cve/published/2024/CVE-2024-36919.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload

 The session resources are used by FW and driver when session is offloaded,
 once session is uploaded these resources are not used. The lock is not
 required as these fields won't be used any longer. The offload and upload
 calls are sequential, hence lock is not required.

 This will suppress following BUG_ON():

 [  449.843143] ------------[ cut here ]------------
 [  449.848302] kernel BUG at mm/vmalloc.c:2727!
 [  449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI
 [  449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1
 Rebooting.
 [  449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016
 [  449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc]
 [  449.882910] RIP: 0010:vunmap+0x2e/0x30
 [  449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41
 [  449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206
 [  449.913887] RAX: 0000000080000201 RBX: ffff8f4355133550 RCX: 000000000d400005
 [  449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI: ffffb83da53f5000
 [  449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf
 [  449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000
 [  449.945736] R13: 0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0
 [  449.953701] FS:  0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000
 [  449.962732] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 [  449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0
 [  449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 [  449.985065] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
 [  449.993028] Call Trace:
 [  449.995756]  __iommu_dma_free+0x96/0x100
 [  450.000139]  bnx2fc_free_session_resc+0x67/0x240 [bnx2fc]
 [  450.006171]  bnx2fc_upload_session+0xce/0x100 [bnx2fc]
 [  450.011910]  bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc]
 [  450.018136]  fc_rport_work+0x103/0x5b0 [libfc]
 [  450.023103]  process_one_work+0x1e8/0x3c0
 [  450.027581]  worker_thread+0x50/0x3b0
 [  450.031669]  ? rescuer_thread+0x370/0x370
 [  450.036143]  kthread+0x149/0x170
 [  450.039744]  ? set_kthread_struct+0x40/0x40
 [  450.044411]  ret_from_fork+0x22/0x30
 [  450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls
 [  450.048497]  libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler
 [  450.159753] ---[ end trace 712de2c57c64abc8 ]---

 The Linux kernel CVE team has assigned CVE-2024-36919 to this issue.


 Affected and fixed versions
 ===========================

 	Fixed in 4.19.314 with commit 468f3e3c15076338367b0945b041105b67cf31e3
 	Fixed in 5.4.276 with commit acd370c1fb86b7302c1cbb354a7c1cd9953768eb
 	Fixed in 5.10.217 with commit ad498539dda0816aadef384ec117bfea304c75c3
 	Fixed in 5.15.159 with commit 93aa5ccc44781bdfef1bf0bc4c2c292d45251312
 	Fixed in 6.1.91 with commit 1150606d47d711d5bfdf329a1a96ed7027085936
 	Fixed in 6.6.31 with commit c885ab23206b1f1ba0731ffe7c9455c6a91db256
 	Fixed in 6.8.10 with commit ea50941cd8c9f0b12f38b73d3b1bfeca660dd342
 	Fixed in 6.9 with commit c214ed2a4dda35b308b0b28eed804d7ae66401f9

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2024-36919
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	drivers/scsi/bnx2fc/bnx2fc_tgt.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/468f3e3c15076338367b0945b041105b67cf31e3
 	https://git.kernel.org/stable/c/acd370c1fb86b7302c1cbb354a7c1cd9953768eb
 	https://git.kernel.org/stable/c/ad498539dda0816aadef384ec117bfea304c75c3
 	https://git.kernel.org/stable/c/93aa5ccc44781bdfef1bf0bc4c2c292d45251312
 	https://git.kernel.org/stable/c/1150606d47d711d5bfdf329a1a96ed7027085936
 	https://git.kernel.org/stable/c/c885ab23206b1f1ba0731ffe7c9455c6a91db256
 	https://git.kernel.org/stable/c/ea50941cd8c9f0b12f38b73d3b1bfeca660dd342
 	https://git.kernel.org/stable/c/c214ed2a4dda35b308b0b28eed804d7ae66401f9
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2024-36919: scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload

	The session resources are used by FW and driver when session is offloaded,
	once session is uploaded these resources are not used. The lock is not
	required as these fields won't be used any longer. The offload and upload
	calls are sequential, hence lock is not required.

	This will suppress following BUG_ON():

	[ 449.843143] ------------[ cut here ]------------
	[ 449.848302] kernel BUG at mm/vmalloc.c:2727!
	[ 449.853072] invalid opcode: 0000 [#1] PREEMPT SMP PTI
	[ 449.858712] CPU: 5 PID: 1996 Comm: kworker/u24:2 Not tainted 5.14.0-118.el9.x86_64 #1
	Rebooting.
	[ 449.867454] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.3.4 11/08/2016
	[ 449.876966] Workqueue: fc_rport_eq fc_rport_work [libfc]
	[ 449.882910] RIP: 0010:vunmap+0x2e/0x30
	[ 449.887098] Code: 00 65 8b 05 14 a2 f0 4a a9 00 ff ff 00 75 1b 55 48 89 fd e8 34 36 79 00 48 85 ed 74 0b 48 89 ef 31 f6 5d e9 14 fc ff ff 5d c3 <0f> 0b 0f 1f 44 00 00 41 57 41 56 49 89 ce 41 55 49 89 fd 41 54 41
	[ 449.908054] RSP: 0018:ffffb83d878b3d68 EFLAGS: 00010206
	[ 449.913887] RAX: 0000000080000201 RBX: ffff8f4355133550 RCX: 000000000d400005
	[ 449.921843] RDX: 0000000000000001 RSI: 0000000000001000 RDI: ffffb83da53f5000
	[ 449.929808] RBP: ffff8f4ac6675800 R08: ffffb83d878b3d30 R09: 00000000000efbdf
	[ 449.937774] R10: 0000000000000003 R11: ffff8f434573e000 R12: 0000000000001000
	[ 449.945736] R13: 0000000000001000 R14: ffffb83da53f5000 R15: ffff8f43d4ea3ae0
	[ 449.953701] FS: 0000000000000000(0000) GS:ffff8f529fc80000(0000) knlGS:0000000000000000
	[ 449.962732] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
	[ 449.969138] CR2: 00007f8cf993e150 CR3: 0000000efbe10003 CR4: 00000000003706e0
	[ 449.977102] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
	[ 449.985065] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
	[ 449.993028] Call Trace:
	[ 449.995756] __iommu_dma_free+0x96/0x100
	[ 450.000139] bnx2fc_free_session_resc+0x67/0x240 [bnx2fc]
	[ 450.006171] bnx2fc_upload_session+0xce/0x100 [bnx2fc]
	[ 450.011910] bnx2fc_rport_event_handler+0x9f/0x240 [bnx2fc]
	[ 450.018136] fc_rport_work+0x103/0x5b0 [libfc]
	[ 450.023103] process_one_work+0x1e8/0x3c0
	[ 450.027581] worker_thread+0x50/0x3b0
	[ 450.031669] ? rescuer_thread+0x370/0x370
	[ 450.036143] kthread+0x149/0x170
	[ 450.039744] ? set_kthread_struct+0x40/0x40
	[ 450.044411] ret_from_fork+0x22/0x30
	[ 450.048404] Modules linked in: vfat msdos fat xfs nfs_layout_nfsv41_files rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver dm_service_time qedf qed crc8 bnx2fc libfcoe libfc scsi_transport_fc intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp dcdbas rapl intel_cstate intel_uncore mei_me pcspkr mei ipmi_ssif lpc_ich ipmi_si fuse zram ext4 mbcache jbd2 loop nfsv3 nfs_acl nfs lockd grace fscache netfs irdma ice sd_mod t10_pi sg ib_uverbs ib_core 8021q garp mrp stp llc mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt mxm_wmi fb_sys_fops cec crct10dif_pclmul ahci crc32_pclmul bnx2x drm ghash_clmulni_intel libahci rfkill i40e libata megaraid_sas mdio wmi sunrpc lrw dm_crypt dm_round_robin dm_multipath dm_snapshot dm_bufio dm_mirror dm_region_hash dm_log dm_zero dm_mod linear raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx raid6_pq libcrc32c crc32c_intel raid1 raid0 iscsi_ibft squashfs be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls
	[ 450.048497] libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi edd ipmi_devintf ipmi_msghandler
	[ 450.159753] ---[ end trace 712de2c57c64abc8 ]---

	The Linux kernel CVE team has assigned CVE-2024-36919 to this issue.


	Affected and fixed versions
	===========================

	Fixed in 4.19.314 with commit 468f3e3c15076338367b0945b041105b67cf31e3
	Fixed in 5.4.276 with commit acd370c1fb86b7302c1cbb354a7c1cd9953768eb
	Fixed in 5.10.217 with commit ad498539dda0816aadef384ec117bfea304c75c3
	Fixed in 5.15.159 with commit 93aa5ccc44781bdfef1bf0bc4c2c292d45251312
	Fixed in 6.1.91 with commit 1150606d47d711d5bfdf329a1a96ed7027085936
	Fixed in 6.6.31 with commit c885ab23206b1f1ba0731ffe7c9455c6a91db256
	Fixed in 6.8.10 with commit ea50941cd8c9f0b12f38b73d3b1bfeca660dd342
	Fixed in 6.9 with commit c214ed2a4dda35b308b0b28eed804d7ae66401f9

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-36919
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	drivers/scsi/bnx2fc/bnx2fc_tgt.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/468f3e3c15076338367b0945b041105b67cf31e3
	https://git.kernel.org/stable/c/acd370c1fb86b7302c1cbb354a7c1cd9953768eb
	https://git.kernel.org/stable/c/ad498539dda0816aadef384ec117bfea304c75c3
	https://git.kernel.org/stable/c/93aa5ccc44781bdfef1bf0bc4c2c292d45251312
	https://git.kernel.org/stable/c/1150606d47d711d5bfdf329a1a96ed7027085936
	https://git.kernel.org/stable/c/c885ab23206b1f1ba0731ffe7c9455c6a91db256
	https://git.kernel.org/stable/c/ea50941cd8c9f0b12f38b73d3b1bfeca660dd342
	https://git.kernel.org/stable/c/c214ed2a4dda35b308b0b28eed804d7ae66401f9