Skip to content
Heist/ feed
High

scsi: qla2xxx: Implement ref count for SRB

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Implement ref count for SRB The timeout handler and the done function are racing. When qla2x00_async_iocb_timeout() starts to run it can be preempted by the normal response path (via the firmware?). qla24xx_async_gpsc_sp_done() releases the SRB unconditionally. When scheduling back to qla2x00_async_iocb_timeout() qla24xx_async_abort_cmd() will access an freed sp->qpair pointer: qla2xxx [0000:83:00.0]-2871:0: Async-gpsc timeout - hdl=63d portid=234500 50:06:0e:80:08:77:b6:21. qla2xxx [0000:83:00.0]-2853:0: Async done-gpsc res 0, WWPN 50:06:0e:80:08:77:b6:21 qla2xxx [0000:83:00.0]-2854:0: Async-gpsc OUT WWPN 20:45:00:27:f8:75:33:00 speeds=2c00 speed=0400. qla2xxx [0000:83:00.0]-28d8:0: qla24xx_handle_gpsc_event 50:06:0e:80:08:77:b6:21 DS 7 LS 6 rc 0 login 1|1 rscn 1|0 lid 5 BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 IP: qla24xx_async_abort_cmd+0x1b/0x1c0 [qla2xxx] Obvious solution to this is to introduce a reference counter. One reference is taken for the normal code path (the 'good' case) and one for the timeout path. As we always race between the normal good case and the timeout/abort handler we need to serialize it. Also we cannot assume any order between the handlers. Since this is slow path we can use proper synchronization via locks. When we are able to cancel a timer (del_timer returns 1) we know there can't be any error handling in progress because the timeo

Announced Group revision 1
Original source ↗

CVE-2022-49159

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2022-49159

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "ac280b670e6d6666667aba02324e2fc50bd96ae7",
        "lessThan": "e17111dd2fda81c35f309b1e5b6ab35809a375e7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ac280b670e6d6666667aba02324e2fc50bd96ae7",
        "lessThan": "e140723f78ff418c8df7d990e102e07b65c87d4a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ac280b670e6d6666667aba02324e2fc50bd96ae7",
        "lessThan": "ceda7f794f3dfe272491e93e3e93049f8be5f07b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ac280b670e6d6666667aba02324e2fc50bd96ae7",
        "lessThan": "31e6cdbe0eae37badceb5e0d4f06cf051432fd77",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/scsi/qla2xxx/qla_bsg.c",
      "drivers/scsi/qla2xxx/qla_def.h",
      "drivers/scsi/qla2xxx/qla_edif.c",
      "drivers/scsi/qla2xxx/qla_gbl.h",
      "drivers/scsi/qla2xxx/qla_gs.c",
      "drivers/scsi/qla2xxx/qla_init.c",
      "drivers/scsi/qla2xxx/qla_inline.h",
      "drivers/scsi/qla2xxx/qla_iocb.c",
      "drivers/scsi/qla2xxx/qla_mbx.c",
      "drivers/scsi/qla2xxx/qla_mid.c",
      "drivers/scsi/qla2xxx/qla_mr.c",
      "drivers/scsi/qla2xxx/qla_os.c",
      "drivers/scsi/qla2xxx/qla_target.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.32"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.32",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.33",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "5.16.19",
        "versionType": "semver",
        "lessThanOrEqual": "5.16.*"
      },
      {
        "status": "unaffected",
        "version": "5.17.2",
        "versionType": "semver",
        "lessThanOrEqual": "5.17.*"
      },
      {
        "status": "unaffected",
        "version": "5.18",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/scsi/qla2xxx/qla_bsg.c",
      "drivers/scsi/qla2xxx/qla_def.h",
      "drivers/scsi/qla2xxx/qla_edif.c",
      "drivers/scsi/qla2xxx/qla_gbl.h",
      "drivers/scsi/qla2xxx/qla_gs.c",
      "drivers/scsi/qla2xxx/qla_init.c",
      "drivers/scsi/qla2xxx/qla_inline.h",
      "drivers/scsi/qla2xxx/qla_iocb.c",
      "drivers/scsi/qla2xxx/qla_mbx.c",
      "drivers/scsi/qla2xxx/qla_mid.c",
      "drivers/scsi/qla2xxx/qla_mr.c",
      "drivers/scsi/qla2xxx/qla_os.c",
      "drivers/scsi/qla2xxx/qla_target.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2022-49159

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30182 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement

Revision history

  1. CVE-2022-49159 · Revision 1Source updated