In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
If lpfcissueels_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference.
Similarly, when processing non-zero ELS PLOGI completion status in lpfccmplelsplogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfcdevlosstmo_handler() results in a use after free ndlp dereference.
Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling.
[
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-03ccd9ab",
"digest": {
"function_hash": "1145742288075980213634356214676997953",
"length": 311.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604",
"signature_type": "Function",
"target": {
"function": "lpfc_initial_fdisc",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-2b99e5ba",
"digest": {
"function_hash": "191757456897299402320331026563470632329",
"length": 3454.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_plogi",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-2c3cc219",
"digest": {
"function_hash": "191757456897299402320331026563470632329",
"length": 3454.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_plogi",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-2eff7294",
"digest": {
"line_hashes": [
"118749103532777762746405084571479949492",
"223003368217785725846202112354432139280",
"34249398854114949879272874340660338694",
"275385895335179328146721532945110861218",
"265568018505035468461865746813230239424",
"216272754264935547006606881291533234422",
"336194052918816643462367478951935129707",
"275385895335179328146721532945110861218",
"208096699697646892288064241299141982877",
"303182423121830329302009742344807914",
"189599367387060143827004821108908758860",
"55719398642530314046324928063042816136",
"115375269774481160066821097237623720863",
"224347100241300310081256167344147299601",
"180961499948472265035097701937225221829",
"180666938181743373592821304564143890877",
"245472269055664561237341942019864488520",
"332414133892687346552670209181299471524",
"239751382046503956993711308545717742514",
"146292083286979978287209402092170078617",
"34412646505071982164405581922972305225",
"213411497213277871149612701883073884041",
"89591819423877956928088031724082879331",
"154328172155348152695278283791462329962",
"93715771589539223537012073944027804906",
"265324732309078044638669622320901431742",
"320019641824652690695760654953127840091",
"31369289633488800273690117403375518885",
"283606940821144504368160213080273776815",
"228585536153758295735132769391872999392",
"126344696352201183356765648443661451265",
"118165606077125710472042946673025502805",
"332414133892687346552670209181299471524",
"239751382046503956993711308545717742514",
"146292083286979978287209402092170078617",
"34412646505071982164405581922972305225",
"16480447528037249793860383921921855517",
"57802807177675102210584764990743859485",
"88477879909434709946988253934437368063",
"81501033674721578441254735902475649033",
"181479739296208540513622574926002010289",
"157255383395184009746091231443372914920",
"230502617037054819996551066881826708443",
"274126107915438891819416597380473996642",
"61205009887984054067406094098071015402",
"245472269055664561237341942019864488520",
"332414133892687346552670209181299471524",
"239751382046503956993711308545717742514",
"146292083286979978287209402092170078617",
"317807532251472516702578532259469788892",
"275184043653261104104758250896096387581",
"319144148816678297331719554395521035404"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424",
"signature_type": "Line",
"target": {
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-36dc1f45",
"digest": {
"function_hash": "317277274882809709917304679312943952948",
"length": 1756.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_adisc",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-48ee75f0",
"digest": {
"function_hash": "191153548437163310291762200043001099863",
"length": 1720.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_prli",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-53c0b091",
"digest": {
"function_hash": "84658533482250004607653672285129081195",
"length": 1704.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_prli",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-5ce396e8",
"digest": {
"line_hashes": [
"24098607799357765413020013880032185748",
"143680043463754362559755346387293168925",
"34249398854114949879272874340660338694",
"275385895335179328146721532945110861218",
"265568018505035468461865746813230239424",
"216272754264935547006606881291533234422",
"336194052918816643462367478951935129707",
"275385895335179328146721532945110861218",
"134866799611207121519457670758993577963",
"12114438711939919462034575214166215872",
"248597652973689120039352195573948824488",
"161197087306474687417639505843186670299",
"115375269774481160066821097237623720863",
"224347100241300310081256167344147299601",
"180961499948472265035097701937225221829",
"180666938181743373592821304564143890877",
"245472269055664561237341942019864488520",
"332414133892687346552670209181299471524",
"239751382046503956993711308545717742514",
"146292083286979978287209402092170078617",
"34412646505071982164405581922972305225",
"213411497213277871149612701883073884041",
"89591819423877956928088031724082879331",
"165597667918795846894183264090555067023",
"107363777155022242946766519820592021533",
"225873159023394709050330148170990246958",
"266750826813264092811671780416333126529",
"112576789503192856046169262421031705305",
"303153779327203140835681569341122229272",
"225127287214141093574717340844541013308",
"126344696352201183356765648443661451265",
"118165606077125710472042946673025502805",
"332414133892687346552670209181299471524",
"239751382046503956993711308545717742514",
"146292083286979978287209402092170078617",
"34412646505071982164405581922972305225",
"16480447528037249793860383921921855517",
"57802807177675102210584764990743859485",
"60375395558636242277918521392355559489",
"108474545266420056657678741060486154061",
"265864880389980917523771160816680081438",
"108193403960512621329116777570538795873",
"69743849405139716939131962895569237953",
"274126107915438891819416597380473996642",
"61205009887984054067406094098071015402",
"245472269055664561237341942019864488520",
"332414133892687346552670209181299471524",
"239751382046503956993711308545717742514",
"146292083286979978287209402092170078617",
"317807532251472516702578532259469788892",
"275184043653261104104758250896096387581",
"319144148816678297331719554395521035404"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604",
"signature_type": "Line",
"target": {
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-6990ed46",
"digest": {
"function_hash": "309700711681468624096389317909078340165",
"length": 400.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424",
"signature_type": "Function",
"target": {
"function": "lpfc_initial_flogi",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-6dd447f7",
"digest": {
"function_hash": "251629900461854044295825456189443161649",
"length": 1821.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_adisc",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-808ad10f",
"digest": {
"function_hash": "1145742288075980213634356214676997953",
"length": 311.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df",
"signature_type": "Function",
"target": {
"function": "lpfc_initial_fdisc",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-82ef753f",
"digest": {
"function_hash": "223439922889844219165128938576715093616",
"length": 367.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df",
"signature_type": "Function",
"target": {
"function": "lpfc_initial_flogi",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-85dcfaf3",
"digest": {
"line_hashes": [
"24098607799357765413020013880032185748",
"143680043463754362559755346387293168925",
"34249398854114949879272874340660338694",
"275385895335179328146721532945110861218",
"265568018505035468461865746813230239424",
"216272754264935547006606881291533234422",
"336194052918816643462367478951935129707",
"275385895335179328146721532945110861218",
"208096699697646892288064241299141982877",
"303182423121830329302009742344807914",
"189599367387060143827004821108908758860",
"55719398642530314046324928063042816136",
"115375269774481160066821097237623720863",
"224347100241300310081256167344147299601",
"180961499948472265035097701937225221829",
"180666938181743373592821304564143890877",
"245472269055664561237341942019864488520",
"332414133892687346552670209181299471524",
"239751382046503956993711308545717742514",
"146292083286979978287209402092170078617",
"34412646505071982164405581922972305225",
"213411497213277871149612701883073884041",
"89591819423877956928088031724082879331",
"154328172155348152695278283791462329962",
"93715771589539223537012073944027804906",
"265324732309078044638669622320901431742",
"320019641824652690695760654953127840091",
"31369289633488800273690117403375518885",
"283606940821144504368160213080273776815",
"228585536153758295735132769391872999392",
"126344696352201183356765648443661451265",
"118165606077125710472042946673025502805",
"332414133892687346552670209181299471524",
"239751382046503956993711308545717742514",
"146292083286979978287209402092170078617",
"34412646505071982164405581922972305225",
"16480447528037249793860383921921855517",
"57802807177675102210584764990743859485",
"88477879909434709946988253934437368063",
"81501033674721578441254735902475649033",
"181479739296208540513622574926002010289",
"157255383395184009746091231443372914920",
"230502617037054819996551066881826708443",
"274126107915438891819416597380473996642",
"61205009887984054067406094098071015402",
"245472269055664561237341942019864488520",
"332414133892687346552670209181299471524",
"239751382046503956993711308545717742514",
"146292083286979978287209402092170078617",
"317807532251472516702578532259469788892",
"275184043653261104104758250896096387581",
"319144148816678297331719554395521035404"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df",
"signature_type": "Line",
"target": {
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-8edc0aba",
"digest": {
"function_hash": "267900120926325476998626823832912119033",
"length": 3503.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_plogi",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-96a47309",
"digest": {
"function_hash": "1145742288075980213634356214676997953",
"length": 311.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424",
"signature_type": "Function",
"target": {
"function": "lpfc_initial_fdisc",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-974b36b9",
"digest": {
"function_hash": "223439922889844219165128938576715093616",
"length": 367.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604",
"signature_type": "Function",
"target": {
"function": "lpfc_initial_flogi",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-9d8ac7e0",
"digest": {
"function_hash": "251629900461854044295825456189443161649",
"length": 1821.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_adisc",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2022-49535-a73b8805",
"digest": {
"function_hash": "84658533482250004607653672285129081195",
"length": 1704.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424",
"signature_type": "Function",
"target": {
"function": "lpfc_cmpl_els_prli",
"file": "drivers/scsi/lpfc/lpfc_els.c"
}
}
]