Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix cs84xx use-after-free on host teardown qla84xx_put_chip() drops the last reference to ha->cs84xx and frees it via __qla84xx_chip_release() without clearing ha->cs84xx. During teardown it ran before scsi_remove_host(), which is what removes the 84xx_fw_version host sysfs attribute. A concurrent read of that attribute in the window between the two calls executes qla24xx_84xx_fw_version_show(), which dereferences the freed ha->cs84xx, resulting in a use-after-free. Move qla84xx_put_chip() to after scsi_remove_host() in both qla2x00_remove_one() and qla2x00_disable_board_on_pci_error(). Once scsi_remove_host() returns, the sysfs attribute is gone and kernfs has drained any in-flight show(), so no reader can touch cs84xx; the put still runs before the host and ha are freed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fe1b806f4f7172b1eae18ddeebb7d8fb351043f7 to < 8c1ebcade6aac58137f2645b579894301febabf3affectedfe1b806f4f7172b1eae18ddeebb7d8fb351043f7 to < 1d8bbc4344b9367d9d54731475d745fbc9ea28f2affectedfe1b806f4f7172b1eae18ddeebb7d8fb351043f7 to < 2c3b17ee53f034936f7398dbf4d143e608b7c35caffectedfe1b806f4f7172b1eae18ddeebb7d8fb351043f7 to < ae09260be7454ed7630a913f147591a25e3a9d09affectedfe1b806f4f7172b1eae18ddeebb7d8fb351043f7 to < fcf0804dfe05862007189ac9dc4dc2063be36de1affectedfe1b806f4f7172b1eae18ddeebb7d8fb351043f7 to < 8286a9095fb59751fba171afa2b4f590271c87d5affectedfe1b806f4f7172b1eae18ddeebb7d8fb351043f7 to < 122bf170c94a3797531b12fee580639a5dc893edaffectedfe1b806f4f7172b1eae18ddeebb7d8fb351043f7 to < 33d102102d925357c5fd172dd6672a27d74b3215affected
Linux Linux
Default version status: affected
3.14affected0 to < 3.14unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8c1ebcade6aac58137f2645b579894301febabf3 ↗
- https://git.kernel.org/stable/c/1d8bbc4344b9367d9d54731475d745fbc9ea28f2 ↗
- https://git.kernel.org/stable/c/2c3b17ee53f034936f7398dbf4d143e608b7c35c ↗
- https://git.kernel.org/stable/c/ae09260be7454ed7630a913f147591a25e3a9d09 ↗
- https://git.kernel.org/stable/c/fcf0804dfe05862007189ac9dc4dc2063be36de1 ↗
- https://git.kernel.org/stable/c/8286a9095fb59751fba171afa2b4f590271c87d5 ↗
- https://git.kernel.org/stable/c/122bf170c94a3797531b12fee580639a5dc893ed ↗
- https://git.kernel.org/stable/c/33d102102d925357c5fd172dd6672a27d74b3215 ↗