Maurizio Lombardi

The issue is related to a kernel panic that occurs when a host sends an invalid H2C PDU length. If the host sends an H2CData command with an invalid DATAL, the kernel may crash in the `nvmet tcp build pdu iovec()` function due to a null pointer dereference. The PDU length should never exceed the `MAXH2CDATA` parameter, which has been communicated to the host in `nvmet tcp handle icreq()`. To fix the bug, a fatal error is raised if DATAL isn't coherent with the packet size.

The issue is related to the `flush all cpu locked()` function in the Linux kernel's memory management subsystem. When this function is called from a task context, it may cause a dependency issue if a workqueue with the `WQ MEM RECLAIM` bit set ends up flushing the global workqueue. This can lead to problems with memory management and potentially affect the confidentiality, integrity, and availability of protected information. The vulnerability can be exploited by creating a workqueue for the flush operation without the `WQ MEM RECLAIM` bit set.

The vulnerability is related to the `bnx2fc` driver in the Linux kernel. The `bnx2fc destroy()` function removes the interface before calling `destroy work`, resulting in multiple warnings from `sysfs remove group()` as the controller rport device attributes are removed too early. This issue can be reproduced by following specific steps, including enabling `fcoe` and executing `fipvlan` and `fcoeadm` commands. The problem is caused by the removal of the `fcoe port`'s `destroy work` queue, which is not needed.