Description
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix possible use-after-free in transport error_recovery work While nvme_tcp_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error recovery handler itself changing the ctrl state.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3f2304f8c6d6ed97849057bd16fee99e434ca796 to < 61a26ffd5ad3ece456d74c4c79f7b5e3f440a141affected3f2304f8c6d6ed97849057bd16fee99e434ca796 to < e192184cf8bce8dd55d619f5611a2eaba996fa05affected3f2304f8c6d6ed97849057bd16fee99e434ca796 to < 5e42fca37ccc76f39f73732661bd47254cad5982affected3f2304f8c6d6ed97849057bd16fee99e434ca796 to < bb0d8fb35c4ff00a503c2c4dca4cce8d102a21c4affected3f2304f8c6d6ed97849057bd16fee99e434ca796 to < ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9eaffected
Linux Linux
Default version status: affected
5.0affected0 to < 5.0unaffected5.4.181 to ≤ 5.4.*unaffected5.10.102 to ≤ 5.10.*unaffected5.15.25 to ≤ 5.15.*unaffected5.16.11 to ≤ 5.16.*unaffected5.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/61a26ffd5ad3ece456d74c4c79f7b5e3f440a141 ↗
- https://git.kernel.org/stable/c/e192184cf8bce8dd55d619f5611a2eaba996fa05 ↗
- https://git.kernel.org/stable/c/5e42fca37ccc76f39f73732661bd47254cad5982 ↗
- https://git.kernel.org/stable/c/bb0d8fb35c4ff00a503c2c4dca4cce8d102a21c4 ↗
- https://git.kernel.org/stable/c/ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9e ↗