In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Quiesce response IRQ before freeing request queue<\/p>\n
qla2xxx_delete_qpair() deletes the request queue before the response
\nqueue. qla25xx_delete_req_que() frees the request queue memory
\n(kfree(req) in qla25xx_free_req_que()), but the response-queue MSI-X is
\nonly released later, in qla25xx_free_rsp_que(). In that window the
\nresponse interrupt can still fire, qla2xxx_msix_rsp_q() queues
\nqpair->q_work, and qla_do_work() -> qla24xx_process_response_queue()
\ndereferences the now-freed rsp->req (LOGINOUT\/CT\/ELS entries and the
\nstatus path), a use-after-free.<\/p>\n
The cancel_work_sync() added for the qpair teardown lives in the
\nresponse free path, which runs after the request queue is already freed,
\nso it does not protect rsp->req.<\/p>\n
Release the response-queue interrupt and flush qpair->q_work before
\ndeleting the request queue, so no late completion can reach the freed
\nrequest queue. Clearing have_irq makes the subsequent
\nqla25xx_free_rsp_que() skip its free_irq(), and the firmware
\nqueue-delete order (request then response) is preserved; the
\nrequest-delete mailbox completes on the default vector and is unaffected
\nby dropping the qpair response interrupt early.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Quiesce response IRQ before freeing request queue<\/p>\n
qla2xxx_delete_qpair() deletes the request queue before the respo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24535","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24535","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24535"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24535"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24535"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}