[PATCH 5.2 259/413] scsi: zfcp: fix request object use-after-free in send path causing wrong traces

[Greg Kroah-Hartman]

From: Benjamin Block <bbl...@linux.ibm.com>

commit 106d45f350c7cac876844dc685845cba4ffdb70b upstream.

When tracing instances where we open and close WKA ports, we also pass the
request-ID of the respective FSF command.

But after successfully sending the FSF command we must not use the
request-object anymore, as this might result in an use-after-free (see
"zfcp: fix request object use-after-free in send path causing seqno
errors" ).

To fix this add a new variable that caches the request-ID before sending
the request. This won't change during the hand-off to the FCP channel,
and so it's safe to trace this cached request-ID later, instead of using
the request object.

Signed-off-by: Benjamin Block <bbl...@linux.ibm.com>
Fixes: d27a7cb91960 ("zfcp: trace on request for open and close of WKA port")
Cc: <sta...@vger.kernel.org> #2.6.38+
Reviewed-by: Steffen Maier <ma...@linux.ibm.com>
Reviewed-by: Jens Remus <jre...@linux.ibm.com>
Signed-off-by: Martin K. Petersen <martin.peter...@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 drivers/s390/scsi/zfcp_fsf.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -1627,6 +1627,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_f
 {
        struct zfcp_qdio *qdio = wka_port->adapter->qdio;
        struct zfcp_fsf_req *req;
+       unsigned long req_id = 0;
        int retval = -EIO;
 
        spin_lock_irq(&qdio->req_q_lock);
@@ -1649,6 +1650,8 @@ int zfcp_fsf_open_wka_port(struct zfcp_f
        hton24(req->qtcb->bottom.support.d_id, wka_port->d_id);
        req->data = wka_port;
 
+       req_id = req->req_id;
+
        zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
        retval = zfcp_fsf_req_send(req);
        if (retval)
@@ -1657,7 +1660,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_f
 out:
        spin_unlock_irq(&qdio->req_q_lock);
        if (!retval)
-               zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
+               zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req_id);
        return retval;
 }
 
@@ -1683,6 +1686,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_
 {
        struct zfcp_qdio *qdio = wka_port->adapter->qdio;
        struct zfcp_fsf_req *req;
+       unsigned long req_id = 0;
        int retval = -EIO;
 
        spin_lock_irq(&qdio->req_q_lock);
@@ -1705,6 +1709,8 @@ int zfcp_fsf_close_wka_port(struct zfcp_
        req->data = wka_port;
        req->qtcb->header.port_handle = wka_port->handle;
 
+       req_id = req->req_id;
+
        zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
        retval = zfcp_fsf_req_send(req);
        if (retval)
@@ -1713,7 +1719,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_
 out:
        spin_unlock_irq(&qdio->req_q_lock);
        if (!retval)
-               zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
+               zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req_id);
        return retval;
 }