linux-kernel - Re: CVE-2024-26929: scsi: qla2xxx: Fix double free of fcport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a28ac5fe-932e-4d5c-a0c1-93d00da8ccd7@oracle.com>
Date: Sun, 29 Dec 2024 18:17:14 +0530
From: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: cve@...nel.org, linux-kernel@...r.kernel.org,
        Vegard Nossum <vegard.nossum@...cle.com>
Subject: Re: CVE-2024-26929: scsi: qla2xxx: Fix double free of fcport

Hi Greg,

On 29/12/24 12:54, Greg Kroah-Hartman wrote:
...
>>
>>
>> I think the broken commit/vuln commit is: 4895009c4bb7 ("scsi: qla2xxx:
>> Prevent command send on chip reset") and this is only present in stable
>> kernels newer than (>=) 5.15.y.
>>
>> Is it worth putting the vuln commit information if we find out what the
>> broken/vuln commit is while trying to backport it to older stable kernels ?
> 
> Yes it is, our tools provide for this, see:
> 	https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/schema#n69
> for how to do it (i.e. give us a git id and we can add a .vulnerable
> file so the tools pick it up properly, or send us a patch for that!)
> 
> Do you want to send a patch for this, or do you need us to?
> 

I will send a patch, thanks for the guidance.


Thanks,
Harshit

> thanks,
> 
> greg k-h