CVE-2022-50493: scsi: qla2xxx: Fix crash when I/O abort times out
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix crash when I/O abort times out
While performing CPU hotplug, a crash with the following stack was seen:
Call Trace: qla24xxprocessresponsequeue+0x42a/0x970 [qla2xxx] qla2x00startnvmemq+0x3a2/0x4b0 [qla2xxx] qlanvmepostcmd+0x166/0x240 [qla2xxx] nvmefcstartfcpop.part.0+0x119/0x2e0 [nvmefc] blkmqdispatchrqlist+0x17b/0x610 blkmqscheddispatchrequests+0xb0/0x140 blkmqscheddispatchrequests+0x30/0x60 blkmqrunhwqueue+0x35/0x90 blkmqdelayrunhwqueue+0x161/0x180 blkexecuterq+0xbe/0x160 nvmesubmitsynccmd+0x16f/0x220 [nvmecore] nvmfconnectadminqueue+0x11a/0x170 [nvmefabrics] nvmefccreateassociation.cold+0x50/0x3dc [nvmefc] nvmefcconnectctrlwork+0x19/0x30 [nvmefc] processonework+0x1e8/0x3c0
On abort timeout, completion was called without checking if the I/O was already completed.
Verify that I/O and abort request are indeed outstanding before attempting completion.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50493?
CVE-2022-50493 has been classified with a moderate severity level due to the potential for crash during I/O operations.
How do I fix CVE-2022-50493?
To fix CVE-2022-50493, update the Linux kernel to the latest version that includes the fix for this vulnerability.
What platforms are affected by CVE-2022-50493?
CVE-2022-50493 affects various versions of the Linux kernel specifically those utilizing the qla2xxx SCSI driver.
What issues can CVE-2022-50493 cause?
CVE-2022-50493 can lead to system crashes during CPU hotplug operations, impacting uptime and system reliability.
Is there a known exploit for CVE-2022-50493?
As of now, there is no known public exploit for CVE-2022-50493, but it is advisable to apply patches promptly to mitigate risk.