CVE-2026-97537: scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking
qla25xxfreereqque() and qla25xxfreerspque() have two pre-existing bugs exposed on the error path of qla25xxcreate{req,rsp}que():
1. When dmaalloccoherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dmafreecoherent() with a NULL cpuaddr is undefined behavior and can panic.
2. The free functions clear reqqidmap / rspqidmap under vportlock, but the create functions protect the same bitmaps with mqlock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mqlock before calling the free function, creating a window where another thread can allocate the same queid and have its ha->reqqmap entry clobbered by the subsequent lockless NULL assignment in the free function.
Fix by:
- Guarding dmafreecoherent() with a NULL check on the ring pointer.
- Using mqlock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit.
- Removing the now-redundant clearbit blocks from the create error paths since the free functions handle it atomically.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the qla2xxx queue teardown/create error paths to guard dma_free_coherent() with a NULL check on req->ring/rsp->ring, remove the redundant clear_bit blocks from the create error paths, and use mq_lock in qla25xx_free_req_que() and qla25xx_free_rsp_que() to atomically NULL the map entry and clear the bitmap bit.
Event History
Frequently Asked Questions
Under what conditions can this issue be triggered?
The NULL dma_free_coherent() case is exposed when dma_alloc_coherent() fails while creating a request or response queue. The bitmap and queue-map race requires queue creation and teardown activity that can overlap across threads.
What is the practical impact of the affected error path?
Freeing a queue whose ring allocation failed can invoke dma_free_coherent() with a NULL CPU address, which is undefined behavior and can panic the system. The locking issue can also allow a newly allocated queue ID's map entry to be cleared by another queue's cleanup.