In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix crash when I/O abort times out
While performing CPU hotplug, a crash with the following stack was seen:
Call Trace: qla24xxprocessresponsequeue+0x42a/0x970 [qla2xxx] qla2x00startnvmemq+0x3a2/0x4b0 [qla2xxx] qlanvmepostcmd+0x166/0x240 [qla2xxx] nvmefcstartfcpop.part.0+0x119/0x2e0 [nvmefc] blkmqdispatchrqlist+0x17b/0x610 _blkmqscheddispatchrequests+0xb0/0x140 blkmqscheddispatchrequests+0x30/0x60 _blkmqrunhwqueue+0x35/0x90 _blkmqdelayrunhwqueue+0x161/0x180 blkexecuterq+0xbe/0x160 _nvmesubmitsynccmd+0x16f/0x220 [nvmecore] nvmfconnectadminqueue+0x11a/0x170 [nvmefabrics] nvmefccreateassociation.cold+0x50/0x3dc [nvmefc] nvmefcconnectctrlwork+0x19/0x30 [nvmefc] processonework+0x1e8/0x3c0
On abort timeout, completion was called without checking if the I/O was already completed.
Verify that I/O and abort request are indeed outstanding before attempting completion.