In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Avoid double completion in async IOCB timeout<\/p>\n
qla2x00_async_iocb_timeout() tries to abort a timed-out async IOCB. When
\nqla24xx_async_abort_cmd() fails, both the SRB_LOGIN_CMD path and the
\nSRB_CTRL_VP\/default path scan outstanding_cmds[] for the SRB and then
\ncall sp->done(sp, QLA_FUNCTION_TIMEOUT) unconditionally, without checking
\nwhether the SRB was actually found and removed.<\/p>\n
If the response ISR completes the same handle first, it removes the SRB
\nunder qp_lock_ptr and runs sp->done() -> complete(sp->comp). The
\nsubmitter qla24xx_control_vp() wakes from wait_for_completion(), clears
\nsp->comp, drops its reference and returns, reclaiming the on-stack
\ncompletion. The timer reference keeps the SRB alive across the timeout
\nhandler, but not the submitter’s stack. The timeout then issues a second
\nsp->done() -> qla_ctrlvp_sp_done(), which evaluates “if (sp->comp)
\ncomplete(sp->comp)”; with the pointer loaded before the submitter’s NULL
\nstore, complete() writes into the freed stack frame, a use-after-free.<\/p>\n
Track whether this path removed the SRB from outstanding_cmds and only
\ncall sp->done() when it did, so the command is completed exactly once by
\nwhichever path owns it. This mirrors the sp_found guard already used in
\nqla24xx_abort_iocb_timeout().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Avoid double completion in async IOCB timeout<\/p>\n
qla2x00_async_iocb_timeout() tries to abort a timed-out async IOCB. W<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24534","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24534","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24534"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24534"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24534"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}