[RFC PATCH 1/3] scsi: lpfc: Do not touch the SFP mailbox after a wait timeout

[Artem Dinaburg <artem@trailofbits.com>]

Commit ede596b1434b ("scsi: lpfc: Handle mailbox timeouts in
lpfc_get_sfp_info") made the mailbox cleanup in lpfc_get_sfp_info_wait()
conditional on LPFC_MBX_WAKE, so that a timed-out mailbox is left for
its late completion.

Once lpfc_sli_issue_mbox_wait() returns MBX_TIMEOUT, the mailbox belongs
to the late completion, whose default handler frees it together with its
DMA buffer. Reading mbox_flag at the error label after a timeout is
therefore a use-after-free if the completion has already run.

The LPFC_MBX_WAKE test is also wrong when issuing fails immediately.
lpfc_sli_issue_mbox_wait() clears the flag before issuing, so the caller
still owns the mailbox but skips the cleanup, leaking the mailbox and its
DMA buffer. The A2 page dump does not check for an issue failure at all,
so it can report success with a zeroed page.

Never touch the mailbox after MBX_TIMEOUT, and treat every other
non-success return from either dump as a failure that the caller cleans
up.

Fixes: ede596b1434b ("scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Artem Dinaburg <artem@trailofbits.com>
---
 drivers/scsi/lpfc/lpfc_els.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 52fc50589..ea8835515 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -7410,12 +7410,12 @@ int lpfc_get_sfp_info_wait(struct lpfc_hba *phba,
 	}
 	mbox->vport = phba->pport;
 	rc = lpfc_sli_issue_mbox_wait(phba, mbox, LPFC_MBOX_SLI4_CONFIG_TMO);
-	if (rc == MBX_NOT_FINISHED) {
+	if (rc == MBX_TIMEOUT)
+		goto error;
+	if (rc != MBX_SUCCESS) {
 		rc = 1;
 		goto error;
 	}
-	if (rc == MBX_TIMEOUT)
-		goto error;
 	if (phba->sli_rev == LPFC_SLI_REV4)
 		mp = mbox->ctx_buf;
 	else
@@ -7472,6 +7472,10 @@ int lpfc_get_sfp_info_wait(struct lpfc_hba *phba,
 
 	if (rc == MBX_TIMEOUT)
 		goto error;
+	if (rc != MBX_SUCCESS) {
+		rc = 1;
+		goto error;
+	}
 	if (bf_get(lpfc_mqe_status, &mbox->u.mqe)) {
 		rc = 1;
 		goto error;
@@ -7482,7 +7486,7 @@ int lpfc_get_sfp_info_wait(struct lpfc_hba *phba,
 			     DMP_SFF_PAGE_A2_SIZE);
 
 error:
-	if (mbox->mbox_flag & LPFC_MBX_WAKE) {
+	if (rc != MBX_TIMEOUT) {
 		mbox->ctx_buf = mpsave;
 		lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED);
 	}
-- 
2.43.0