Description
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort() A race can occur between the MCQ completion path and the abort handler: once a request completes, __blk_mq_free_request() sets rq->mq_hctx to NULL, meaning the subsequent ufshcd_mcq_req_to_hwq() call in ufshcd_mcq_abort() can return a NULL pointer. If this NULL pointer is dereferenced, the kernel will crash. Add a NULL check for the returned hwq pointer. If hwq is NULL, log an error and return FAILED, preventing a potential NULL-pointer dereference. As suggested by Bart, the ufshcd_cmd_inflight() check is removed. This is similar to the fix in commit 74736103fb41 ("scsi: ufs: core: Fix ufshcd_abort_one racing issue"). This is found by our static analysis tool KNighter.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f1304d4420777f82a1d844c606db3d9eca841765 to < d6979fabe812a168d5053e5a41d5a2e9b8afd7bfaffectedf1304d4420777f82a1d844c606db3d9eca841765 to < 7d002f591486f5ef4bc02eb02025a53f931f0eb5affectedf1304d4420777f82a1d844c606db3d9eca841765 to < 47eec518aef3814f64a5da43df81bdd74d8c0041affectedf1304d4420777f82a1d844c606db3d9eca841765 to < 4c324085062919d4e21c69e5e78456dcec0052feaffected
Linux Linux
Default version status: affected
6.5affected0 to < 6.5unaffected6.6.89 to ≤ 6.6.*unaffected6.12.26 to ≤ 6.12.*unaffected6.14.5 to ≤ 6.14.*unaffected6.15 to ≤ *unaffected