scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list
In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list When freeing slots in function slot_complete_v3_hw(), it is possible that sas_dev.list is being traversed elsewhere, and it may trigger a NULL pointer exception, such as follows: ==>cq thread ==>scsi_eh_6 ==>scsi_error_handler() ==>sas_eh_handle_sas_errors() ==>sas_scsi_find_task() ==>lldd_abort_task() ==>slot_complete_v3_hw() ==>hisi_sas_abort_task() ==>hisi_sas_slot_task_free() ==>dereg_device_v3_hw() ==>list_del_init() ==>list_for_each_entry_safe() [ 7165.434918] sas: Enter sas_scsi_recover_host busy: 32 failed: 32 [ 7165.434926] sas: trying to find task 0x00000000769b5ba5 [ 7165.434927] sas: sas_scsi_find_task: aborting task 0x00000000769b5ba5 [ 7165.434940] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000769b5ba5) aborted [ 7165.434964] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000c9f7aa07) ignored [ 7165.434965] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(00000000e2a1cf01) ignored [ 7165.434968] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 7165.434972] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(0000000022d52d93) ignored [ 7165.434975] hisi_sas_v3_hw 0000:b4:02.0: slot complete: task(0000000066a7516c) ignored [ 7165.434976] Mem abort info: [ 7165.434982] ESR = 0x96000004 [ 7165.434991] Exception class = DABT (current EL), IL = 32 bits [ 7165.434992] SET =
CVE-2023-53627
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-53627
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "47caad1577cd7a39e2048c5e4edbce4b863dc12b",
"lessThan": "6fb177f10d87b8d816402c488e83506d0fb5340a",
"versionType": "git"
},
{
"status": "affected",
"version": "47caad1577cd7a39e2048c5e4edbce4b863dc12b",
"lessThan": "6e2a40b3a332ea84079983be21c944de8ddbc4f3",
"versionType": "git"
},
{
"status": "affected",
"version": "47caad1577cd7a39e2048c5e4edbce4b863dc12b",
"lessThan": "71fb36b5ff113a7674710b9d6063241eada84ff7",
"versionType": "git"
}
],
"programFiles": [
"drivers/scsi/hisi_sas/hisi_sas.h",
"drivers/scsi/hisi_sas/hisi_sas_main.c",
"drivers/scsi/hisi_sas/hisi_sas_v1_hw.c",
"drivers/scsi/hisi_sas/hisi_sas_v2_hw.c",
"drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.3.4",
"versionType": "semver",
"lessThanOrEqual": "6.3.*"
},
{
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/scsi/hisi_sas/hisi_sas.h",
"drivers/scsi/hisi_sas/hisi_sas_main.c",
"drivers/scsi/hisi_sas/hisi_sas_v1_hw.c",
"drivers/scsi/hisi_sas/hisi_sas_v2_hw.c",
"drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-53627
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #8217 · Revision 1
- Added to Heist Feed
- Publisher date