Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #94541

Bug#1151377: linux: lpfc boot hang since 6.1.178 - use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

Cross-posted to 2 groups.

Show all headers | View raw

Package: src:linux
Version: 6.1.180-1
Severity: important
Control: found -1 6.1.187-1
Control: found -1 6.1.190-1

Dear Maintainer,
Since linux-image-6.1.0-52-amd64 (6.1.180-1), my Debian 12 server hangs
early during boot. The last working kernel is linux-image-6.1.0-51-amd64
(6.1.177-1). 6.1.0-53 (6.1.187-1) and 6.1.0-54 (6.1.190-1) hang in the
same way.

Hardware:
Emulex Corporation LPe31000/LPe32000 Series 16Gb/32Gb Fibre Channel Adapter
11:00.0 Fibre Channel [0c04]: Emulex Corporation LPe31000/LPe32000 
Series 16Gb/32Gb Fibre Channel Adapter [10df:e300] (rev 01)

HBA firmware: 14.4.322.17, sli-4:2:c
lpfc driver version: 14.2.0.7

The HBA is connected by fibre to an external RAID storage. The root
filesystem is NOT on the FC storage.

On the working kernel, lpfc initializes about 2 seconds into boot. On 
the newer kernels, the system hangs at about the same point, before any
filesystems are mounted.

Probable cause:
6.1.178 includes the stable backport of "scsi: lpfc: Fix memory leak in 
lpfc_sli4_driver_resource_setup()" (upstream commit 
1bd28625e25be549ee7c47532e7c3ef91c682410, CVE-2026-72087).

Upstream, the new mempool_free(mboxq, ...) is placed after the call to
lpfc_get_sli4_parameters(phba, mboxq) and its error check. In the 6.1.y
backport it was placed before that call. In 
drivers/scsi/lpfc/lpfc_init.c of v6.1.178:

8178:  mempool_free(mboxq, phba->mbox_mem_pool);
8187:  rc = lpfc_get_sli4_parameters(phba, mboxq);
8200:  mempool_free(mboxq, phba->mbox_mem_pool);   (error path)
8207:  mempool_free(mboxq, phba->mbox_mem_pool);   (error path)

So mboxq is freed, then used for a mailbox command to the HBA
(use-after-free), and can be freed again in the error paths (double free).
This happens on every SLI-4 HBA probe, which matches the boot hang.

The fix should be to move the mempool_free() at line 8178 to after the
lpfc_get_sli4_parameters() call and its error handling, as in the
mainline version of the patch.

I have pinned 6.1.0-51 for now. This is a production server, so I can
only test during maintenance windows, but I can test a fixed kernel or
a patched module when one is available.

Kernel on the running system:
Linux mx 6.1.0-51-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.177-1 
(2026-07-16) x86_64 GNU/Linux


Alexander Antonakakis

-- 
Alexander Antonakakis
Information Systems Department
Mediterranean Agronomic Institute of Chania (MAICh)
Alsyllio Agrokepiou, 1 Makedonias str, Chania, Crete, 73100 GREECE
Τ. +30 28210 35000 ext.718 | Ε. antonakakis@maich.gr


--
Διευκρίνιση ηλεκτρονικού ταχυδρομείου
Οι πληροφορίες που συμπεριλαμβάνονται σε αυτό το μήνυμα είναι εμπιστευτικές και η χρήση τους
επιτρέπεται μόνον από τον αναφερόμενο παραλήπτη. Εάν έχετε λάβει το παρόν μήνυμα από λάθος και δεν
είστε ο προοριζόμενος παραλήπτης, σας ενημερώνουμε ότι αποκάλυψη, αναπαραγωγή, διανομή ή οποιασδήποτε
άλλης μορφής χρήση των περιεχομένων του παρόντος μηνύματος απαγορεύεται. Επίσης παρακαλείσθε να
αποστείλετε το αρχικό μήνυμα στην διεύθυνση του αποστολέα, καθώς και στη συνέχεια να διαγράψετε το
μήνυμα από το σύστημά σας.
Η επικοινωνία μέσω Internet δεν είναι ασφαλής και επομένως το ΜΑΙΧ δεν φέρει ευθύνη για οποιαδήποτε
θετική ή αποθετική ζημιά που προκλήθηκε από την χρήση του παρόντος ή των συνημμένων του λόγω ιών που
έχουν περάσει σε αυτά.

Email Disclaimer
The information in this email is confidential and is intended solely for the addressee(s). If you have
received this transmission in error, and you are not an intended recipient, be aware that any
disclosure, copying, distribution or use of this transmission or its contents is prohibited.
Furthermore, you are kindly requested to send us back the original message to the sender’s address and
delete the message from your system immediately.
Internet communications are not secure and therefore MAICh does not accept legal responsibility for the
contents of this message and for any damage whatsoever that is caused by viruses being passed.

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1151377: linux: lpfc boot hang since 6.1.178 - use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport Alexander Antonakakis <alexis@maich.gr> - 2026-10-20 12:20 +0200
  Processed: linux: lpfc boot hang since 6.1.178 - use-after-free  of mboxq in lpfc_sli4_driver_resource_setup() backport "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-10-20 12:20 +0200
  Bug#1151377: [REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport Andrey Misiurov <andrey.misyrov@gmail.com> - 2026-10-20 13:50 +0200
    Bug#1151377: [REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport Alexander Antonakakis <alexis@maich.gr> - 2026-10-20 14:00 +0200
  Bug#1151377: linux: lpfc boot hang since 6.1.178 - use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport Alexander Antonakakis <alexis@maich.gr> - 2026-10-20 14:00 +0200

csiph-web