CVE-2022-49217

scsi: pm8001: Fix abort all task initialization

State: Published
Severity: Not scored
Published: Feb 26, 2025
Updated: May 11, 2026
Reserved: Feb 26, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm8001: Fix abort all task initialization

In pm80xx_send_abort_all(), the n_elem field of the ccb used is not initialized to 0. This missing initialization sometimes lead to the task completion path seeing the ccb with a non-zero n_elem resulting in the execution of invalid dma_unmap_sg() calls in pm8001_ccb_task_free(), causing a crash such as:

[ 197.676341] RIP: 0010:iommu_dma_unmap_sg+0x6d/0x280 [ 197.700204] RSP: 0018:ffff889bbcf89c88 EFLAGS: 00010012 [ 197.705485] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83d0bda0 [ 197.712687] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff88810dffc0d0 [ 197.719887] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff8881c790098b [ 197.727089] R10: ffffed1038f20131 R11: 0000000000000001 R12: 0000000000000000 [ 197.734296] R13: ffff88810dffc0d0 R14: 0000000000000010 R15: 0000000000000000 [ 197.741493] FS: 0000000000000000(0000) GS:ffff889bbcf80000(0000) knlGS:0000000000000000 [ 197.749659] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 197.755459] CR2: 00007f16c1b42734 CR3: 0000000004814000 CR4: 0000000000350ee0 [ 197.762656] Call Trace: [ 197.765127] <IRQ> [ 197.767162] pm8001_ccb_task_free+0x5f1/0x820 [pm80xx] [ 197.772364] ? do_raw_spin_unlock+0x54/0x220 [ 197.776680] pm8001_mpi_task_abort_resp+0x2ce/0x4f0 [pm80xx] [ 197.782406] process_oq+0xe85/0x7890 [pm80xx] [ 197.786817] ? lock_acquire+0x194/0x490 [ 197.790697] ? handle_irq_event+0x10e/0x1b0 [ 197.794920] ? mpi_sata_completion+0x2d70/0x2d70 [pm80xx] [ 197.800378] ? __wake_up_bit+0x100/0x100 [ 197.804340] ? lock_is_held_type+0x98/0x110 [ 197.808565] pm80xx_chip_isr+0x94/0x130 [pm80xx] [ 197.813243] tasklet_action_common.constprop.0+0x24b/0x2f0 [ 197.818785] __do_softirq+0x1b5/0x82d [ 197.822485] ? do_raw_spin_unlock+0x54/0x220 [ 197.826799] __irq_exit_rcu+0x17e/0x1e0 [ 197.830678] irq_exit_rcu+0xa/0x20 [ 197.834114] common_interrupt+0x78/0x90 [ 197.840051] </IRQ> [ 197.844236] <TASK> [ 197.848397] asm_common_interrupt+0x1e/0x40

Avoid this issue by always initializing the ccb n_elem field to 0 in pm8001_send_abort_all(), pm8001_send_read_log() and pm80xx_send_abort_all().

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 9914461db82caee6c519acfbe10a86fe11bcdecaAffected c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before d6ec4471550cc53e96485a7124c5891e6a38d1c3Affected c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 1824a21b2cedc5774a5adfa74f5f7b90472d8677Affected c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 765674e3b30121782a2b792684554baa48c61f5eAffected c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 279f318bd7d6e04e6e0bc7b8cd8e190da8fa37a4Affected c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before c8db786858d895ac58342f67767b4999ae6538faAffected c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 326d894adf89f3c707b7784becbe241830daaab6Affected c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 16cd02e0951b520bef324adb9a35afcc92501cafAffected c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 7f12845c8389855dbcc67baa068b6832dc4a396eAffected
LinuxLinux	3.10Affected before 3.10Not affected 4.9.311 through 4.9.Not affected 4.14.276 through 4.14.Not affected 4.19.238 through 4.19.Not affected 5.4.189 through 5.4.Not affected 5.10.110 through 5.10.Not affected 5.15.33 through 5.15.Not affected 5.16.19 through 5.16.Not affected 5.17.2 through 5.17.Not affected 5.18 and laterNot affected

Product

Versions

LinuxLinux

c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 9914461db82caee6c519acfbe10a86fe11bcdecaAffected
c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before d6ec4471550cc53e96485a7124c5891e6a38d1c3Affected
c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 1824a21b2cedc5774a5adfa74f5f7b90472d8677Affected
c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 765674e3b30121782a2b792684554baa48c61f5eAffected
c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 279f318bd7d6e04e6e0bc7b8cd8e190da8fa37a4Affected
c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before c8db786858d895ac58342f67767b4999ae6538faAffected
c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 326d894adf89f3c707b7784becbe241830daaab6Affected
c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 16cd02e0951b520bef324adb9a35afcc92501cafAffected
c6b9ef5779c3e1edfa9de949d2a51252bc347663 to before 7f12845c8389855dbcc67baa068b6832dc4a396eAffected

LinuxLinux

3.10Affected
before 3.10Not affected
4.9.311 through 4.9.*Not affected
4.14.276 through 4.14.*Not affected
4.19.238 through 4.19.*Not affected
5.4.189 through 5.4.*Not affected
5.10.110 through 5.10.*Not affected
5.15.33 through 5.15.*Not affected
5.16.19 through 5.16.*Not affected
5.17.2 through 5.17.*Not affected
5.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.