CVE-2022-48758

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()

The bnx2fc_destroy() functions are removing the interface before calling

destroy_work. This results multiple WARNings from sysfs_remove_group() as

the controller rport device attributes are removed too early.

Replace the fcoe_port's destroy_work queue. It's not needed.

The problem is easily reproducible with the following steps.

Example:

$ dmesg -w &

$ systemctl enable --now fcoe

$ fipvlan -s -c ens2f1

$ fcoeadm -d ens2f1.802

[ 583.464488] host2: libfc: Link down on port (7500a1)

[ 583.472651] bnx2fc: 7500a1 - rport not created Yet!!

[ 583.490468] ------------[ cut here ]------------

[ 583.538725] sysfs group 'power' not found for kobject 'rport-2:0-0'

[ 583.568814] WARNING: CPU: 3 PID: 192 at fs/sysfs/group.c:279 sysfs_remove_group+0x6f/0x80

[ 583.607130] Modules linked in: dm_service_time 8021q garp mrp stp ll

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References