Description
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request __nvme_fc_init_request() maps cmd_iu and then rsp_iu for DMA. If the rsp_iu mapping fails, the original code only recorded the error and fell through: it left the already-mapped cmd_iu unmapped and still marked the op as FCPOP_STATE_IDLE before returning. Since blk-mq does not call .exit_request() when .init_request() fails, the cmd_iu mapping is leaked for every op whose rsp_iu mapping fails. Jump to an error path on rsp_iu mapping failure that unmaps cmd_iu and returns the error without marking the op idle, so it stays in the FCPOP_STATE_UNINIT state set by the initial memset().
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e399441de9115cd472b8ace6c517708273ca7997 to < c0892cfb60a75e2c86ba8e2127b133f6549c12b3affectede399441de9115cd472b8ace6c517708273ca7997 to < 5e820d04c241c81a47e1940349018690e93d8167affectede399441de9115cd472b8ace6c517708273ca7997 to < bb0251991420c25e3ceeac40ea09250d79ed7ef0affectede399441de9115cd472b8ace6c517708273ca7997 to < acc173608ca7abe5dee8983086b44efd8b0dbc84affectede399441de9115cd472b8ace6c517708273ca7997 to < 18c5781ed8bc2f423c26ec93e47e2057cd76a783affectede399441de9115cd472b8ace6c517708273ca7997 to < bd764baf82bb46e958a0bd0b481630dd71313055affectede399441de9115cd472b8ace6c517708273ca7997 to < be5eb47ee3fea338efae1a5b678d6bb5f0fcc931affectede399441de9115cd472b8ace6c517708273ca7997 to < f49d0c3a8d56a7cda1628ae17341a4a42063563caffected
Linux Linux
Default version status: affected
4.10affected0 to < 4.10unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c0892cfb60a75e2c86ba8e2127b133f6549c12b3 ↗
- https://git.kernel.org/stable/c/5e820d04c241c81a47e1940349018690e93d8167 ↗
- https://git.kernel.org/stable/c/bb0251991420c25e3ceeac40ea09250d79ed7ef0 ↗
- https://git.kernel.org/stable/c/acc173608ca7abe5dee8983086b44efd8b0dbc84 ↗
- https://git.kernel.org/stable/c/18c5781ed8bc2f423c26ec93e47e2057cd76a783 ↗
- https://git.kernel.org/stable/c/bd764baf82bb46e958a0bd0b481630dd71313055 ↗
- https://git.kernel.org/stable/c/be5eb47ee3fea338efae1a5b678d6bb5f0fcc931 ↗
- https://git.kernel.org/stable/c/f49d0c3a8d56a7cda1628ae17341a4a42063563c ↗