lpfc: Fix possible use-after-free and double free in lpfc_mbx_cmpl_rdp_page_a2()
lpfc: Fix possible use-after-free and double free in lpfc_mbx_cmpl_rdp_page_a2()

If the bf_get() call in lpfc_mbx_cmpl_rdp_page_a2() does succeeds, execution
continues normally and mp gets kfree()d.

If the subsequent call to lpfc_sli_issue_mbox() fails execution jumps to the
error label where lpfc_mbuf_free() is called with mp->virt and mp->phys as
function arguments. This is the use after free. Following the use after free mp
gets kfree()d again which is a double free.

Signed-off-by: Johannes Thumshirn <76e27a2cf2160151c27b307564ef391a743f57c5@suse.de>
Acked-by: James Smart <2b041da073ece526f0738329b43a4ebfc495c725@avagotech.com>
Signed-off-by: James Bottomley <1acebbdca565c7b6b638bdc23b58b5610d1a56b8@Odin.com>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs