CVE-2022-50532

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()<br /> <br /> In mpt3sas_transport_port_add(), if sas_rphy_add() returns error,<br /> sas_rphy_free() needs be called to free the resource allocated in<br /> sas_end_device_alloc(). Otherwise a kernel crash will happen:<br /> <br /> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108<br /> CPU: 45 PID: 37020 Comm: bash Kdump: loaded Tainted: G W 6.1.0-rc1+ #189<br /> pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> pc : device_del+0x54/0x3d0<br /> lr : device_del+0x37c/0x3d0<br /> Call trace:<br /> device_del+0x54/0x3d0<br /> attribute_container_class_device_del+0x28/0x38<br /> transport_remove_classdev+0x6c/0x80<br /> attribute_container_device_trigger+0x108/0x110<br /> transport_remove_device+0x28/0x38<br /> sas_rphy_remove+0x50/0x78 [scsi_transport_sas]<br /> sas_port_delete+0x30/0x148 [scsi_transport_sas]<br /> do_sas_phy_delete+0x78/0x80 [scsi_transport_sas]<br /> device_for_each_child+0x68/0xb0<br /> sas_remove_children+0x30/0x50 [scsi_transport_sas]<br /> sas_rphy_remove+0x38/0x78 [scsi_transport_sas]<br /> sas_port_delete+0x30/0x148 [scsi_transport_sas]<br /> do_sas_phy_delete+0x78/0x80 [scsi_transport_sas]<br /> device_for_each_child+0x68/0xb0<br /> sas_remove_children+0x30/0x50 [scsi_transport_sas]<br /> sas_remove_host+0x20/0x38 [scsi_transport_sas]<br /> scsih_remove+0xd8/0x420 [mpt3sas]<br /> <br /> Because transport_add_device() is not called when sas_rphy_add() fails, the<br /> device is not added. When sas_rphy_remove() is subsequently called to<br /> remove the device in the remove() path, a NULL pointer dereference happens.