In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Skip vport under deletion in report ID acquisition<\/p>\n
qla24xx_report_id_acquisition() format-1 handling walks ha->vp_list under
\nvport_slock, takes a vref_count on the matching vport and calls
\nqla_update_host_map() to register its port id.<\/p>\n
A vport teardown via qla24xx_vport_delete() sets VPORT_DELETE, then
\nqla24xx_disable_vp() removes the vport from the host_map btree and zeroes
\nvha->d_id (RESET_AL_PA). The vport is only unlinked from vp_list later,
\nin qla24xx_deallocate_vp_id(), which clears vp_map[idx] (RESET_VP_IDX)
\nbut does not touch host_map. In the window in between, report ID
\nacquisition can still find the vport on vp_list and call
\nqla_update_host_map(); with d_id already zeroed it takes the
\nbtree_insert32() path and re-inserts the dying vport into host_map.
\nNothing cleans that entry afterwards, so once scsi_host_put() frees the
\nvha a later host_map lookup dereferences freed memory.<\/p>\n
Skip a vport that has VPORT_DELETE set before taking the reference, so it
\nis neither re-registered nor scheduled for DPC re-registration. This
\nmirrors the existing guard in qla2x00_alert_all_vps().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Skip vport under deletion in report ID acquisition<\/p>\n
qla24xx_report_id_acquisition() format-1 handling walks ha->vp_l<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28963","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}