Skip to content

[ciqlts9 4] 2 VULNS #779

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
roxanan1996 wants to merge 2 commits into
base: ciqlts9_4
Choose a base branch
from
Open

[ciqlts9 4] 2 VULNS #779

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9c93236
powerpc/pseries/memhp: Fix access beyond end of drmem array
roxanan1996 Dec 17, 2025
49d1189
scsi: lpfc: Fix buffer free/clear order in deferred receive path
roxanan1996 Dec 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions arch/powerpc/platforms/pseries/hotplug-memory.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -501,14 +501,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index)
}
}

if (!lmb_found)
if (!lmb_found) {
pr_debug("Failed to look up LMB for drc index %x\n", drc_index);
rc = -EINVAL;

if (rc)
} else if (rc) {
pr_debug("Failed to hot-remove memory at %llx\n",
lmb->base_addr);
else
} else {
pr_debug("Memory at %llx was hot-removed\n", lmb->base_addr);
}

return rc;
}
Expand Down
10 changes: 6 additions & 4 deletions drivers/scsi/lpfc/lpfc_nvmet.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1245,31 +1245,33 @@ lpfc_nvmet_defer_rcv(struct nvmet_fc_target_port *tgtport,
struct lpfc_nvmet_tgtport *tgtp;
struct lpfc_async_xchg_ctx *ctxp =
container_of(rsp, struct lpfc_async_xchg_ctx, hdlrctx.fcp_req);
struct rqb_dmabuf *nvmebuf = ctxp->rqb_buffer;
struct rqb_dmabuf *nvmebuf;
struct lpfc_hba *phba = ctxp->phba;
unsigned long iflag;


lpfc_nvmeio_data(phba, "NVMET DEFERRCV: xri x%x sz %d CPU %02x\n",
ctxp->oxid, ctxp->size, raw_smp_processor_id());

spin_lock_irqsave(&ctxp->ctxlock, iflag);
nvmebuf = ctxp->rqb_buffer;
if (!nvmebuf) {
spin_unlock_irqrestore(&ctxp->ctxlock, iflag);
lpfc_printf_log(phba, KERN_INFO, LOG_NVME_IOERR,
"6425 Defer rcv: no buffer oxid x%x: "
"flg %x ste %x\n",
ctxp->oxid, ctxp->flag, ctxp->state);
return;
}
ctxp->rqb_buffer = NULL;
spin_unlock_irqrestore(&ctxp->ctxlock, iflag);

tgtp = phba->targetport->private;
if (tgtp)
atomic_inc(&tgtp->rcv_fcp_cmd_defer);

/* Free the nvmebuf since a new buffer already replaced it */
nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
spin_lock_irqsave(&ctxp->ctxlock, iflag);
ctxp->rqb_buffer = NULL;
spin_unlock_irqrestore(&ctxp->ctxlock, iflag);
}

/**
Expand Down