| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-42287: scsi: qla2xxx: Complete command early within lock |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| scsi: qla2xxx: Complete command early within lock |
| |
| A crash was observed while performing NPIV and FW reset, |
| |
| BUG: kernel NULL pointer dereference, address: 000000000000001c |
| #PF: supervisor read access in kernel mode |
| #PF: error_code(0x0000) - not-present page |
| PGD 0 P4D 0 |
| Oops: 0000 1 PREEMPT_RT SMP NOPTI |
| RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0 |
| RSP: 0018:ffffc90026f47b88 EFLAGS: 00010246 |
| RAX: 0000000000000000 RBX: 0000000000000021 RCX: 0000000000000002 |
| RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff8881041130d0 |
| RBP: ffff8881041130d0 R08: 0000000000000000 R09: 0000000000000034 |
| R10: ffffc90026f47c48 R11: 0000000000000031 R12: 0000000000000000 |
| R13: 0000000000000000 R14: ffff8881565e4a20 R15: 0000000000000000 |
| FS: 00007f4c69ed3d00(0000) GS:ffff889faac80000(0000) knlGS:0000000000000000 |
| CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| CR2: 000000000000001c CR3: 0000000288a50002 CR4: 00000000007706e0 |
| DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 |
| DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 |
| PKRU: 55555554 |
| Call Trace: |
| <TASK> |
| ? __die_body+0x1a/0x60 |
| ? page_fault_oops+0x16f/0x4a0 |
| ? do_user_addr_fault+0x174/0x7f0 |
| ? exc_page_fault+0x69/0x1a0 |
| ? asm_exc_page_fault+0x22/0x30 |
| ? dma_direct_unmap_sg+0x51/0x1e0 |
| ? preempt_count_sub+0x96/0xe0 |
| qla2xxx_qpair_sp_free_dma+0x29f/0x3b0 [qla2xxx] |
| qla2xxx_qpair_sp_compl+0x60/0x80 [qla2xxx] |
| __qla2x00_abort_all_cmds+0xa2/0x450 [qla2xxx] |
| |
| The command completion was done early while aborting the commands in driver |
| unload path but outside lock to avoid the WARN_ON condition of performing |
| dma_free_attr within the lock. However this caused race condition while |
| command completion via multiple paths causing system crash. |
| |
| Hence complete the command early in unload path but within the lock to |
| avoid race condition. |
| |
| The Linux kernel CVE team has assigned CVE-2024-42287 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.4.240 with commit 9189f20b4c5307c0998682bb522e481b4567a8b8 and fixed in 5.4.282 with commit af46649304b0c9cede4ccfc2be2561ce8ed6a2ea |
| Issue introduced in 5.10.177 with commit 231cfa78ec5badd84a1a2b09465bfad1a926aba1 and fixed in 5.10.224 with commit 57ba7563712227647f82a92547e82c96cd350553 |
| Issue introduced in 5.15.105 with commit d6f7377528d2abf338e504126e44439541be8f7d and fixed in 5.15.165 with commit 9117337b04d789bd08fdd9854a40bec2815cd3f6 |
| Issue introduced in 6.1.22 with commit cd0a1804ac5bab2545ac700c8d0fe9ae9284c567 and fixed in 6.1.103 with commit 814f4a53cc86f7ea8b501bfb1723f24fd29ef5ee |
| Issue introduced in 6.3 with commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9 and fixed in 6.6.44 with commit 314efe3f87949a568f512f05df20bf47b81cf232 |
| Issue introduced in 6.3 with commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9 and fixed in 6.10.3 with commit 36fdc5319c4d0ec8b8938ec4769764098a246bfb |
| Issue introduced in 6.3 with commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9 and fixed in 6.11 with commit 4475afa2646d3fec176fc4d011d3879b26cb26e3 |
| Issue introduced in 6.2.9 with commit 415d614344a4f1bbddf55d724fc7eb9ef4b39aad |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-42287 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/scsi/qla2xxx/qla_os.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/af46649304b0c9cede4ccfc2be2561ce8ed6a2ea |
| https://git.kernel.org/stable/c/57ba7563712227647f82a92547e82c96cd350553 |
| https://git.kernel.org/stable/c/9117337b04d789bd08fdd9854a40bec2815cd3f6 |
| https://git.kernel.org/stable/c/814f4a53cc86f7ea8b501bfb1723f24fd29ef5ee |
| https://git.kernel.org/stable/c/314efe3f87949a568f512f05df20bf47b81cf232 |
| https://git.kernel.org/stable/c/36fdc5319c4d0ec8b8938ec4769764098a246bfb |
| https://git.kernel.org/stable/c/4475afa2646d3fec176fc4d011d3879b26cb26e3 |
