In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix crash when I/O abort times out
While performing CPU hotplug, a crash with the following stack was seen:
Call Trace: qla24xxprocessresponsequeue+0x42a/0x970 [qla2xxx] qla2x00startnvmemq+0x3a2/0x4b0 [qla2xxx] qlanvmepostcmd+0x166/0x240 [qla2xxx] nvmefcstartfcpop.part.0+0x119/0x2e0 [nvmefc] blkmqdispatchrqlist+0x17b/0x610 _blkmqscheddispatchrequests+0xb0/0x140 blkmqscheddispatchrequests+0x30/0x60 _blkmqrunhwqueue+0x35/0x90 _blkmqdelayrunhwqueue+0x161/0x180 blkexecuterq+0xbe/0x160 _nvmesubmitsynccmd+0x16f/0x220 [nvmecore] nvmfconnectadminqueue+0x11a/0x170 [nvmefabrics] nvmefccreateassociation.cold+0x50/0x3dc [nvmefc] nvmefcconnectctrlwork+0x19/0x30 [nvmefc] processonework+0x1e8/0x3c0
On abort timeout, completion was called without checking if the I/O was already completed.
Verify that I/O and abort request are indeed outstanding before attempting completion.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50493.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-50493.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05382ed9142cf8a8a3fb662224477eecc415778b",
"digest": {
"function_hash": "317535355744527012777016338968174257027",
"length": 1081.0
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "qla24xx_abort_iocb_timeout",
"file": "drivers/scsi/qla2xxx/qla_init.c"
},
"id": "CVE-2022-50493-40518443"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb4dff498468b62e8c520568559b3a9007e104d7",
"digest": {
"line_hashes": [
"64530748143216337412927030684120732070",
"89965928984479727763254542686096674334",
"116700414676056465196296079613873437034",
"333958893671089974257393446252080149599",
"152213012115123775314035178593914356212",
"53577159239761670503108330697923652724",
"127668156795675829515810299286988270367",
"2672264946809016834927681260735069161",
"251076767735412310691397929801893451659",
"16475842995563556173975640137151920106",
"65605405076994186569593857261719874783",
"49410199946750843527743773748366974005",
"272034163562973547147650485922998500932",
"246925010785694497012097280959136010551",
"64921658509829198563878386426310237874",
"277302378717079262901259227484388376627",
"193504391778096068886996831033743478137",
"171481014794870337601925034290917989085",
"39799276571969026084738256552520160917",
"234268009634412662294040809753817811049"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/scsi/qla2xxx/qla_init.c"
},
"id": "CVE-2022-50493-4744a8e3"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb4dff498468b62e8c520568559b3a9007e104d7",
"digest": {
"function_hash": "317535355744527012777016338968174257027",
"length": 1081.0
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "qla24xx_abort_iocb_timeout",
"file": "drivers/scsi/qla2xxx/qla_init.c"
},
"id": "CVE-2022-50493-57c6b636"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3871af13aa03fbbe7fbb812eaf140501229a72e",
"digest": {
"line_hashes": [
"64530748143216337412927030684120732070",
"89965928984479727763254542686096674334",
"116700414676056465196296079613873437034",
"333958893671089974257393446252080149599",
"152213012115123775314035178593914356212",
"53577159239761670503108330697923652724",
"127668156795675829515810299286988270367",
"2672264946809016834927681260735069161",
"251076767735412310691397929801893451659",
"16475842995563556173975640137151920106",
"65605405076994186569593857261719874783",
"49410199946750843527743773748366974005",
"272034163562973547147650485922998500932",
"246925010785694497012097280959136010551",
"64921658509829198563878386426310237874",
"277302378717079262901259227484388376627",
"193504391778096068886996831033743478137",
"171481014794870337601925034290917989085",
"39799276571969026084738256552520160917",
"234268009634412662294040809753817811049"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/scsi/qla2xxx/qla_init.c"
},
"id": "CVE-2022-50493-6d8eef77"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68ad83188d782b2ecef2e41ac245d27e0710fe8e",
"digest": {
"function_hash": "317535355744527012777016338968174257027",
"length": 1081.0
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "qla24xx_abort_iocb_timeout",
"file": "drivers/scsi/qla2xxx/qla_init.c"
},
"id": "CVE-2022-50493-74a86507"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3871af13aa03fbbe7fbb812eaf140501229a72e",
"digest": {
"function_hash": "317535355744527012777016338968174257027",
"length": 1081.0
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "qla24xx_abort_iocb_timeout",
"file": "drivers/scsi/qla2xxx/qla_init.c"
},
"id": "CVE-2022-50493-982b68d9"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68ad83188d782b2ecef2e41ac245d27e0710fe8e",
"digest": {
"line_hashes": [
"64530748143216337412927030684120732070",
"89965928984479727763254542686096674334",
"116700414676056465196296079613873437034",
"333958893671089974257393446252080149599",
"152213012115123775314035178593914356212",
"53577159239761670503108330697923652724",
"127668156795675829515810299286988270367",
"2672264946809016834927681260735069161",
"251076767735412310691397929801893451659",
"16475842995563556173975640137151920106",
"65605405076994186569593857261719874783",
"49410199946750843527743773748366974005",
"272034163562973547147650485922998500932",
"246925010785694497012097280959136010551",
"64921658509829198563878386426310237874",
"277302378717079262901259227484388376627",
"193504391778096068886996831033743478137",
"171481014794870337601925034290917989085",
"39799276571969026084738256552520160917",
"234268009634412662294040809753817811049"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/scsi/qla2xxx/qla_init.c"
},
"id": "CVE-2022-50493-beeee25f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@05382ed9142cf8a8a3fb662224477eecc415778b",
"digest": {
"line_hashes": [
"64530748143216337412927030684120732070",
"89965928984479727763254542686096674334",
"116700414676056465196296079613873437034",
"333958893671089974257393446252080149599",
"152213012115123775314035178593914356212",
"53577159239761670503108330697923652724",
"127668156795675829515810299286988270367",
"2672264946809016834927681260735069161",
"251076767735412310691397929801893451659",
"16475842995563556173975640137151920106",
"65605405076994186569593857261719874783",
"49410199946750843527743773748366974005",
"272034163562973547147650485922998500932",
"246925010785694497012097280959136010551",
"64921658509829198563878386426310237874",
"277302378717079262901259227484388376627",
"193504391778096068886996831033743478137",
"171481014794870337601925034290917989085",
"39799276571969026084738256552520160917",
"234268009634412662294040809753817811049"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/scsi/qla2xxx/qla_init.c"
},
"id": "CVE-2022-50493-fbd82d29"
}
]