In the Linux kernel, the following vulnerability has been resolved:
scsi: hisi_sas: Free irq vectors in order for v3 HW
If the driver probe fails to request the channel IRQ or fatal IRQ, the driver will free the IRQ vectors before freeing the IRQs in free_irq(), and this will cause a kernel BUG like this:
------------[ cut here ]------------ kernel BUG at drivers/pci/msi.c:369! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Call trace: freemsiirqs+0x118/0x13c pcidisablemsi+0xfc/0x120 pcifreeirqvectors+0x24/0x3c hisisasv3probe+0x360/0x9d0 [hisisasv3hw] localpciprobe+0x44/0xb0 workforcpufn+0x20/0x34 processonework+0x1d0/0x340 workerthread+0x2e0/0x460 kthread+0x180/0x190 retfrom_fork+0x10/0x20 ---[ end trace b88990335b610c11 ]---
So we use devmaddaction() to control the order in which we free the vectors.
[
{
"id": "CVE-2022-49118-06f880d5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@554fb72ee34f4732c7f694f56c3c6e67790352a0",
"digest": {
"length": 2623.0,
"function_hash": "332864390483349805262030680779562069539"
},
"signature_version": "v1",
"target": {
"function": "hisi_sas_v3_probe",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-0c62ae5d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@554fb72ee34f4732c7f694f56c3c6e67790352a0",
"digest": {
"line_hashes": [
"288793390109961226136644364288257784862",
"45839957489145185811109501663857983171",
"58148548994620433079163632422094301642",
"229978411681398675879027921278254270452",
"207238736913153875626085628226475478417",
"7330335585444824272155703179993640252",
"326962612723143043460379686354787083621",
"328362180816669618985208473719514790563",
"55446409051131577695415775448797123288",
"281543212926488388473133682805407822354",
"210958735603432685981633350732399188909",
"209497237903022255886966387416136844624",
"312732475450025137095922685227502558400",
"157384684480256499883751630250294778945",
"122123820348859372050839445184370239913",
"124671672785587592365931932478532981164",
"297774917078781731674656524923696195060",
"120706934518131733584458731938936690225",
"43094524817593116143189667964321892393",
"254720745864987721330969379177028160832",
"323884058667246668257447281787074855932",
"57849966363239679716809965492259922627",
"91563613353283842786226744811204310328",
"116097927239343579518624893432991460658",
"112968142429697666386961438325764056011",
"55328354272180583783762687652605977171",
"238776622797621696303013122491000948054",
"51934210670098777619956666354672239581",
"276302904297361503447420563801160636496"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49118-17a9d25f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b6eab9d683bae7f88dc894b8c851f866032301c",
"digest": {
"line_hashes": [
"288793390109961226136644364288257784862",
"45839957489145185811109501663857983171",
"58148548994620433079163632422094301642",
"229978411681398675879027921278254270452",
"207238736913153875626085628226475478417",
"7330335585444824272155703179993640252",
"326962612723143043460379686354787083621",
"328362180816669618985208473719514790563",
"55446409051131577695415775448797123288",
"281543212926488388473133682805407822354",
"210958735603432685981633350732399188909",
"209497237903022255886966387416136844624",
"312732475450025137095922685227502558400",
"157384684480256499883751630250294778945",
"122123820348859372050839445184370239913",
"124671672785587592365931932478532981164",
"297774917078781731674656524923696195060",
"120706934518131733584458731938936690225",
"43094524817593116143189667964321892393",
"254720745864987721330969379177028160832",
"323884058667246668257447281787074855932",
"57849966363239679716809965492259922627",
"91563613353283842786226744811204310328",
"116097927239343579518624893432991460658",
"112968142429697666386961438325764056011",
"55328354272180583783762687652605977171",
"238776622797621696303013122491000948054",
"51934210670098777619956666354672239581",
"276302904297361503447420563801160636496"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49118-1ba861de",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@554fb72ee34f4732c7f694f56c3c6e67790352a0",
"digest": {
"length": 441.0,
"function_hash": "133626170352506398303351951102025216395"
},
"signature_version": "v1",
"target": {
"function": "interrupt_preinit_v3_hw",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-1ea6d028",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4cc04fa8f1fc3816c8494d77abab3f72b9d2292",
"digest": {
"length": 441.0,
"function_hash": "133626170352506398303351951102025216395"
},
"signature_version": "v1",
"target": {
"function": "interrupt_preinit_v3_hw",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-2036ec1c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f05a0d8de2ea49af36821a20b0b501e20ced937e",
"digest": {
"line_hashes": [
"288793390109961226136644364288257784862",
"45839957489145185811109501663857983171",
"58148548994620433079163632422094301642",
"229978411681398675879027921278254270452",
"207238736913153875626085628226475478417",
"7330335585444824272155703179993640252",
"326962612723143043460379686354787083621",
"328362180816669618985208473719514790563",
"55446409051131577695415775448797123288",
"281543212926488388473133682805407822354",
"210958735603432685981633350732399188909",
"209497237903022255886966387416136844624",
"312732475450025137095922685227502558400",
"157384684480256499883751630250294778945",
"122123820348859372050839445184370239913",
"124671672785587592365931932478532981164",
"272614528593514828494045436736796835770",
"120706934518131733584458731938936690225",
"43094524817593116143189667964321892393",
"254720745864987721330969379177028160832",
"323884058667246668257447281787074855932",
"57849966363239679716809965492259922627",
"91563613353283842786226744811204310328",
"116097927239343579518624893432991460658",
"112968142429697666386961438325764056011",
"55328354272180583783762687652605977171",
"238776622797621696303013122491000948054",
"51934210670098777619956666354672239581",
"276302904297361503447420563801160636496"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49118-3cd4f386",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b6eab9d683bae7f88dc894b8c851f866032301c",
"digest": {
"length": 2643.0,
"function_hash": "15490608590260349044408086384968342474"
},
"signature_version": "v1",
"target": {
"function": "hisi_sas_v3_probe",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-3e6180c8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@224903cc60d045576393c3b16907742f23e6c740",
"digest": {
"length": 2769.0,
"function_hash": "120040577360230236938875719814678990306"
},
"signature_version": "v1",
"target": {
"function": "hisi_sas_v3_probe",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-44cb6ff7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b6eab9d683bae7f88dc894b8c851f866032301c",
"digest": {
"length": 441.0,
"function_hash": "133626170352506398303351951102025216395"
},
"signature_version": "v1",
"target": {
"function": "interrupt_preinit_v3_hw",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-4f8c6623",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f05a0d8de2ea49af36821a20b0b501e20ced937e",
"digest": {
"length": 2790.0,
"function_hash": "233940849140089719001584451129613030191"
},
"signature_version": "v1",
"target": {
"function": "hisi_sas_v3_probe",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-573ec96f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@224903cc60d045576393c3b16907742f23e6c740",
"digest": {
"length": 488.0,
"function_hash": "10931607671230996630840802411279367982"
},
"signature_version": "v1",
"target": {
"function": "hisi_sas_v3_destroy_irqs",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-5c350501",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@554fb72ee34f4732c7f694f56c3c6e67790352a0",
"digest": {
"length": 488.0,
"function_hash": "10931607671230996630840802411279367982"
},
"signature_version": "v1",
"target": {
"function": "hisi_sas_v3_destroy_irqs",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-62034fb2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4cc04fa8f1fc3816c8494d77abab3f72b9d2292",
"digest": {
"length": 2623.0,
"function_hash": "332864390483349805262030680779562069539"
},
"signature_version": "v1",
"target": {
"function": "hisi_sas_v3_probe",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-72c3fa01",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4cc04fa8f1fc3816c8494d77abab3f72b9d2292",
"digest": {
"line_hashes": [
"288793390109961226136644364288257784862",
"45839957489145185811109501663857983171",
"58148548994620433079163632422094301642",
"229978411681398675879027921278254270452",
"207238736913153875626085628226475478417",
"7330335585444824272155703179993640252",
"326962612723143043460379686354787083621",
"328362180816669618985208473719514790563",
"55446409051131577695415775448797123288",
"281543212926488388473133682805407822354",
"210958735603432685981633350732399188909",
"209497237903022255886966387416136844624",
"312732475450025137095922685227502558400",
"157384684480256499883751630250294778945",
"122123820348859372050839445184370239913",
"124671672785587592365931932478532981164",
"297774917078781731674656524923696195060",
"120706934518131733584458731938936690225",
"43094524817593116143189667964321892393",
"254720745864987721330969379177028160832",
"323884058667246668257447281787074855932",
"57849966363239679716809965492259922627",
"91563613353283842786226744811204310328",
"116097927239343579518624893432991460658",
"112968142429697666386961438325764056011",
"55328354272180583783762687652605977171",
"238776622797621696303013122491000948054",
"51934210670098777619956666354672239581",
"276302904297361503447420563801160636496"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49118-7d3040f1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f05a0d8de2ea49af36821a20b0b501e20ced937e",
"digest": {
"length": 488.0,
"function_hash": "10931607671230996630840802411279367982"
},
"signature_version": "v1",
"target": {
"function": "hisi_sas_v3_destroy_irqs",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-8060af69",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@224903cc60d045576393c3b16907742f23e6c740",
"digest": {
"line_hashes": [
"288793390109961226136644364288257784862",
"45839957489145185811109501663857983171",
"58148548994620433079163632422094301642",
"229978411681398675879027921278254270452",
"207238736913153875626085628226475478417",
"7330335585444824272155703179993640252",
"326962612723143043460379686354787083621",
"328362180816669618985208473719514790563",
"55446409051131577695415775448797123288",
"281543212926488388473133682805407822354",
"210958735603432685981633350732399188909",
"209497237903022255886966387416136844624",
"312732475450025137095922685227502558400",
"157384684480256499883751630250294778945",
"122123820348859372050839445184370239913",
"124671672785587592365931932478532981164",
"272614528593514828494045436736796835770",
"120706934518131733584458731938936690225",
"43094524817593116143189667964321892393",
"254720745864987721330969379177028160832",
"203271752303674717001433365225176412054",
"57849966363239679716809965492259922627",
"91563613353283842786226744811204310328",
"101236905029385282582504284140110690853",
"93705472714029897954181448990108832208",
"55328354272180583783762687652605977171",
"238776622797621696303013122491000948054",
"51934210670098777619956666354672239581",
"276302904297361503447420563801160636496"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Line",
"deprecated": false
},
{
"id": "CVE-2022-49118-b63369ee",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@224903cc60d045576393c3b16907742f23e6c740",
"digest": {
"length": 441.0,
"function_hash": "133626170352506398303351951102025216395"
},
"signature_version": "v1",
"target": {
"function": "interrupt_preinit_v3_hw",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-cffe56ca",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f05a0d8de2ea49af36821a20b0b501e20ced937e",
"digest": {
"length": 441.0,
"function_hash": "133626170352506398303351951102025216395"
},
"signature_version": "v1",
"target": {
"function": "interrupt_preinit_v3_hw",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-f2b6509a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b4cc04fa8f1fc3816c8494d77abab3f72b9d2292",
"digest": {
"length": 488.0,
"function_hash": "10931607671230996630840802411279367982"
},
"signature_version": "v1",
"target": {
"function": "hisi_sas_v3_destroy_irqs",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
},
{
"id": "CVE-2022-49118-f931f836",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b6eab9d683bae7f88dc894b8c851f866032301c",
"digest": {
"length": 488.0,
"function_hash": "10931607671230996630840802411279367982"
},
"signature_version": "v1",
"target": {
"function": "hisi_sas_v3_destroy_irqs",
"file": "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c"
},
"signature_type": "Function",
"deprecated": false
}
]