Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #94799

Bug#1153112: linux: lpfc use-after-free in lpfc_sli4_driver_resource_setup(), boot fails (regression 6.1.177-1 -> 6.1.180-1)

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: src:linux
Version: 6.1.180-1
Severity: important
Tags: patch upstream
Control: found -1 6.1.190-1
X-Debbugs-Cc: debian-lts@lists.debian.org

Dear Maintainer,

since linux-image-6.1.0-52-amd64 (6.1.180-1) our SAN-booted servers with
Emulex FC HBAs fail to boot. 6.1.0-51 (6.1.177-1) boots reliably on the
same machines. 6.12.115+deb13.1 (trixie) works.

A note on how this report was produced: the crashes, the version
history, the kernel logs and the gdb output below are real and were
observed or captured by me on our machines. The analysis of these data
(reading the logs, comparing the kernel sources, identifying the commit
and writing the patch) was done with the help of an AI assistant
(Claude, by Anthropic). I have checked it for plausibility, but I cannot
guarantee that the analysis is correct. The patch is not build-tested
and not runtime-tested.


1. Observations

Hardware:
   Fujitsu PRIMERGY RX2530 M7 (D3982-A1), BIOS V1.0.0.0 R2.13.0 06/12/2026
   1x Intel Xeon Gold 5415+, 768 GiB RAM
   Emulex LPe31000/LPe32000 series FC HBA, 2 ports, boot from SAN
   (Dell PowerStore, dm-multipath)
   lspci -nn (full output attached):
   16:00.0 Fibre Channel [0c04]: Emulex Corporation LPe31000/LPe32000 
Series 16Gb/32Gb Fibre Channel Adapter [10df:e300] (rev 01)
   16:00.1 Fibre Channel [0c04]: Emulex Corporation LPe31000/LPe32000 
Series 16Gb/32Gb Fibre Channel Adapter [10df:e300] (rev 01)
   HBA firmware (/sys/class/scsi_host/host*/fwrev):
   14.4.393.25, sli-4:2:c
   14.4.393.25, sli-4:2:c
   lpfc module options: lpfc_lun_queue_depth=64

Version history on the affected node (from dpkg.log and kern.log):
   6.1.177-1 (6.1.0-51): boots fine (all boots in October 2026)
   6.1.180-1 (6.1.0-52): fails to boot (first installed 2026-08-06,
                         removed one hour later)
   6.1.190-1 (6.1.0-54): fails the same way (crash in the slab allocator
                         during lpfc_sli4_enable_intr)

A few seconds after /init starts, while lpfc probes the HBA in the
initramfs, the kernel crashes. Boot of 6.1.180-1 with slub_debug=FZPU
(full log attached, see below):

   lpfc 0000:16:00.0: 0:2574 IO channels: hdwQ 8 IRQ 8 MRQ: 0
   BUG kmalloc-512 (Not tainted): Poison overwritten
   0xff35a2b750cf6e00-0xff35a2b750cf6f57 @offset=28160. First byte 0x0 
instead of 0x6b
   Allocated in mempool_alloc+0x82/0x1b0 age=7 cpu=0 pid=150
    __kmalloc+0x49/0x150
    mempool_alloc+0x82/0x1b0
    lpfc_pci_probe_one+0xef6/0x17c0 [lpfc]
   Freed in lpfc_pci_probe_one+0xf9b/0x17c0 [lpfc] age=7 cpu=0 pid=150
   ...
   CPU: 0 PID: 150 Comm: kworker/0:2 Not tainted 6.1.0-52-amd64 #1 
Debian 6.1.180-1
   Call Trace:
    check_object+0x22b/0x280
    alloc_debug_processing+0xa8/0x120
    ...
    kmalloc_node_trace+0x23/0x90
    alloc_desc+0x35/0x250
    ...
    pci_alloc_irq_vectors_affinity+0xa9/0x110
    lpfc_sli4_enable_intr+0x2b8/0xa60 [lpfc]
    lpfc_pci_probe_one.cold+0x9c8/0x1173 [lpfc]
   ...
   list_del corruption, ffd525d181433c08->next is LIST_POISON1 
(dead000000000100)
   kernel BUG at lib/list_debug.c:53!
   invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
   CPU: 13 PID: 402 Comm: (udev-worker) Tainted: G    B 
6.1.0-52-amd64 #1  Debian 6.1.180-1
   RIP: 0010:__list_del_entry_valid.cold+0x5c/0x6f
   Call Trace:
    free_to_partial_list+0x437/0x4f0
    __free_slab+0x82/0x1a0
   ...
   Kernel panic - not syncing: Fatal exception

gdb with lpfc.ko from linux-image-6.1.0-52-amd64-dbg (6.1.180-1):

   0x54866 is in lpfc_pci_probe_one (drivers/scsi/lpfc/lpfc_init.c:8109).
   0x5490b is in lpfc_pci_probe_one (drivers/scsi/lpfc/lpfc_init.c:8180).

The failure was first seen on bookworm in August 2026. The log above
was captured later on the same machine after the upgrade to trixie,
booting the bookworm kernel package (dracut initramfs, efi_pstore
loaded early).


2. Analysis (AI-assisted, see note above)

Both lines are in lpfc_sli4_driver_resource_setup(). In v6.1.180,
mempool_free(mboxq) (line 8178) comes before
lpfc_get_sli4_parameters(phba, mboxq) (line 8187), which still uses
mboxq: a use-after-free. The error paths after it free mboxq a second
time. The overwritten data in the SLUB report starts with a 16-byte
list_head followed by command byte 0x9B (MBX_SLI4_CONFIG), which fits
the SLI4_CONFIG mailbox issued by lpfc_get_sli4_parameters().

The only change to lpfc_init.c between v6.1.177 and v6.1.180 is the
6.1.y backport of upstream commit 1bd28625e25b ("scsi: lpfc: Fix memory
leak in lpfc_sli4_driver_resource_setup()", stable commit 299f5baa1321,
CVE-2026-72087). In mainline and 6.12.y the free is placed after the
lpfc_get_sli4_parameters() error handling. In 6.1.y the hunk apparently
applied at an identical-looking context about 35 lines too early.
v6.1.190 is unchanged at this spot.

The attached patch moves the free behind the error handling, as in
mainline. It uses 12 lines of context so that it cannot land at the
wrong place again. It applies with patch --fuzz=0 to v6.1.180 and
v6.1.190. It is not build-tested and not runtime-tested.


Attachments:
   lpfc-6.1-mboxq-uaf-fix.patch
   lspci-nn.txt: full output of lspci -nn
   pstore-6.1.0-52.tar.xz: the kernel log of the 6.1.180-1 test boot with
   slub_debug=FZPU, as written to efi-pstore by the crashing kernel and
   archived by systemd-pstore at the next boot. Two dumps:
   Oops#1 = 1793893400/001 (parts 18-4) followed by 1793893399/001
   (parts 3-1, newest), Panic#2 = 1793893403/002 followed by
   1793893402/002. The directory names are the write times of the
   individual parts.

Regards,
   Th. Schlichting

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1153112: linux: lpfc use-after-free in lpfc_sli4_driver_resource_setup(), boot fails (regression 6.1.177-1 -> 6.1.180-1) Thorsten Schlichting <schlichting@tuhh.de> - 2026-11-05 18:30 +0100
  Processed: Bug#1153112 "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-11-05 18:40 +0100
  Bug#1153112:  Thorsten Schlichting <schlichting@tuhh.de> - 2026-11-05 18:40 +0100
    Bug#1153112:  Salvatore Bonaccorso <carnil@debian.org> - 2026-11-05 22:40 +0100
  Processed: Re: Bug#1153112: "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-11-05 22:40 +0100

csiph-web