In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation<\/p>\n
ha->msix_count is u16, but ha->max_req_queues, ha->max_rsp_queues and
\nha->max_qpairs are u8. Deriving the queue count as
\n“ha->max_req_queues = ha->msix_count – 1” therefore truncates: a board
\n(or a misconfigured\/malicious hot-plugged device) advertising 257 MSI-X
\nvectors yields msix_count – 1 == 256, which truncates to 0. An MSI-X
\ncount of 1 zeroes it as well, and in target mode the subsequent
\n“ha->max_req_queues–” then underflows 0 to 255.<\/p>\n
When the count is 0, qla2x00_alloc_queues() calls
\nkzalloc_objs(struct req_que *, 0), which returns ZERO_SIZE_PTR. That is
\nnot NULL, so the allocation check passes and the following
\n“ha->req_q_map[0] = req” dereferences ZERO_SIZE_PTR, corrupting memory
\nor crashing the kernel.<\/p>\n
Add qla_calc_queue_count() to clamp the derived value into
\n[1, QLA_MAX_QUEUES – 1] so it always fits in u8 and is never zero, and
\nuse it at all three derivation sites (qla25xx_iospace_config(),
\nqla83xx_iospace_config() and qla24xx_enable_msix()). Also guard the
\ntarget-mode decrement so it cannot reintroduce a zero (which would in
\nturn underflow max_qpairs).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation<\/p>\n
ha->msix_count is u16, but ha->max_req_queues, ha->max_rsp_que<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24543","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24543","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24543"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24543"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24543"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}