#1151558 AW: linux-image-6.1.0-54-amd64: [6.1.y regression] ==> lpfc: use-after-free of mboxq in lpfc_sli4_driver_resource_setup() since 6.1.178

#1151558#5
Date:
2026-10-21 15:37:09 UTC
From:
To:
Since 6.1.178 (commit 299f5baa1321, backport of upstream 1bd28625e25b "scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()"), mempool_free(mboxq) is called before lpfc_get_sli4_parameters(phba, mboxq), which still uses mboxq; the error paths after it free mboxq a second time.
On an Emulex LPe35000/36000 (10df:f400, FW 14.4.730.15) this causes slab corruption and a GPF in __kmem_cache_alloc_node during boot; the system hangs. 6.1.170 (Debian 6.1.0-45) works; 6.1.190 (Debian 6.1.0-54) fails; booting with modprobe.blacklist=lpfc avoids the crash. Reverting the backport or moving the free below lpfc_get_sli4_parameters() should fix it.

Greetings,
Tim