| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49159: scsi: qla2xxx: Implement ref count for SRB |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| scsi: qla2xxx: Implement ref count for SRB |
| |
| The timeout handler and the done function are racing. When |
| qla2x00_async_iocb_timeout() starts to run it can be preempted by the |
| normal response path (via the firmware?). qla24xx_async_gpsc_sp_done() |
| releases the SRB unconditionally. When scheduling back to |
| qla2x00_async_iocb_timeout() qla24xx_async_abort_cmd() will access an freed |
| sp->qpair pointer: |
| |
| qla2xxx [0000:83:00.0]-2871:0: Async-gpsc timeout - hdl=63d portid=234500 50:06:0e:80:08:77:b6:21. |
| qla2xxx [0000:83:00.0]-2853:0: Async done-gpsc res 0, WWPN 50:06:0e:80:08:77:b6:21 |
| qla2xxx [0000:83:00.0]-2854:0: Async-gpsc OUT WWPN 20:45:00:27:f8:75:33:00 speeds=2c00 speed=0400. |
| qla2xxx [0000:83:00.0]-28d8:0: qla24xx_handle_gpsc_event 50:06:0e:80:08:77:b6:21 DS 7 LS 6 rc 0 login 1|1 rscn 1|0 lid 5 |
| BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 |
| IP: qla24xx_async_abort_cmd+0x1b/0x1c0 [qla2xxx] |
| |
| Obvious solution to this is to introduce a reference counter. One reference |
| is taken for the normal code path (the 'good' case) and one for the timeout |
| path. As we always race between the normal good case and the timeout/abort |
| handler we need to serialize it. Also we cannot assume any order between |
| the handlers. Since this is slow path we can use proper synchronization via |
| locks. |
| |
| When we are able to cancel a timer (del_timer returns 1) we know there |
| can't be any error handling in progress because the timeout handler hasn't |
| expired yet, thus we can safely decrement the refcounter by one. |
| |
| If we are not able to cancel the timer, we know an abort handler is |
| running. We have to make sure we call sp->done() in the abort handlers |
| before calling kref_put(). |
| |
| The Linux kernel CVE team has assigned CVE-2022-49159 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.15 with commit 7ebb336e45ef1ce23462c3bbd03779929008901f and fixed in 5.15.33 with commit e17111dd2fda81c35f309b1e5b6ab35809a375e7 |
| Issue introduced in 5.15 with commit 7ebb336e45ef1ce23462c3bbd03779929008901f and fixed in 5.16.19 with commit e140723f78ff418c8df7d990e102e07b65c87d4a |
| Issue introduced in 5.15 with commit 7ebb336e45ef1ce23462c3bbd03779929008901f and fixed in 5.17.2 with commit ceda7f794f3dfe272491e93e3e93049f8be5f07b |
| Issue introduced in 5.15 with commit 7ebb336e45ef1ce23462c3bbd03779929008901f and fixed in 5.18 with commit 31e6cdbe0eae37badceb5e0d4f06cf051432fd77 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49159 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/scsi/qla2xxx/qla_bsg.c |
| drivers/scsi/qla2xxx/qla_def.h |
| drivers/scsi/qla2xxx/qla_edif.c |
| drivers/scsi/qla2xxx/qla_gbl.h |
| drivers/scsi/qla2xxx/qla_gs.c |
| drivers/scsi/qla2xxx/qla_init.c |
| drivers/scsi/qla2xxx/qla_inline.h |
| drivers/scsi/qla2xxx/qla_iocb.c |
| drivers/scsi/qla2xxx/qla_mbx.c |
| drivers/scsi/qla2xxx/qla_mid.c |
| drivers/scsi/qla2xxx/qla_mr.c |
| drivers/scsi/qla2xxx/qla_os.c |
| drivers/scsi/qla2xxx/qla_target.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/e17111dd2fda81c35f309b1e5b6ab35809a375e7 |
| https://git.kernel.org/stable/c/e140723f78ff418c8df7d990e102e07b65c87d4a |
| https://git.kernel.org/stable/c/ceda7f794f3dfe272491e93e3e93049f8be5f07b |
| https://git.kernel.org/stable/c/31e6cdbe0eae37badceb5e0d4f06cf051432fd77 |
