RE: [PATCH 2/2] scsi: fnic: free the NVMe port template from the delete callback

On Thursday, August 20, 2026 1:00 PM, Linmao Li <[email protected]> wrote:
>
> Resending: this reply went to the review thread and linux-scsi on Aug 19
> but not to any of you directly, so you may not have seen it.  Please drop
> 2/2.  The bot's two findings are quoted below; the rest of its mail is
> trimmed.
>
> On Wed, Aug 19, 2026 at 11:52 AM +0000, [email protected] wrote:
> > New issues:
> > - [Critical] Relocating `kfree(iport->nv_tmpl)` to the asynchronous
> > `nvfnic_local_port_delete()` callback introduces a severe arbitrary free
> > and memory corruption vulnerability if the unregister process times out.
> >
> > Pre-existing issues:
> > - [Critical] The driver's bounded timeout design for NVMe FC
> > unregistration leaves the `fnic` structure vulnerable to a Use-After-Free
> > when deferred callbacks execute.
>
> The bot is right.  Please drop this patch; 1/2 is independent and still
> stands on its own.
>
> If the wait times out, fnic_remove() continues and eventually frees fnic,
> which also frees the embedded iport still referenced by lport->private.
> A later ->localport_delete() callback would therefore read nv_tmpl from
> freed memory before passing it to kfree().
>
> The underlying problem is that the bounded wait allows fnic to be freed
> while the NVMe/FC transport still holds pointers into it.  I will revisit
> that teardown separately.
>
> Sorry for the noise on 2/2.
>
>
> Thanks,
> Linmao
>

Thanks for the change, Linmao.

I will get back to you about this change after testing it internally.

Regards,
Karan