Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #94541 > unrolled thread

Bug#1151377: linux: lpfc boot hang since 6.1.178 - use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

Back to article view | Back to linux.debian.kernel

Contents

  Bug#1151377: linux: lpfc boot hang since 6.1.178 - use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport Alexander Antonakakis <alexis@maich.gr> - 2026-10-20 12:20 +0200
    Processed: linux: lpfc boot hang since 6.1.178 - use-after-free  of mboxq in lpfc_sli4_driver_resource_setup() backport "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-10-20 12:20 +0200
    Bug#1151377: [REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport Andrey Misiurov <andrey.misyrov@gmail.com> - 2026-10-20 13:50 +0200
      Bug#1151377: [REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport Alexander Antonakakis <alexis@maich.gr> - 2026-10-20 14:00 +0200
    Bug#1151377: linux: lpfc boot hang since 6.1.178 - use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport Alexander Antonakakis <alexis@maich.gr> - 2026-10-20 14:00 +0200

#94541 — Bug#1151377: linux: lpfc boot hang since 6.1.178 - use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

Package: src:linux
Version: 6.1.180-1
Severity: important
Control: found -1 6.1.187-1
Control: found -1 6.1.190-1

Dear Maintainer,
Since linux-image-6.1.0-52-amd64 (6.1.180-1), my Debian 12 server hangs
early during boot. The last working kernel is linux-image-6.1.0-51-amd64
(6.1.177-1). 6.1.0-53 (6.1.187-1) and 6.1.0-54 (6.1.190-1) hang in the
same way.

Hardware:
Emulex Corporation LPe31000/LPe32000 Series 16Gb/32Gb Fibre Channel Adapter
11:00.0 Fibre Channel [0c04]: Emulex Corporation LPe31000/LPe32000 
Series 16Gb/32Gb Fibre Channel Adapter [10df:e300] (rev 01)

HBA firmware: 14.4.322.17, sli-4:2:c
lpfc driver version: 14.2.0.7

The HBA is connected by fibre to an external RAID storage. The root
filesystem is NOT on the FC storage.

On the working kernel, lpfc initializes about 2 seconds into boot. On 
the newer kernels, the system hangs at about the same point, before any
filesystems are mounted.

Probable cause:
6.1.178 includes the stable backport of "scsi: lpfc: Fix memory leak in 
lpfc_sli4_driver_resource_setup()" (upstream commit 
1bd28625e25be549ee7c47532e7c3ef91c682410, CVE-2026-72087).

Upstream, the new mempool_free(mboxq, ...) is placed after the call to
lpfc_get_sli4_parameters(phba, mboxq) and its error check. In the 6.1.y
backport it was placed before that call. In 
drivers/scsi/lpfc/lpfc_init.c of v6.1.178:

8178:  mempool_free(mboxq, phba->mbox_mem_pool);
8187:  rc = lpfc_get_sli4_parameters(phba, mboxq);
8200:  mempool_free(mboxq, phba->mbox_mem_pool);   (error path)
8207:  mempool_free(mboxq, phba->mbox_mem_pool);   (error path)

So mboxq is freed, then used for a mailbox command to the HBA
(use-after-free), and can be freed again in the error paths (double free).
This happens on every SLI-4 HBA probe, which matches the boot hang.

The fix should be to move the mempool_free() at line 8178 to after the
lpfc_get_sli4_parameters() call and its error handling, as in the
mainline version of the patch.

I have pinned 6.1.0-51 for now. This is a production server, so I can
only test during maintenance windows, but I can test a fixed kernel or
a patched module when one is available.

Kernel on the running system:
Linux mx 6.1.0-51-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.177-1 
(2026-07-16) x86_64 GNU/Linux


Alexander Antonakakis

-- 
Alexander Antonakakis
Information Systems Department
Mediterranean Agronomic Institute of Chania (MAICh)
Alsyllio Agrokepiou, 1 Makedonias str, Chania, Crete, 73100 GREECE
Τ. +30 28210 35000 ext.718 | Ε. antonakakis@maich.gr


--
Διευκρίνιση ηλεκτρονικού ταχυδρομείου
Οι πληροφορίες που συμπεριλαμβάνονται σε αυτό το μήνυμα είναι εμπιστευτικές και η χρήση τους
επιτρέπεται μόνον από τον αναφερόμενο παραλήπτη. Εάν έχετε λάβει το παρόν μήνυμα από λάθος και δεν
είστε ο προοριζόμενος παραλήπτης, σας ενημερώνουμε ότι αποκάλυψη, αναπαραγωγή, διανομή ή οποιασδήποτε
άλλης μορφής χρήση των περιεχομένων του παρόντος μηνύματος απαγορεύεται. Επίσης παρακαλείσθε να
αποστείλετε το αρχικό μήνυμα στην διεύθυνση του αποστολέα, καθώς και στη συνέχεια να διαγράψετε το
μήνυμα από το σύστημά σας.
Η επικοινωνία μέσω Internet δεν είναι ασφαλής και επομένως το ΜΑΙΧ δεν φέρει ευθύνη για οποιαδήποτε
θετική ή αποθετική ζημιά που προκλήθηκε από την χρήση του παρόντος ή των συνημμένων του λόγω ιών που
έχουν περάσει σε αυτά.

Email Disclaimer
The information in this email is confidential and is intended solely for the addressee(s). If you have
received this transmission in error, and you are not an intended recipient, be aware that any
disclosure, copying, distribution or use of this transmission or its contents is prohibited.
Furthermore, you are kindly requested to send us back the original message to the sender’s address and
delete the message from your system immediately.
Internet communications are not secure and therefore MAICh does not accept legal responsibility for the
contents of this message and for any damage whatsoever that is caused by viruses being passed.

[toc] | [next] | [standalone]

#94542 — Processed: linux: lpfc boot hang since 6.1.178 - use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

Processing control commands:

> found -1 6.1.187-1
Bug #1151377 [src:linux] linux: lpfc boot hang since 6.1.178 - use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport
The source 'linux' and version '6.1.187-1' do not appear to match any binary packages
Marked as found in versions linux/6.1.187-1.
> found -1 6.1.190-1
Bug #1151377 [src:linux] linux: lpfc boot hang since 6.1.178 - use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport
The source 'linux' and version '6.1.190-1' do not appear to match any binary packages
Marked as found in versions linux/6.1.190-1.

-- 
1151377: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151377
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#94543 — Bug#1151377: [REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

On Tue, Oct 20, 2026 at 01:23:03PM +0300, Alexander Antonakakis wrote:
> Moving the mempool_free() at line 8178 to after the
> lpfc_get_sli4_parameters() call and its error handling, as in
> mainline, should fix it.

Hi Alexander,

This looks like the same issue I came across. A patch doing exactly
that is already queued for the next 6.1.y release:

https://lore.kernel.org/r/20261008184328.2857037-1-andrey.misyrov@gmail.com

Regards,
Andrey

[toc] | [prev] | [next] | [standalone]

#94545 — Bug#1151377: [REGRESSION] 6.1.178+: lpfc: boot hang due to use-after-free of mboxq in lpfc_sli4_driver_resource_setup() backport

#regzbot link: 
https://lore.kernel.org/r/20261008184328.2857037-1-andrey.misyrov@gmail.com

On 10/20/26 14:39, Andrey Misiurov wrote:
> On Tue, Oct 20, 2026 at 01:23:03PM +0300, Alexander Antonakakis wrote:
>> Moving the mempool_free() at line 8178 to after the
>> lpfc_get_sli4_parameters() call and its error handling, as in
>> mainline, should fix it.
> 
> Hi Alexander,
> 
> This looks like the same issue I came across. A patch doing exactly
> that is already queued for the next 6.1.y release:
> 
> https://lore.kernel.org/r/20261008184328.2857037-1-andrey.misyrov@gmail.com
> 
> Regards,
> Andrey

-- 
Alexander Antonakakis
Information Systems Department
Mediterranean Agronomic Institute of Chania (MAICh)
Alsyllio Agrokepiou, 1 Makedonias str, Chania, Crete, 73100 GREECE
Τ. +30 28210 35000 ext.718 | Ε. antonakakis@maich.gr

[toc] | [prev] | [next] | [standalone]

#94544

A fix for this is queued for the next upstream 6.1.y release:
https://lore.kernel.org/r/20261008184328.2857037-1-andrey.misyrov@gmail.com

It may be worth applying it to the Debian bookworm kernel before the
next stable rebase.

-- 
Alexander Antonakakis
Information Systems Department
Mediterranean Agronomic Institute of Chania (MAICh)
Alsyllio Agrokepiou, 1 Makedonias str, Chania, Crete, 73100 GREECE
Τ. +30 28210 35000 ext.718 | Ε. antonakakis@maich.gr


--
Διευκρίνιση ηλεκτρονικού ταχυδρομείου
Οι πληροφορίες που συμπεριλαμβάνονται σε αυτό το μήνυμα είναι εμπιστευτικές και η χρήση τους
επιτρέπεται μόνον από τον αναφερόμενο παραλήπτη. Εάν έχετε λάβει το παρόν μήνυμα από λάθος και δεν
είστε ο προοριζόμενος παραλήπτης, σας ενημερώνουμε ότι αποκάλυψη, αναπαραγωγή, διανομή ή οποιασδήποτε
άλλης μορφής χρήση των περιεχομένων του παρόντος μηνύματος απαγορεύεται. Επίσης παρακαλείσθε να
αποστείλετε το αρχικό μήνυμα στην διεύθυνση του αποστολέα, καθώς και στη συνέχεια να διαγράψετε το
μήνυμα από το σύστημά σας.
Η επικοινωνία μέσω Internet δεν είναι ασφαλής και επομένως το ΜΑΙΧ δεν φέρει ευθύνη για οποιαδήποτε
θετική ή αποθετική ζημιά που προκλήθηκε από την χρήση του παρόντος ή των συνημμένων του λόγω ιών που
έχουν περάσει σε αυτά.

Email Disclaimer
The information in this email is confidential and is intended solely for the addressee(s). If you have
received this transmission in error, and you are not an intended recipient, be aware that any
disclosure, copying, distribution or use of this transmission or its contents is prohibited.
Furthermore, you are kindly requested to send us back the original message to the sender’s address and
delete the message from your system immediately.
Internet communications are not secure and therefore MAICh does not accept legal responsibility for the
contents of this message and for any damage whatsoever that is caused by viruses being passed.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web