In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature<\/p>\n
qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll
\nrsp_q->ring_ptr->signature for RESPONSE_PROCESSED (0xDEADDEAD) to decide
\nwhether the next continuation IOCB has arrived, spinning on cpu_relax()
\nwithout advancing the ring or decrementing the entry count while it has
\nnot. response_t::signature lives at byte offset 60, but a continuation
\nIOCB (sts_cont_entry_t \/ struct sts_cont_entry_ext) carries raw FC frame
\npayload at that offset (data[56..59]). A received frame whose payload
\nbytes happen to equal 0xDEADDEAD is therefore misread as “not yet
\narrived”, and the loop spins forever in interrupt\/DPC context, causing a
\nCPU soft lockup.<\/p>\n
The poll is also unnecessary: callers of qla27xx_copy_multiple_pkt()
\n(PT_LS4_UNSOL and the NVMe purls path) already gate on
\nqla_chk_cont_iocb_avail(), which guarantees all entry_count IOCBs are
\npresent before copying begins. The sibling helper
\n__qla_copy_purex_to_buffer() already drops the signature poll and relies
\non the entry_type == STATUS_CONT_TYPE guard instead.<\/p>\n
Remove the signature busy-wait from both helpers, keeping the entry_type
\nguard, and gate the FPIN path with qla_chk_cont_iocb_avail() so it defers
\nand re-processes on the next interrupt once all continuation IOCBs have
\narrived, mirroring the ELS_AUTH_ELS and PT_LS4_UNSOL arms. With this the
\nsignature field is never read on a continuation IOCB, eliminating the
\npayload-aliasing lockup.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature<\/p>\n
qla27xx_copy_multiple_pkt() and qla27xx_copy_fpin_pkt() poll
\nrs<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28962","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}