lpfc_els_rsp_rls_acc() drops the ndlp reference held for the MBX_READ_LNK_STAT mailbox command before it logs the ACC response and before it takes the reference that keeps the node alive while the response is being sent. If that was the last reference, ndlp is freed and the log message and lpfc_nlp_get() below touch released memory. Take the reference for the ACC iocb before dropping the mailbox one. Fixes: 12265f68ae92 ("[SCSI] lpfc 8.3.18: Add support of received ELS commands") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/scsi/lpfc/lpfc_els.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c index 4e3fe89283e4..bdf8fe3e77a5 100644 --- a/drivers/scsi/lpfc/lpfc_els.c +++ b/drivers/scsi/lpfc/lpfc_els.c @@ -8782,11 +8782,9 @@ lpfc_els_rsp_rls_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) lpfc_max_els_tries, ndlp, ndlp->nlp_DID, ELS_CMD_ACC); - /* Decrement the ndlp reference count from previous mbox command */ - lpfc_nlp_put(ndlp); - if (!elsiocb) { mempool_free(pmb, phba->mbox_mem_pool); + lpfc_nlp_put(ndlp); return; } @@ -8824,6 +8822,10 @@ lpfc_els_rsp_rls_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) elsiocb->cmd_cmpl = lpfc_cmpl_els_rsp; phba->fc_stat.elsXmitACC++; elsiocb->ndlp = lpfc_nlp_get(ndlp); + + /* Decrement the ndlp reference count from previous mbox command */ + lpfc_nlp_put(ndlp); + if (!elsiocb->ndlp) { lpfc_els_free_iocb(phba, elsiocb); return; -- 2.34.1