In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails<\/p>\n
nvmf_create_ctrl() owns the fabrics options and frees them whenever
\n->create_ctrl() returns an error, so a transport must not free them on
\nits own error paths. nvme-fc tracks this by testing ctrl->ctrl.opts in
\nnvme_fc_ctrl_free(), which requires nvme_fc_init_ctrl() to clear that
\npointer on every error exit.<\/p>\n
The coupling is implicit, and commit 1a9e218195a5 (“nvme: split device
\nadd from initialization”) broke it by adding a second error exit. When
\nnvme_add_ctrl() fails, nvme_fc_init_ctrl() jumps to out_put_ctrl:, past
\nthe “ctrl->ctrl.opts = NULL” that only sits on the fail_ctrl: path, so
\nnvme_fc_ctrl_free() frees the options and nvmf_create_ctrl() frees them
\na second time:<\/p>\n
BUG: KASAN: slab-use-after-free in nvmf_free_options+0x30\/0x190
\n nvmf_free_options+0x30\/0x190 drivers\/nvme\/host\/fabrics.c:1284
\n nvmf_create_ctrl drivers\/nvme\/host\/fabrics.c:1374 [inline]
\n Freed by task 5534:
\n nvme_fc_ctrl_free drivers\/nvme\/host\/fc.c:2374 [inline]
\n nvme_fc_init_ctrl+0xe17\/0x1450 drivers\/nvme\/host\/fc.c:3605<\/p>\n
nvme_add_ctrl() fails when dev_set_name() cannot allocate, so this is
\nreachable under memory pressure or fault injection. Without KASAN the
\noptions are freed twice.<\/p>\n
Rather than clear the pointer on the second exit as well, derive
\nownership the way nvme-tcp, nvme-rdma and nvme-loop do, from list
\nmembership: their free_ctrl leaves the options alone unless the
\ncontroller made it onto the transport list.<\/p>\n
The list cannot simply be populated on the success path as it is there.
\nnvme-fc runs the initial connect synchronously via flush_delayed_work(),
\nand the controller has to be reachable on rport->ctrl_list for the whole
\nof it: nvme_fc_unregister_remoteport() needs to find it to signal
\nconnectivity loss, nvme_fc_match_disconn_ls() matches an incoming
\nDisconnect Association LS against ctrl->association_id, which is only
\nassigned during that window, nvme_fc_resume_controller() needs it on
\nremoteport re-registration, and nvme_fc_existing_controller() uses it to
\nreject a duplicate connect racing the one in flight.<\/p>\n
Keep the insertion where it is and add a fail_unlist: label, falling
\ninto fail_ctrl:, for the error paths that run after it. The earlier
\nerror paths never reach the insertion and keep using fail_ctrl:
\ndirectly, so the list is only touched where the controller is actually
\non it.<\/p>\n
nvme_fc_ctrl_free() cannot use the plain “goto free_ctrl” the other
\ntransports use, because it still has to put_device(), release the rport
\nreference and free the ida entry for resources taken before the
\ninsertion. Sample list_empty() under rport->lock instead.<\/p>\n
ctrl->ctrl.opts also stays valid for the whole teardown now. That is
\nnot the bug being fixed, but it removes some fragility around the old
\nidiom: nvme_free_ctrl() calls nvme_auth_free() before ->free_ctrl(), and
\nctrl_max_dhchaps() dereferences ctrl->opts without a NULL check when
\nctrl->dhchap_ctxs is set, which nvme-fc permits since NVMF_ALLOWED_OPTS
\nallows the dhchap options. The nvme sysfs attributes that dereference
\nctrl->opts, such as hostnqn and address, evaluate their is_visible()
\ntest once at device_add() time and stay readable until
\ncdev_device_del().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails<\/p>\n
nvmf_create_ctrl() owns the fabrics options and frees them <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24661","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24661","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24661"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24661"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}