CVE-2022-49159: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a race condition vulnerability was discovered in the qla2xxx driver. The issue occurs between the timeout handler and done function, where qla2x00_async_iocb_timeout() can be preempted by the normal response path via firmware. When this happens, qla24xx_async_gpsc_sp_done() releases the SRB unconditionally, leading to a NULL pointer dereference when qla24xx_async_abort_cmd() attempts to access the freed sp->qpair pointer (Kernel Git).

The vulnerability stems from a race condition between the timeout handler and done function in the qla2xxx driver. When qla2x00_async_iocb_timeout() starts execution, it can be preempted by the normal response path through the firmware. The qla24xx_async_gpsc_sp_done() function then unconditionally releases the SRB (SCSI Request Block). When execution returns to qla2x00_async_iocb_timeout(), the subsequent call to qla24xx_async_abort_cmd() attempts to access the now-freed sp->qpair pointer, resulting in a NULL pointer dereference (Kernel Git).

The vulnerability can lead to a kernel NULL pointer dereference, potentially causing system crashes or denial of service conditions. This affects the stability and availability of systems using the qla2xxx driver for SCSI storage devices (Kernel Git).

The vulnerability can be triggered during normal operation of the SCSI subsystem when timeout conditions occur. A specific sequence of events involving timeouts and firmware responses is required to trigger the race condition (Kernel Git).

The issue has been fixed by implementing a reference counter for SRB. The solution introduces proper synchronization using locks and reference counting, where one reference is taken for the normal code path and another for the timeout path. The fix ensures proper handling of the race condition between the normal case and timeout/abort handler (Kernel Git).