&vport->phba->inactive_vmid_poll);
 
 	kfree(vport->qfpa_res);
 	kfree(vport->vmid_priority.vmid_range);
+	if (vport->vmid)
+		for (i = 0; i < vport->max_vmid; i++)
+			free_percpu(vport->vmid[i].last_io_time);
+	hash_init(vport->hash_table);
 	kfree(vport->vmid);
 
-	if (!hash_empty(vport->hash_table))
-		hash_for_each(vport->hash_table, bucket, cur, hnode)
-			hash_del(&cur->hnode);
-
 	vport->qfpa_res = NULL;
 	vport->vmid_priority.vmid_range = NULL;
 	vport->vmid = NULL;
diff --git a/drivers/scsi/lpfc/lpfc_vmid.c b/drivers/scsi/lpfc/lpfc_vmid.c
index 14dbfe954e42..a13e5a07e818 100644
--- a/drivers/scsi/lpfc/lpfc_vmid.c
+++ b/drivers/scsi/lpfc/lpfc_vmid.c
@@ -270,6 +270,7 @@ int lpfc_vmid_get_appid(struct lpfc_vport *vport, char *uuid,
 			hash_del(&vmp->hnode);
 			vmp->flag = LPFC_VMID_SLOT_FREE;
 			free_percpu(vmp->last_io_time);
+			vmp->last_io_time = NULL;
 			write_unlock(&vport->vmid_lock);
 			return -EIO;
 		}

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0