In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown<\/p>\n
The response queue MSI-X handler qla2xxx_msix_rsp_q() schedules
\nqla_do_work() via queue_work(ha->wq, &qpair->q_work). qla_do_work()
\ndereferences the qpair (vha, rsp) and takes qpair->qp_lock.<\/p>\n
During teardown, qla2xxx_delete_qpair() deletes the response queue, which
\ncalls free_irq() in qla25xx_free_rsp_que(), and then frees the queue and
\nthe qpair. free_irq() waits for running hardirq handlers but does not
\ncancel work already placed on ha->wq. A still-pending q_work then runs
\nqla_do_work() against the freed qpair and response queue, causing a
\nuse-after-free. This is especially likely during full adapter teardown,
\nwhere destroy_workqueue(ha->wq) forces pending work to run after the queue
\npairs have been freed.<\/p>\n
Flush the work item with cancel_work_sync() in qla25xx_free_rsp_que()
\nafter free_irq() has released the interrupt (so no new work can be
\nqueued) and before the response queue and qpair memory are freed (so the
\nflushed handler still sees valid memory). Guard on rsp->qpair and ha->wq
\nto match the INIT_WORK() condition and avoid operating on an
\nuninitialized work_struct.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown<\/p>\n
The response queue MSI-X handler qla2xxx_msix_rsp_q() schedules<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28968","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28968","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28968"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28968"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28968"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}