cve/published/2024/CVE-2024-26931.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2024-26931: scsi: qla2xxx: Fix command flush on cable pull

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 scsi: qla2xxx: Fix command flush on cable pull

 System crash due to command failed to flush back to SCSI layer.

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
  PGD 0 P4D 0
  Oops: 0000 [#1] SMP NOPTI
  CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G           OE    --------- -  - 4.18.0-372.9.1.el8.x86_64 #1
  Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021
  Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc]
  RIP: 0010:__wake_up_common+0x4c/0x190
  Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75
  RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086
  RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000
  RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320
  RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8
  R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20
  R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
  FS:  0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  PKRU: 55555554
  Call Trace:
   __wake_up_common_lock+0x7c/0xc0
   qla_nvme_ls_req+0x355/0x4c0 [qla2xxx]
  qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0
  ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc]
  qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200.
   ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc]
  qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1
  ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc]
  qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0
   ? __switch_to+0x10c/0x450
  ? process_one_work+0x1a7/0x360
  qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201.
   ? worker_thread+0x1ce/0x390
   ? create_worker+0x1a0/0x1a0
  qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70
   ? kthread+0x10a/0x120
  qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8
   ? set_kthread_struct+0x40/0x40
  qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed.
   ? ret_from_fork+0x1f/0x40
  qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout

 The system was under memory stress where driver was not able to allocate an
 SRB to carry out error recovery of cable pull.  The failure to flush causes
 upper layer to start modifying scsi_cmnd.  When the system frees up some
 memory, the subsequent cable pull trigger another command flush. At this
 point the driver access a null pointer when attempting to DMA unmap the
 SGL.

 Add a check to make sure commands are flush back on session tear down to
 prevent the null pointer access.

 The Linux kernel CVE team has assigned CVE-2024-26931 to this issue.


 Affected and fixed versions
 ===========================

 	Fixed in 4.19.312 with commit b73377124f56d2fec154737c2f8d2e839c237d5a
 	Fixed in 5.4.274 with commit d7a68eee87b05d4e29419e6f151aef99314970a9
 	Fixed in 5.10.215 with commit 67b2d35853c2da25a8ca1c4190a5e96d3083c2ac
 	Fixed in 5.15.154 with commit a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a
 	Fixed in 6.1.84 with commit 09c0ac18cac206ed1218b1fe6c1a0918e5ea9211
 	Fixed in 6.6.24 with commit 8de1584ec4fe0ebea33c273036e7e0a05e65c81d
 	Fixed in 6.7.12 with commit 8f0d32004e3a572bb77e6c11c2797c87f8c9703d
 	Fixed in 6.8.3 with commit ec7587eef003cab15a13446d67c3adb88146a150
 	Fixed in 6.9 with commit a27d4d0e7de305def8a5098a614053be208d1aa1

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2024-26931
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	drivers/scsi/qla2xxx/qla_target.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a
 	https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9
 	https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac
 	https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a
 	https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211
 	https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d
 	https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d
 	https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150
 	https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2024-26931: scsi: qla2xxx: Fix command flush on cable pull

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	scsi: qla2xxx: Fix command flush on cable pull

	System crash due to command failed to flush back to SCSI layer.

	BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
	PGD 0 P4D 0
	Oops: 0000 [#1] SMP NOPTI
	CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1
	Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021
	Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc]
	RIP: 0010:__wake_up_common+0x4c/0x190
	Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75
	RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086
	RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000
	RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320
	RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8
	R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20
	R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000
	FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000
	CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0
	DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
	DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
	PKRU: 55555554
	Call Trace:
	__wake_up_common_lock+0x7c/0xc0
	qla_nvme_ls_req+0x355/0x4c0 [qla2xxx]
	qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loop_id 0x02 s_id 01:02:00 logout 1 keep 0 els_logo 0
	? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc]
	qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200.
	? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc]
	qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320002ac07eeb8. rport ffff8ae598122000 roles 1
	? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc]
	qla2xxx [0000:12:00.1]-f084:3: qlt_free_session_done: se_sess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loop_id 0x04 s_id 01:02:01 logout 1 keep 0 els_logo 0
	? __switch_to+0x10c/0x450
	? process_one_work+0x1a7/0x360
	qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201.
	? worker_thread+0x1ce/0x390
	? create_worker+0x1a0/0x1a0
	qla2xxx [0000:12:00.1]-2109:3: qla2x00_schedule_rport_del 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70
	? kthread+0x10a/0x120
	qla2xxx [0000:12:00.1]-2112:3: qla_nvme_unregister_remote_port: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8
	? set_kthread_struct+0x40/0x40
	qla2xxx [0000:12:00.1]-2110:3: remoteport_delete of ffff8ae14801e000 21320102adf7eeb8 completed.
	? ret_from_fork+0x1f/0x40
	qla2xxx [0000:12:00.1]-f086:3: qlt_free_session_done: waiting for sess ffff8ae14801e000 logout

	The system was under memory stress where driver was not able to allocate an
	SRB to carry out error recovery of cable pull. The failure to flush causes
	upper layer to start modifying scsi_cmnd. When the system frees up some
	memory, the subsequent cable pull trigger another command flush. At this
	point the driver access a null pointer when attempting to DMA unmap the
	SGL.

	Add a check to make sure commands are flush back on session tear down to
	prevent the null pointer access.

	The Linux kernel CVE team has assigned CVE-2024-26931 to this issue.


	Affected and fixed versions
	===========================

	Fixed in 4.19.312 with commit b73377124f56d2fec154737c2f8d2e839c237d5a
	Fixed in 5.4.274 with commit d7a68eee87b05d4e29419e6f151aef99314970a9
	Fixed in 5.10.215 with commit 67b2d35853c2da25a8ca1c4190a5e96d3083c2ac
	Fixed in 5.15.154 with commit a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a
	Fixed in 6.1.84 with commit 09c0ac18cac206ed1218b1fe6c1a0918e5ea9211
	Fixed in 6.6.24 with commit 8de1584ec4fe0ebea33c273036e7e0a05e65c81d
	Fixed in 6.7.12 with commit 8f0d32004e3a572bb77e6c11c2797c87f8c9703d
	Fixed in 6.8.3 with commit ec7587eef003cab15a13446d67c3adb88146a150
	Fixed in 6.9 with commit a27d4d0e7de305def8a5098a614053be208d1aa1

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26931
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	drivers/scsi/qla2xxx/qla_target.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/b73377124f56d2fec154737c2f8d2e839c237d5a
	https://git.kernel.org/stable/c/d7a68eee87b05d4e29419e6f151aef99314970a9
	https://git.kernel.org/stable/c/67b2d35853c2da25a8ca1c4190a5e96d3083c2ac
	https://git.kernel.org/stable/c/a859f6a8f4234b8ef62862bf7a92f1af5f8cd47a
	https://git.kernel.org/stable/c/09c0ac18cac206ed1218b1fe6c1a0918e5ea9211
	https://git.kernel.org/stable/c/8de1584ec4fe0ebea33c273036e7e0a05e65c81d
	https://git.kernel.org/stable/c/8f0d32004e3a572bb77e6c11c2797c87f8c9703d
	https://git.kernel.org/stable/c/ec7587eef003cab15a13446d67c3adb88146a150
	https://git.kernel.org/stable/c/a27d4d0e7de305def8a5098a614053be208d1aa1