CVE-2021-46964

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Reserve extra IRQ vectors

Commit a6dcfe08487e ("scsi: qla2xxx: Limit interrupt vectors to number of

CPUs") lowers the number of allocated MSI-X vectors to the number of CPUs.

That breaks vector allocation assumptions in qla83xx_iospace_config(),

qla24xx_enable_msix() and qla2x00_iospace_config(). Either of the functions

computes maximum number of qpairs as:

ha->max_qpairs = ha->msix_count - 1 (MB interrupt) - 1 (default

response queue) - 1 (ATIO, in dual or pure target mode)

max_qpairs is set to zero in case of two CPUs and initiator mode. The

number is then used to allocate ha->queue_pair_map inside

qla2x00_alloc_queues(). No allocation happens and ha->queue_pair_map is

left NULL but the driver thinks there are queue pairs available.

qla2xxx_queuecommand() tries to find a qpair in the map and crashes:

if (ha->mqenable) {

uint32_t tag;

uint16_t hwq;

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References