CVE-2022-49114: scsi: libfc: Fix use after free in fc_exch_abts_resp()

CVE-2022-49114: scsi: libfc: Fix use after free in fc_exch_abts_resp()

[Greg Kroah-Hartman]

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

scsi: libfc: Fix use after free in fc_exch_abts_resp()

fc_exch_release(ep) will decrease the ep's reference count. When the
reference count reaches zero, it is freed. But ep is still used in the
following code, which will lead to a use after free.

Return after the fc_exch_release() call to avoid use after free.

The Linux kernel CVE team has assigned CVE-2022-49114 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.311 with commit 4a131d4ea8b581ac9b01d3a72754db4848be3232
	Fixed in 4.14.276 with commit 499d198494e77b6533251b9b909baf5c101129cb
	Fixed in 4.19.238 with commit 6044ad64f41c87382cfeeca281573d1886d80cbe
	Fixed in 5.4.189 with commit 5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836
	Fixed in 5.10.111 with commit 1d7effe5fff9d28e45e18ac3a564067c7ddfe898
	Fixed in 5.15.34 with commit f581df412bc45c95176e3c808ee2839c05b2ab0c
	Fixed in 5.16.20 with commit 87909291762d08fdb60d19069d7a89b5b308d0ef
	Fixed in 5.17.3 with commit 412dd8299b02e4410fe77b8396953c1a8dde183a
	Fixed in 5.18 with commit 271add11994ba1a334859069367e04d2be2ebdd4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49114
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/scsi/libfc/fc_exch.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4a131d4ea8b581ac9b01d3a72754db4848be3232
	https://git.kernel.org/stable/c/499d198494e77b6533251b9b909baf5c101129cb
	https://git.kernel.org/stable/c/6044ad64f41c87382cfeeca281573d1886d80cbe
	https://git.kernel.org/stable/c/5cf2ce8967b0d98c8cfa4dc42ef4fcf080f5c836
	https://git.kernel.org/stable/c/1d7effe5fff9d28e45e18ac3a564067c7ddfe898
	https://git.kernel.org/stable/c/f581df412bc45c95176e3c808ee2839c05b2ab0c
	https://git.kernel.org/stable/c/87909291762d08fdb60d19069d7a89b5b308d0ef
	https://git.kernel.org/stable/c/412dd8299b02e4410fe77b8396953c1a8dde183a
	https://git.kernel.org/stable/c/271add11994ba1a334859069367e04d2be2ebdd4