From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 09B7D217704 for ; Wed, 26 Feb 2025 02:14:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536099; cv=none; b=OyO19jVbcBGUvUvIsHBX2SspKLLP8hXoxHlhBPlOwUdfk1Y+3SQsLbrCfd5TEbntzKThlkR9ypJZdvTtq+dLMyFSAgt7pBGeGdoeGyhtfKDquwviyKLYURb3VqrnjfGos6v7lqAv0KIpotKgWbNMZJY0+Io5msD4gLGtIn1Kchw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536099; c=relaxed/simple; bh=4Bbx+VEF46cavxSmJXUhCgHCSXHWe7X/F7TZX+ZPFYA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=fmhpttlC/If4nKrAEp5JRXVEhi9MYObRgabwRWKSJu/bEk438KEi3MLIEP0x6DpgJ2+qinRyBcZ0P7u2xZEj3a7NA6Kyt0l02f5h20GY1Aj50axclzMnq+XJKnIt3VDjGbHGA5xjrmskltFIcBBJ2WarvXf3x8Ly+s0BRltxJqk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=xbl4p//m; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="xbl4p//m" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D449FC4CEDD; Wed, 26 Feb 2025 02:14:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536098; bh=4Bbx+VEF46cavxSmJXUhCgHCSXHWe7X/F7TZX+ZPFYA=; h=From:To:Cc:Subject:Date:Reply-to:From; b=xbl4p//mwFUvgYIIeeXym0p016yzk64q6FOoEzN9Ky1a6OWjZT9UvooXq0OzuNje8 X/fVZ6LiijvN5/9qW6O625gjrao/tMFlYvcpZtRhlVzlhYfpZ0pNOxugqE6ASgwpMQ CO9YgjP02sAHZ5GSRgFv8XnM51pAUKyiSzS2+xbI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49492: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags Date: Wed, 26 Feb 2025 03:12:46 +0100 Message-ID: <2025022606-CVE-2022-49492-6a2d@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3190; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=4Bbx+VEF46cavxSmJXUhCgHCSXHWe7X/F7TZX+ZPFYA=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7yv+1HAm/vM4oRnviPPFC7oMFajc2pFvNf28VVZlk0 5XT/PRmRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEykNJZhvmOOWFsoy4Jmtdi7 z5d3LQ3L/Ku8nWGe8THLJG8NO9faLi6lrZ9uFZyveCwHAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags In nvme_alloc_admin_tags, the admin_q can be set to an error (typically -ENOMEM) if the blk_mq_init_queue call fails to set up the queue, which is checked immediately after the call. However, when we return the error message up the stack, to nvme_reset_work the error takes us to nvme_remove_dead_ctrl() nvme_dev_disable() nvme_suspend_queue(&dev->queues[0]). Here, we only check that the admin_q is non-NULL, rather than not an error or NULL, and begin quiescing a queue that never existed, leading to bad / NULL pointer dereference. The Linux kernel CVE team has assigned CVE-2022-49492 to this issue. Affected and fixed versions =========================== Fixed in 4.9.318 with commit 8321b17789f614414206af07e17ce4751c95dc76 Fixed in 4.14.283 with commit 9e649471b396fa0139d53919354ce1eace9b9a24 Fixed in 4.19.247 with commit 8da2b7bdb47e94bbc4062a3978c708926bcb022c Fixed in 5.4.198 with commit f76729662650cd7bc8f8194e057af381370349a7 Fixed in 5.10.121 with commit af98940dd33c9f9e1beb4f71c0a39260100e2a65 Fixed in 5.15.46 with commit 906c81dba8ee8057523859b5e1a2479e9fd34860 Fixed in 5.17.14 with commit 7a28556082d1fbcbc599baf1c24252dfc73efefc Fixed in 5.18.3 with commit 54a4c1e47d1b2585e74920399455bd9abbfb2bd7 Fixed in 5.19 with commit da42761181627e9bdc37d18368b827948a583929 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49492 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/nvme/host/pci.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/8321b17789f614414206af07e17ce4751c95dc76 https://git.kernel.org/stable/c/9e649471b396fa0139d53919354ce1eace9b9a24 https://git.kernel.org/stable/c/8da2b7bdb47e94bbc4062a3978c708926bcb022c https://git.kernel.org/stable/c/f76729662650cd7bc8f8194e057af381370349a7 https://git.kernel.org/stable/c/af98940dd33c9f9e1beb4f71c0a39260100e2a65 https://git.kernel.org/stable/c/906c81dba8ee8057523859b5e1a2479e9fd34860 https://git.kernel.org/stable/c/7a28556082d1fbcbc599baf1c24252dfc73efefc https://git.kernel.org/stable/c/54a4c1e47d1b2585e74920399455bd9abbfb2bd7 https://git.kernel.org/stable/c/da42761181627e9bdc37d18368b827948a583929