CVE-2021-47198
Assigner: Linux
Published: 2024-04-10T18:56:33.898Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine

An error is detected with the following report when unloading the driver:
  "KASAN: use-after-free in lpfc_unreg_rpi+0x1b1b"

The NLP_REG_LOGIN_SEND nlp_flag is set in lpfc_reg_fab_ctrl_node(), but the
flag is not cleared upon completion of the login.

This allows a second call to lpfc_unreg_rpi() to proceed with nlp_rpi set
to LPFC_RPI_ALLOW_ERROR.  This results in a use after free access when used
as an rpi_ids array index.

Fix by clearing the NLP_REG_LOGIN_SEND nlp_flag in
lpfc_mbx_cmpl_fc_reg_login().
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 1da177e4c3f4
lessThan: dbebf865b323
status: affected
versionType: git
version: 1da177e4c3f4
lessThan: 79b20beccea3
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 5.15.5
lessThanOrEqual: 5.15.*
status: unaffected
versionType: custom
version: 5.16
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
x_generator: engine: bippy-d175d3acf727