High · published April 10, 2024
In the Linux kernel, the following vulnerability has been resolved:
scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()
When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass
the requests to the adapter. If such an attempt fails, a local "fail_msg"
string is set and a log message output. The job is then added to a
completions list for cancellation.
Processing of any further jobs from the txq list continues, but since
"fail_msg" remains set, jobs are added to the completions list regardless
of whether a wqe was passed to the adapter. If successfully added to
txcmplq, jobs are added to both lists resulting in list corruption.
Fix by clearing the fail_msg string after adding a job to the completions
list. This stops the subsequent jobs from being added to the completions
list unless they had an appropriate failure.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 4.4.293 | 4.4.293 |
| linux/linux_kernel | ≥ 4.5, < 4.9.291 | 4.9.291 |
| linux/linux_kernel | ≥ 4.10, < 4.14.256 | 4.14.256 |
| linux/linux_kernel | ≥ 4.15, < 4.19.218 | 4.19.218 |
| linux/linux_kernel | ≥ 4.20, < 5.4.162 | 5.4.162 |
| linux/linux_kernel | ≥ 5.5, < 5.10.82 | 5.10.82 |
| linux/linux_kernel | ≥ 5.11, < 5.15.5 | 5.15.5 |