Null Pointer Dereference in IBM Power 9 Linux Kernel SCSI Driver

CVE-2022-49703

Summary

A vulnerability in the Linux kernel's SCSI driver for IBM Power 9 hardware can lead to a null pointer dereference under specific circumstances. During the allocation of sub-channel request queues (subcrqs), the back pointer from the queue to the vhost adapter is not assigned until after registering interrupt requests. This could result in a crash if a pending subcrq interrupt is replayed upon IRQ registration, allowing the kernel to attempt to read from an invalid memory address. This problem was particularly noted during kexec/kdump scenarios. Implementing a fix ensures that the back pointer is correctly set during initial allocation, mitigating the risk of dereferencing invalid memory and preventing the potential crash.

References