Patch "scsi: lpfc: Use after free in lpfc_rq_buf_free()" has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

scsi: lpfc: Use after free in lpfc_rq_buf_free()

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Dan Carpenter <[email protected]>
Date: Wed, 22 Nov 2017 11:58:03 +0300
Subject: scsi: lpfc: Use after free in lpfc_rq_buf_free()

From: Dan Carpenter <[email protected]>

[ Upstream commit 9816ef6ecbc102b9bcbb1d83e12c7fb19924f38c ]

The error message dereferences "rqb_entry" so we need to print it first and then free the buffer.

---
 drivers/scsi/lpfc/lpfc_mem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -753,12 +753,12 @@ lpfc_rq_buf_free(struct lpfc_hba *phba,
 	drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
 	rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
 	if (rc < 0) {
-		(rqbp->rqb_free_buffer)(phba, rqb_entry);
 		lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
 				"6409 Cannot post to RQ %d: %x %x\n",
 				rqb_entry->hrq->queue_id,
 				rqb_entry->hrq->host_index,
 				rqb_entry->hrq->hba_index);
+		(rqbp->rqb_free_buffer)(phba, rqb_entry);
 	} else {
 		list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
 		rqbp->buffer_count++;

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/scsi-lpfc-use-after-free-in-lpfc_rq_buf_free.patch queue-4.14/staging-ccree-uninitialized-return-in-ssi_ahash_import.patch