Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI If lpfc_issue_els_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference. Similarly, when processing non-zero ELS PLOGI completion status in lpfc_cmpl_els_plogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfc_dev_loss_tmo_handler() results in a use after free ndlp dereference. Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 52edb2caf675684acf2140a125de4774c691fecd before c7dc74ab7975c9b96284abfe4cca756d75fa4604; affected 52edb2caf675684acf2140a125de4774c691fecd before 10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df; affected 52edb2caf675684acf2140a125de4774c691fecd before 577a942df3de2666f6947bdd3a5c9e8d30073424 |
| Linux / Linux | affected 5.11; unaffected 0 before 5.11; unaffected 5.15.181 through 5.15.*; unaffected 5.18.3 through 5.18.*; unaffected 5.19 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/c7dc74ab7975c9b96284abfe4cca756d75fa4604
- https://git.kernel.org/stable/c/10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df
- https://git.kernel.org/stable/c/577a942df3de2666f6947bdd3a5c9e8d30073424
ADP enrichment
No English description supplied.
No references supplied.