linux-cve-announce - CVE-2021-47203: scsi: lpfc: Fix list_add() corruption in lpfc_drain

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 10 Apr 2024 20:57:52 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2021-47203: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()

When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass
the requests to the adapter. If such an attempt fails, a local "fail_msg"
string is set and a log message output.  The job is then added to a
completions list for cancellation.

Processing of any further jobs from the txq list continues, but since
"fail_msg" remains set, jobs are added to the completions list regardless
of whether a wqe was passed to the adapter.  If successfully added to
txcmplq, jobs are added to both lists resulting in list corruption.

Fix by clearing the fail_msg string after adding a job to the completions
list. This stops the subsequent jobs from being added to the completions
list unless they had an appropriate failure.

The Linux kernel CVE team has assigned CVE-2021-47203 to this issue.

Affected and fixed versions
===========================

	Fixed in 4.4.293 with commit ad4776b5eb2e
	Fixed in 4.9.291 with commit ec70d80a8642
	Fixed in 4.14.256 with commit f05a0191b901
	Fixed in 4.19.218 with commit b291d147d026
	Fixed in 5.4.162 with commit 16bcbfb56d75
	Fixed in 5.10.82 with commit c097bd5a5916
	Fixed in 5.15.5 with commit 814d3610c4ce
	Fixed in 5.16 with commit 99154581b05c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47203
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/scsi/lpfc/lpfc_sli.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ad4776b5eb2e58af1226847fcd3b4f6d051674dd
	https://git.kernel.org/stable/c/ec70d80a8642900086447ba0cdc79e3f44d42e8f
	https://git.kernel.org/stable/c/f05a0191b90156e539cccc189b9d87ca2a4d9305
	https://git.kernel.org/stable/c/b291d147d0268e93ad866f8bc820ea14497abc9b
	https://git.kernel.org/stable/c/16bcbfb56d759c25665f786e33ec633b9508a08f
	https://git.kernel.org/stable/c/c097bd5a59162156d9c2077a2f58732ffbaa9fca
	https://git.kernel.org/stable/c/814d3610c4ce86e8cf285b2cdac0057a42e82de5
	https://git.kernel.org/stable/c/99154581b05c8fb22607afb7c3d66c1bace6aa5d