In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
If lpfcissueels_flogi() fails and returns non-zero status, the node reference count is decremented to trigger the release of the nodelist structure. However, if there is a prior registration or dev-loss-evt work pending, the node may be released prematurely. When dev-loss-evt completes, the released node is referenced causing a use-after-free null pointer dereference.
Similarly, when processing non-zero ELS PLOGI completion status in lpfccmplelsplogi(), the ndlp flags are checked for a transport registration before triggering node removal. If dev-loss-evt work is pending, the node may be released prematurely and a subsequent call to lpfcdevlosstmo_handler() results in a use after free ndlp dereference.
Add test for pending dev-loss before decrementing the node reference count for FLOGI, PLOGI, PRLI, and ADISC handling.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604", "target": { "function": "lpfc_initial_fdisc", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "1145742288075980213634356214676997953", "length": 311.0 }, "deprecated": false, "id": "CVE-2022-49535-03ccd9ab", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424", "target": { "function": "lpfc_cmpl_els_plogi", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "191757456897299402320331026563470632329", "length": 3454.0 }, "deprecated": false, "id": "CVE-2022-49535-2b99e5ba", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df", "target": { "function": "lpfc_cmpl_els_plogi", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "191757456897299402320331026563470632329", "length": 3454.0 }, "deprecated": false, "id": "CVE-2022-49535-2c3cc219", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424", "target": { "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "line_hashes": [ "118749103532777762746405084571479949492", "223003368217785725846202112354432139280", "34249398854114949879272874340660338694", "275385895335179328146721532945110861218", "265568018505035468461865746813230239424", "216272754264935547006606881291533234422", "336194052918816643462367478951935129707", "275385895335179328146721532945110861218", "208096699697646892288064241299141982877", "303182423121830329302009742344807914", "189599367387060143827004821108908758860", "55719398642530314046324928063042816136", "115375269774481160066821097237623720863", "224347100241300310081256167344147299601", "180961499948472265035097701937225221829", "180666938181743373592821304564143890877", "245472269055664561237341942019864488520", "332414133892687346552670209181299471524", "239751382046503956993711308545717742514", "146292083286979978287209402092170078617", "34412646505071982164405581922972305225", "213411497213277871149612701883073884041", "89591819423877956928088031724082879331", "154328172155348152695278283791462329962", "93715771589539223537012073944027804906", "265324732309078044638669622320901431742", "320019641824652690695760654953127840091", "31369289633488800273690117403375518885", "283606940821144504368160213080273776815", "228585536153758295735132769391872999392", "126344696352201183356765648443661451265", "118165606077125710472042946673025502805", "332414133892687346552670209181299471524", "239751382046503956993711308545717742514", "146292083286979978287209402092170078617", "34412646505071982164405581922972305225", "16480447528037249793860383921921855517", "57802807177675102210584764990743859485", "88477879909434709946988253934437368063", "81501033674721578441254735902475649033", "181479739296208540513622574926002010289", "157255383395184009746091231443372914920", "230502617037054819996551066881826708443", "274126107915438891819416597380473996642", "61205009887984054067406094098071015402", "245472269055664561237341942019864488520", "332414133892687346552670209181299471524", "239751382046503956993711308545717742514", "146292083286979978287209402092170078617", "317807532251472516702578532259469788892", "275184043653261104104758250896096387581", "319144148816678297331719554395521035404" ], "threshold": 0.9 }, "deprecated": false, "id": "CVE-2022-49535-2eff7294", "signature_version": "v1", "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604", "target": { "function": "lpfc_cmpl_els_adisc", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "317277274882809709917304679312943952948", "length": 1756.0 }, "deprecated": false, "id": "CVE-2022-49535-36dc1f45", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604", "target": { "function": "lpfc_cmpl_els_prli", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "191153548437163310291762200043001099863", "length": 1720.0 }, "deprecated": false, "id": "CVE-2022-49535-48ee75f0", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df", "target": { "function": "lpfc_cmpl_els_prli", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "84658533482250004607653672285129081195", "length": 1704.0 }, "deprecated": false, "id": "CVE-2022-49535-53c0b091", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604", "target": { "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "line_hashes": [ "24098607799357765413020013880032185748", "143680043463754362559755346387293168925", "34249398854114949879272874340660338694", "275385895335179328146721532945110861218", "265568018505035468461865746813230239424", "216272754264935547006606881291533234422", "336194052918816643462367478951935129707", "275385895335179328146721532945110861218", "134866799611207121519457670758993577963", "12114438711939919462034575214166215872", "248597652973689120039352195573948824488", "161197087306474687417639505843186670299", "115375269774481160066821097237623720863", "224347100241300310081256167344147299601", "180961499948472265035097701937225221829", "180666938181743373592821304564143890877", "245472269055664561237341942019864488520", "332414133892687346552670209181299471524", "239751382046503956993711308545717742514", "146292083286979978287209402092170078617", "34412646505071982164405581922972305225", "213411497213277871149612701883073884041", "89591819423877956928088031724082879331", "165597667918795846894183264090555067023", "107363777155022242946766519820592021533", "225873159023394709050330148170990246958", "266750826813264092811671780416333126529", "112576789503192856046169262421031705305", "303153779327203140835681569341122229272", "225127287214141093574717340844541013308", "126344696352201183356765648443661451265", "118165606077125710472042946673025502805", "332414133892687346552670209181299471524", "239751382046503956993711308545717742514", "146292083286979978287209402092170078617", "34412646505071982164405581922972305225", "16480447528037249793860383921921855517", "57802807177675102210584764990743859485", "60375395558636242277918521392355559489", "108474545266420056657678741060486154061", "265864880389980917523771160816680081438", "108193403960512621329116777570538795873", "69743849405139716939131962895569237953", "274126107915438891819416597380473996642", "61205009887984054067406094098071015402", "245472269055664561237341942019864488520", "332414133892687346552670209181299471524", "239751382046503956993711308545717742514", "146292083286979978287209402092170078617", "317807532251472516702578532259469788892", "275184043653261104104758250896096387581", "319144148816678297331719554395521035404" ], "threshold": 0.9 }, "deprecated": false, "id": "CVE-2022-49535-5ce396e8", "signature_version": "v1", "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424", "target": { "function": "lpfc_initial_flogi", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "309700711681468624096389317909078340165", "length": 400.0 }, "deprecated": false, "id": "CVE-2022-49535-6990ed46", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df", "target": { "function": "lpfc_cmpl_els_adisc", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "251629900461854044295825456189443161649", "length": 1821.0 }, "deprecated": false, "id": "CVE-2022-49535-6dd447f7", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df", "target": { "function": "lpfc_initial_fdisc", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "1145742288075980213634356214676997953", "length": 311.0 }, "deprecated": false, "id": "CVE-2022-49535-808ad10f", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df", "target": { "function": "lpfc_initial_flogi", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "223439922889844219165128938576715093616", "length": 367.0 }, "deprecated": false, "id": "CVE-2022-49535-82ef753f", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@10663ebec0ad5c78493a0dd34c9ee4d73d7ca0df", "target": { "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "line_hashes": [ "24098607799357765413020013880032185748", "143680043463754362559755346387293168925", "34249398854114949879272874340660338694", "275385895335179328146721532945110861218", "265568018505035468461865746813230239424", "216272754264935547006606881291533234422", "336194052918816643462367478951935129707", "275385895335179328146721532945110861218", "208096699697646892288064241299141982877", "303182423121830329302009742344807914", "189599367387060143827004821108908758860", "55719398642530314046324928063042816136", "115375269774481160066821097237623720863", "224347100241300310081256167344147299601", "180961499948472265035097701937225221829", "180666938181743373592821304564143890877", "245472269055664561237341942019864488520", "332414133892687346552670209181299471524", "239751382046503956993711308545717742514", "146292083286979978287209402092170078617", "34412646505071982164405581922972305225", "213411497213277871149612701883073884041", "89591819423877956928088031724082879331", "154328172155348152695278283791462329962", "93715771589539223537012073944027804906", "265324732309078044638669622320901431742", "320019641824652690695760654953127840091", "31369289633488800273690117403375518885", "283606940821144504368160213080273776815", "228585536153758295735132769391872999392", "126344696352201183356765648443661451265", "118165606077125710472042946673025502805", "332414133892687346552670209181299471524", "239751382046503956993711308545717742514", "146292083286979978287209402092170078617", "34412646505071982164405581922972305225", "16480447528037249793860383921921855517", "57802807177675102210584764990743859485", "88477879909434709946988253934437368063", "81501033674721578441254735902475649033", "181479739296208540513622574926002010289", "157255383395184009746091231443372914920", "230502617037054819996551066881826708443", "274126107915438891819416597380473996642", "61205009887984054067406094098071015402", "245472269055664561237341942019864488520", "332414133892687346552670209181299471524", "239751382046503956993711308545717742514", "146292083286979978287209402092170078617", "317807532251472516702578532259469788892", "275184043653261104104758250896096387581", "319144148816678297331719554395521035404" ], "threshold": 0.9 }, "deprecated": false, "id": "CVE-2022-49535-85dcfaf3", "signature_version": "v1", "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604", "target": { "function": "lpfc_cmpl_els_plogi", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "267900120926325476998626823832912119033", "length": 3503.0 }, "deprecated": false, "id": "CVE-2022-49535-8edc0aba", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424", "target": { "function": "lpfc_initial_fdisc", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "1145742288075980213634356214676997953", "length": 311.0 }, "deprecated": false, "id": "CVE-2022-49535-96a47309", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dc74ab7975c9b96284abfe4cca756d75fa4604", "target": { "function": "lpfc_initial_flogi", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "223439922889844219165128938576715093616", "length": 367.0 }, "deprecated": false, "id": "CVE-2022-49535-974b36b9", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424", "target": { "function": "lpfc_cmpl_els_adisc", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "251629900461854044295825456189443161649", "length": 1821.0 }, "deprecated": false, "id": "CVE-2022-49535-9d8ac7e0", "signature_version": "v1", "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@577a942df3de2666f6947bdd3a5c9e8d30073424", "target": { "function": "lpfc_cmpl_els_prli", "file": "drivers/scsi/lpfc/lpfc_els.c" }, "digest": { "function_hash": "84658533482250004607653672285129081195", "length": 1704.0 }, "deprecated": false, "id": "CVE-2022-49535-a73b8805", "signature_version": "v1", "signature_type": "Function" } ]