Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() qla2x00_error_entry() reads ha->req_q_map[que] twice: once for the NULL check and again when assigning it to req. The map slot is cleared by qla25xx_free_req_que() (ha->req_q_map[que_id] = NULL under mq_lock) during queue teardown, while the response-queue interrupt that drives qla2x00_error_entry() is still registered (the IRQ is released later in qla25xx_free_rsp_que()). If the slot is set to NULL between the two reads, req becomes NULL and is dereferenced. Read the slot once into req and NULL-check the local before use. mq_lock is a mutex and cannot be taken from interrupt context, so the single read plus local check is the appropriate fix for the reported NULL dereference.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b to < c845f2597787ef70159a32566669e308b2807a56affecteda6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b to < fe04b31e386aee4cc3a18f07462af146037dc389affecteda6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b to < 1b995cf4157465357d66ba096e7cdaafab9972e7affecteda6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b to < d79376fbd2a076de82c1cd8aa0b600b300c75a44affecteda6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b to < 1c90b74e484ba48f31944fe04963d99e01ac3767affecteda6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b to < 5dd9bec8004ba93cee8b689bf54ce294f59e5e3caffecteda6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b to < 35124cfa9898b2088ee72859e573e0876aff66fcaffecteda6fe35c052c4fdd1e8e21251f14eea0bd4bbd25b to < deb8abde83a799d2501f3977f6d6051000253f5eaffected
Linux Linux
Default version status: affected
3.4affected0 to < 3.4unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c845f2597787ef70159a32566669e308b2807a56 ↗
- https://git.kernel.org/stable/c/fe04b31e386aee4cc3a18f07462af146037dc389 ↗
- https://git.kernel.org/stable/c/1b995cf4157465357d66ba096e7cdaafab9972e7 ↗
- https://git.kernel.org/stable/c/d79376fbd2a076de82c1cd8aa0b600b300c75a44 ↗
- https://git.kernel.org/stable/c/1c90b74e484ba48f31944fe04963d99e01ac3767 ↗
- https://git.kernel.org/stable/c/5dd9bec8004ba93cee8b689bf54ce294f59e5e3c ↗
- https://git.kernel.org/stable/c/35124cfa9898b2088ee72859e573e0876aff66fc ↗
- https://git.kernel.org/stable/c/deb8abde83a799d2501f3977f6d6051000253f5e ↗