In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix use after free on unload
System crash is observed with stack trace warning of use after free. There are 2 signals to tell dpcthread to terminate (UNLOADING flag and kthreadstop).
On setting the UNLOADING flag when dpcthread happens to run at the time and sees the flag, this causes dpcthread to exit and clean up itself. When kthread_stop is called for final cleanup, this causes use after free.
Remove UNLOADING signal to terminate dpcthread. Use the kthreadstop as the main signal to exit dpc_thread.
[596663.812935] kernel BUG at mm/slub.c:294! [596663.812950] invalid opcode: 0000 [#1] SMP PTI [596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G IOE --------- - - 4.18.0-240.el8.x8664 #1 [596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012 [596663.812974] RIP: 0010:slabfree+0x17d/0x360
... [596663.813008] Call Trace: [596663.813022] ? _dentrykill+0x121/0x170 [596663.813030] ? condresched+0x15/0x30 [596663.813034] ? condresched+0x15/0x30 [596663.813039] ? waitforcompletion+0x35/0x190 [596663.813048] ? trytowakeup+0x63/0x540 [596663.813055] freetask+0x5a/0x60 [596663.813061] kthreadstop+0xf3/0x100 [596663.813103] qla2x00remove_one+0x284/0x440 [qla2xxx]
[ { "signature_type": "Function", "id": "CVE-2024-56623-15532d76", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca36d9d53745d5ec8946ef85006d4da605ea7c54", "signature_version": "v1", "target": { "function": "qla2x00_do_dpc", "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "function_hash": "200972355065372116149355837334914263919", "length": 7512.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-56623-177a97cc", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07c903db0a2ff84b68efa1a74a4de353ea591eb0", "signature_version": "v1", "target": { "function": "qla2x00_do_dpc", "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "function_hash": "299388267907637942397719692562796594345", "length": 7427.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-56623-1f7e8926", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07c903db0a2ff84b68efa1a74a4de353ea591eb0", "signature_version": "v1", "target": { "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "95759418447424100217360660650284102797", "93900078240278641754124874570877597048", "70433165177294846424542442129237401769", "254236059271967428328917724897899902068", "90152866493539860616273406546759779663", "276221776401504567395731610416786357884", "113986286650971137507244335058727055304", "172258551665692902944541778111903964021", "287754185540213256026502999070155853879", "56344226862421052181984827893363923260", "79476948694832690549731761649505563109", "339411345353440532868783548561873052804", "29384193901223151523591080190635472710", "107818629781699234579732361197656091547", "241058662175764236734236515755524478360", "124603843267463662796254711626908797780", "191633629983902816341778444556874356313", "186563269487392722120324143610196083443", "221584001830755484481079303432536405012", "90010761636977620279217937274451862519" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-56623-2107a413", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3e6f25176f248762a24d25ab8cf8c5e90874f80", "signature_version": "v1", "target": { "function": "qla2x00_do_dpc", "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "function_hash": "200972355065372116149355837334914263919", "length": 7512.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-56623-5092e090", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15369e774f27ec790f207de87c0b541e3f90b22d", "signature_version": "v1", "target": { "function": "qla2x00_do_dpc", "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "function_hash": "299388267907637942397719692562796594345", "length": 7427.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-56623-5b836651", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abf16d3c915b2feb68c1c8b25fcb71b13f98478", "signature_version": "v1", "target": { "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "95759418447424100217360660650284102797", "93900078240278641754124874570877597048", "70433165177294846424542442129237401769", "254236059271967428328917724897899902068", "90152866493539860616273406546759779663", "276221776401504567395731610416786357884", "113986286650971137507244335058727055304", "172258551665692902944541778111903964021", "287754185540213256026502999070155853879", "56344226862421052181984827893363923260", "79476948694832690549731761649505563109", "339411345353440532868783548561873052804", "29384193901223151523591080190635472710", "107818629781699234579732361197656091547", "241058662175764236734236515755524478360", "124603843267463662796254711626908797780", "191633629983902816341778444556874356313", "186563269487392722120324143610196083443", "221584001830755484481079303432536405012", "90010761636977620279217937274451862519" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-56623-8bbb3906", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3e6f25176f248762a24d25ab8cf8c5e90874f80", "signature_version": "v1", "target": { "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "95759418447424100217360660650284102797", "93900078240278641754124874570877597048", "70433165177294846424542442129237401769", "254236059271967428328917724897899902068", "90152866493539860616273406546759779663", "276221776401504567395731610416786357884", "113986286650971137507244335058727055304", "172258551665692902944541778111903964021", "287754185540213256026502999070155853879", "56344226862421052181984827893363923260", "79476948694832690549731761649505563109", "339411345353440532868783548561873052804", "29384193901223151523591080190635472710", "107818629781699234579732361197656091547", "241058662175764236734236515755524478360", "124603843267463662796254711626908797780", "191633629983902816341778444556874356313", "186563269487392722120324143610196083443", "221584001830755484481079303432536405012", "90010761636977620279217937274451862519" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-56623-a5f476b8", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12f04fc8580eafb0510f805749553eb6213f323e", "signature_version": "v1", "target": { "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "95759418447424100217360660650284102797", "93900078240278641754124874570877597048", "70433165177294846424542442129237401769", "254236059271967428328917724897899902068", "90152866493539860616273406546759779663", "276221776401504567395731610416786357884", "113986286650971137507244335058727055304", "172258551665692902944541778111903964021", "287754185540213256026502999070155853879", "56344226862421052181984827893363923260", "79476948694832690549731761649505563109", "339411345353440532868783548561873052804", "29384193901223151523591080190635472710", "107818629781699234579732361197656091547", "241058662175764236734236515755524478360", "124603843267463662796254711626908797780", "191633629983902816341778444556874356313", "186563269487392722120324143610196083443", "221584001830755484481079303432536405012", "90010761636977620279217937274451862519" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-56623-ad4186da", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abf16d3c915b2feb68c1c8b25fcb71b13f98478", "signature_version": "v1", "target": { "function": "qla2x00_do_dpc", "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "function_hash": "299388267907637942397719692562796594345", "length": 7427.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-56623-c642d72d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12f04fc8580eafb0510f805749553eb6213f323e", "signature_version": "v1", "target": { "function": "qla2x00_do_dpc", "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "function_hash": "200972355065372116149355837334914263919", "length": 7512.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-56623-e7feb87b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca36d9d53745d5ec8946ef85006d4da605ea7c54", "signature_version": "v1", "target": { "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "95759418447424100217360660650284102797", "93900078240278641754124874570877597048", "70433165177294846424542442129237401769", "254236059271967428328917724897899902068", "90152866493539860616273406546759779663", "276221776401504567395731610416786357884", "113986286650971137507244335058727055304", "172258551665692902944541778111903964021", "287754185540213256026502999070155853879", "56344226862421052181984827893363923260", "79476948694832690549731761649505563109", "339411345353440532868783548561873052804", "29384193901223151523591080190635472710", "107818629781699234579732361197656091547", "241058662175764236734236515755524478360", "124603843267463662796254711626908797780", "191633629983902816341778444556874356313", "186563269487392722120324143610196083443", "221584001830755484481079303432536405012", "90010761636977620279217937274451862519" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-56623-f69235c3", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15369e774f27ec790f207de87c0b541e3f90b22d", "signature_version": "v1", "target": { "file": "drivers/scsi/qla2xxx/qla_os.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "95759418447424100217360660650284102797", "93900078240278641754124874570877597048", "70433165177294846424542442129237401769", "254236059271967428328917724897899902068", "90152866493539860616273406546759779663", "276221776401504567395731610416786357884", "113986286650971137507244335058727055304", "172258551665692902944541778111903964021", "287754185540213256026502999070155853879", "56344226862421052181984827893363923260", "79476948694832690549731761649505563109", "339411345353440532868783548561873052804", "29384193901223151523591080190635472710", "107818629781699234579732361197656091547", "241058662175764236734236515755524478360", "124603843267463662796254711626908797780", "191633629983902816341778444556874356313", "186563269487392722120324143610196083443", "221584001830755484481079303432536405012", "90010761636977620279217937274451862519" ] }, "deprecated": false } ]