CVE-2022-48715

scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe

MEDIUM

5.5

CVSS Score

Published: June 20, 2024 at 11:13 AM UTC

Updated: June 17, 2026 at 05:15 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe Running tests with a debug kernel shows that bnx2fc_recv_frame() is modifying the per_cpu lport stats counters in a non-mpsafe way. Just boot a debug kernel and run the bnx2fc driver with the hardware enabled. [ 1391.699147] BUG: using smp_processor_id() in preemptible [00000000] code: bnx2fc_ [ 1391.699160] caller is bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc] [ 1391.699174] CPU: 2 PID: 4355 Comm: bnx2fc_l2_threa Kdump: loaded Tainted: G B [ 1391.699180] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013 [ 1391.699183] Call Trace: [ 1391.699188] dump_stack_lvl+0x57/0x7d [ 1391.699198] check_preemption_disabled+0xc8/0xd0 [ 1391.699205] bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc] [ 1391.699215] ? do_raw_spin_trylock+0xb5/0x180 [ 1391.699221] ? bnx2fc_npiv_create_vports.isra.0+0x4e0/0x4e0 [bnx2fc] [ 1391.699229] ? bnx2fc_l2_rcv_thread+0xb7/0x3a0 [bnx2fc] [ 1391.699240] bnx2fc_l2_rcv_thread+0x1af/0x3a0 [bnx2fc] [ 1391.699250] ? bnx2fc_ulp_init+0xc0/0xc0 [bnx2fc] [ 1391.699258] kthread+0x364/0x420 [ 1391.699263] ? _raw_spin_unlock_irq+0x24/0x50 [ 1391.699268] ? set_kthread_struct+0x100/0x100 [ 1391.699273] ret_from_fork+0x22/0x30 Restore the old get_cpu/put_cpu code with some modifications to reduce the size of the critical section.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

3.16 ≤ v < 4.14.2653.16 ≤ v < 4.19.2283.16 ≤ v < 4.9.3003.16 ≤ v < 5.10.993.16 ≤ v < 5.15.223.16 ≤ v < 5.16.83.16 ≤ v < 5.173.16 ≤ v < 5.4.1783.16.1 ≤ v < 4.9.3004.10 ≤ v < 4.14.2654.15 ≤ v < 4.19.2284.20 ≤ v < 5.4.1785.11 ≤ v < 5.15.225.16 ≤ v < 5.16.85.5 ≤ v < 5.10.993.16 3.16 rc4 3.16 rc5 3.16 rc6 3.16 rc7 5.17 rc1 5.17 rc2d576a5e80cd07ea7049f8fd7b303c14df7b5d7d2

Vendor states this is fixed in 003bcee66a8f0e76157eb3af369c173151901d97 (fixed)

Vendor states this is fixed in 2d24336c7214b281b51860e54783dfc65f1248df (fixed)

Vendor states this is fixed in 2f5a1ac68bdf2899ce822ab845081922ea8c588e (fixed)

Vendor states this is fixed in 3a345198a7c2d1db2526dc60b77052f75de019d3 (fixed)

Vendor states this is fixed in 471085571f926a1fe6b1bed095638994dbf23990 (fixed)

Vendor states this is fixed in 53e4f71763c61a557283eb43301efd671922d1e8 (fixed)

Vendor states this is fixed in 936bd03405fc83ba039d42bc93ffd4b88418f1d3 (fixed)

Vendor states this is fixed in ec4334152dae175dbd8fd5bde1d2139bbe7b42d0 (fixed)

Vendor states this is fixed in 3.16 (unaffected)

Vendor states this is fixed in 4.14.265 (unaffected)

Vendor states this is fixed in 4.19.228 (unaffected)

Vendor states this is fixed in 4.9.300 (unaffected)