CVE-2024-26931: scsi: qla2xxx: Fix command flush on cable pull
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix command flush on cable pull
System crash due to command failed to flush back to SCSI layer.
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 27 PID: 793455 Comm: kworker/u130:6 Kdump: loaded Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x8664 #1 Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvmefcconnectctrlwork [nvmefc] RIP: 0010:wakeupcommon+0x4c/0x190 Code: 24 10 4d 85 c9 74 0a 41 f6 01 04 0f 85 9d 00 00 00 48 8b 43 08 48 83 c3 08 4c 8d 48 e8 49 8d 41 18 48 39 c3 0f 84 f0 00 00 00 <49> 8b 41 18 89 54 24 08 31 ed 4c 8d 70 e8 45 8b 29 41 f6 c5 04 75 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: wakeupcommonlock+0x7c/0xc0 qlanvmelsreq+0x355/0x4c0 [qla2xxx] qla2xxx [0000:12:00.1]-f084:3: qltfreesessiondone: sesess 0000000000000000 / sess ffff8ae1407ca000 from port 21:32:00:02:ac:07:ee:b8 loopid 0x02 sid 01:02:00 logout 1 keep 0 elslogo 0 ? nvmefcsendlsreq+0x260/0x380 [nvmefc] qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:00:02:ac:07:ee:b8 state transitioned from ONLINE to LOST - portid=010200. ? nvmefcsendlsreq.constprop.42+0x1a/0x45 [nvmefc] qla2xxx [0000:12:00.1]-2109:3: qla2x00schedulerportdel 21320002ac07eeb8. rport ffff8ae598122000 roles 1 ? nvmefcconnectctrlwork.cold.63+0x1e3/0xa7d [nvmefc] qla2xxx [0000:12:00.1]-f084:3: qltfreesessiondone: sesess 0000000000000000 / sess ffff8ae14801e000 from port 21:32:01:02:ad:f7:ee:b8 loopid 0x04 sid 01:02:01 logout 1 keep 0 elslogo 0 ? switchto+0x10c/0x450 ? processonework+0x1a7/0x360 qla2xxx [0000:12:00.1]-207d:3: FCPort 21:32:01:02:ad:f7:ee:b8 state transitioned from ONLINE to LOST - portid=010201. ? workerthread+0x1ce/0x390 ? createworker+0x1a0/0x1a0 qla2xxx [0000:12:00.1]-2109:3: qla2x00schedulerportdel 21320102adf7eeb8. rport ffff8ae3b2312800 roles 70 ? kthread+0x10a/0x120 qla2xxx [0000:12:00.1]-2112:3: qlanvmeunregisterremoteport: unregister remoteport on ffff8ae14801e000 21320102adf7eeb8 ? setkthreadstruct+0x40/0x40 qla2xxx [0000:12:00.1]-2110:3: remoteportdelete of ffff8ae14801e000 21320102adf7eeb8 completed. ? retfromfork+0x1f/0x40 qla2xxx [0000:12:00.1]-f086:3: qltfreesessiondone: waiting for sess ffff8ae14801e000 logout
The system was under memory stress where driver was not able to allocate an SRB to carry out error recovery of cable pull. The failure to flush causes upper layer to start modifying scsicmnd. When the system frees up some memory, the subsequent cable pull trigger another command flush. At this point the driver access a null pointer when attempting to DMA unmap the SGL.
Add a check to make sure commands are flush back on session tear down to prevent the null pointer access.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix command flush on cable pull
The Linux kernel CVE team has assigned CVE-2024-26931 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050123-CVE-2024-26931-01d9@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.312 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.274 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.215 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.154 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.84 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.24 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26931?
CVE-2024-26931 is categorized as a critical vulnerability due to potential system crashes.
How do I fix CVE-2024-26931?
To fix CVE-2024-26931, update the kernel to one of the fixed versions: 4.19.312, 5.4.274, 5.10.215, 5.15.154, 6.1.84, 6.6.24, 6.7.12, 6.8.3, 6.9, or the corresponding Linux versions from Debian.
Which systems are affected by CVE-2024-26931?
CVE-2024-26931 affects various versions of the Linux kernel, particularly those prior to the specified patched versions.
What types of attacks can exploit CVE-2024-26931?
CVE-2024-26931 can potentially be exploited to cause a denial-of-service condition through system crashes.
Is there a workaround for CVE-2024-26931?
No specific workaround is recommended for CVE-2024-26931; updating the kernel is the advised mitigation.