From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38477218E85 for ; Wed, 26 Feb 2025 02:15:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536131; cv=none; b=MfprZ9myf0VTui5YnxtL7M7qNmvdx3tujHaVj0tFnR9zLg57ANRJjA3aiG/iuHi+am8EtvGBGquptGZGA6ixsHC6koA54PAw/8U/E0IfV32cmrsySpmNDrOcjjtAFKDZtVK8VZePVHDb9E00x5WDKCQWaf6c7kVzOtRwjquiBc8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536131; c=relaxed/simple; bh=skiQ3C5QD9QBhqBknMSpHKKeTqOrO3FHMp/buWpyUfA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qZua8Fv+GgQNGnyCUcwaeU2MuTUlQ5Oh+LtzwLI9ruUrojmdtKGLyA2zO7BESdQvvkRNDd+ViNuNBYHddFAsN2478QrO9p/ZpQSGCt/LXefBFaxa4X4/vek/blzODMR262Nt3SU13tEJMURNqTgO1v2ygUJrY49Mr4lj8Q9uS/s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=frsmSWsb; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="frsmSWsb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8557DC4CEDD; Wed, 26 Feb 2025 02:15:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536130; bh=skiQ3C5QD9QBhqBknMSpHKKeTqOrO3FHMp/buWpyUfA=; h=From:To:Cc:Subject:Date:Reply-to:From; b=frsmSWsb0vEnzXcWnSGYKbvO80MtGh4PRn8GljzTnvhs53+5ldg8904GHEIlJf4Gb MxMTZiSaeji8yNXY7792AepxnHQxicxuGsBgiX1QtP2hh4AIB6n85tp9i3zVadFsnn PfNrbdVifmDRafFUuxmNLPKaosrdPw3ihp1Bn6A8= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49536: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock Date: Wed, 26 Feb 2025 03:13:30 +0100 Message-ID: <2025022613-CVE-2022-49536-db89@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2958; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=skiQ3C5QD9QBhqBknMSpHKKeTqOrO3FHMp/buWpyUfA=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7KljPcAnpfXIwf7k19L9e0tS5Msb7T7dWx5VqVkQmr t73Ia6mI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACayZzbD/JwWjpSFs/fdfLe1 1Y4r7k/kv9XLZjHMlRfmKNzcNmtha53q2YhVapzOtSdeAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock During stress I/O tests with 500+ vports, hard LOCKUP call traces are observed. CPU A: native_queued_spin_lock_slowpath+0x192 _raw_spin_lock_irqsave+0x32 lpfc_handle_fcp_err+0x4c6 lpfc_fcp_io_cmd_wqe_cmpl+0x964 lpfc_sli4_fp_handle_cqe+0x266 __lpfc_sli4_process_cq+0x105 __lpfc_sli4_hba_process_cq+0x3c lpfc_cq_poll_hdler+0x16 irq_poll_softirq+0x76 __softirqentry_text_start+0xe4 irq_exit+0xf7 do_IRQ+0x7f CPU B: native_queued_spin_lock_slowpath+0x5b _raw_spin_lock+0x1c lpfc_abort_handler+0x13e scmd_eh_abort_handler+0x85 process_one_work+0x1a7 worker_thread+0x30 kthread+0x112 ret_from_fork+0x1f Diagram of lockup: CPUA CPUB ---- ---- lpfc_cmd->buf_lock phba->hbalock lpfc_cmd->buf_lock phba->hbalock Fix by reordering the taking of the lpfc_cmd->buf_lock and phba->hbalock in lpfc_abort_handler routine so that it tries to take the lpfc_cmd->buf_lock first before phba->hbalock. The Linux kernel CVE team has assigned CVE-2022-49536 to this issue. Affected and fixed versions =========================== Fixed in 5.15.46 with commit 7625e81de2164a082810e1f27547d388406da610 Fixed in 5.17.14 with commit 21c0d469349957b5dc811c41200a2a998996ca8d Fixed in 5.18.3 with commit 0c4eed901285b9cae36a622f32bea3e92490da6c Fixed in 5.19 with commit 03cbbd7c2f5ee288f648f4aeedc765a181188553 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49536 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/scsi/lpfc/lpfc_scsi.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/7625e81de2164a082810e1f27547d388406da610 https://git.kernel.org/stable/c/21c0d469349957b5dc811c41200a2a998996ca8d https://git.kernel.org/stable/c/0c4eed901285b9cae36a622f32bea3e92490da6c https://git.kernel.org/stable/c/03cbbd7c2f5ee288f648f4aeedc765a181188553