qla2x00 FCE trace UAF: Fix race in qla_init.c

Vulnerability Overview Vulnerability Name: Vulnerability Type: Use-After-Free (UAF) Trigger Scenario: During a firmware dump, releases while holding the lock. Subsequently, when reads , if is NULL, the copy operation is skipped. However, a concurrent dump might complete the check and copy data to an already freed buffer, leading to a use-after-free condition. Impact Scope Affected Driver: QLogic QLA2xxx series ( driver) Affected File: Affected Versions: Linux kernel stable branch ( ) Fix Details Fix Commit: ("Move FCE trace buffer allocation to user control") Fix Contents: - In , release the lock before freeing to avoid releasing memory while holding the lock. - In , skip the copy operation if is NULL. - In , set to NULL after freeing it to prevent subsequent access. POC/Exploit Code ```c void qla2x00_free_fce_trace(struct qla_hw_data ha) { if (!ha->fce) return; void fce; dma_addr_t fce_dma; unsigned long flags; / Unpublish ha->fce under hardware lock so a firmware dump in progress (which reads ha->fce under the same lock) cannot race with the buffer being freed. / spin_lock_irqsave(&ha->hardware_lock, flags); if (!ha->fce) { spin_unlock_irqrestore(&ha->hardware_lock, flags); return; } fce = ha->fce; fce_dma = ha->fce_dma; ha->fce = NULL; ha->fce_dma = 0; spin_unlock_irqrestore(&ha->hardware_lock, flags); dma_free_coherent(qla2x00_alloc_fce_trace(qla_host_t vha) { if (!ha->fce) return; void fce; dma_addr_t fce_dma; unsigned long flags; / Unpublish ha->fce under hardware lock so a firmware dump in progress (which reads ha->fce under the same lock) cannot race with the buffer being freed. / spin_lock_irqsave(&ha->hardware_lock, flags); if (!ha->fce) { spin_unlock_irqrestore(&ha->hardware_lock, flags); return; } fce = ha->fce; fce_dma = ha->fce_dma; ha->fce = NULL; ha->fce_dma = 0; spin_unlock_irqrestore(&ha->hardware_lock, flags); dma_free_coherent(qla2x00_alloc_fce_trace(qla_host_t vha) { if (!ha->fce) return; void fce; dma_addr_t fce_dma; unsigned long flags; / Unpublish ha->fce under hardware lock so a firmware dump in progress (which reads ha->fce under the same lock) cannot race with the buffer being freed. / spin_lock_irqsave(&ha->hardware_lock, flags); if (!ha->fce) { spin_unlock_irqrestore(&ha->hardware_lock, flags); return; } fce = ha->fce; fce_dma = ha->fce_dma; ha->fce = NULL; ha->fce_dma = 0; spin_unlock_irqrestore(&ha->hardware_lock, flags); dma_free_coherent(qla2x00_alloc_fce_trace(qla_host_t vha) { if (!ha->fce) return; void fce; dma_addr_t fce_dma; unsigned long flags; / Unpublish ha->fce under hardware lock so a firmware dump in progress (which reads ha->fce under the same lock) cannot race with the buffer being freed. / spin_lock_irqsave(&ha->hardware_lock, flags); if (!ha->fce) { spin_unlock_irqrestore(&ha->hardware_lock, flags); return; } fce = ha->fce; fce_dma = ha->fce_dma; ha->fce = NULL; ha->fce_dma = 0; spin_unlock_irqrestore(&ha->hardware_lock, flags); dma_free_coherent(qla2x00_alloc_fce_trace(qla_host_t vha) { if (!ha->fce) return; void fce; dma_addr_t fce_dma; unsigned long flags; / Unpublish ha->fce under hardware lock so a firmware dump in progress (which reads ha->fce under the same lock) cannot race with the buffer being freed. / spin_lock_irqsave(&ha->hardware_lock, flags); if (!ha->fce) { spin_unlock_irqrestore(&ha->hardware_lock, flags); return; } fce = ha->fce; fce_dma = ha->fce_dma; ha->fce = NULL; ha->fce_dma = 0; spin_unlock_irqrestore(&ha->hardware_lock, flags); dma_free_coherent(qla2x00_alloc_fce_trace(qla_host_t vha) { if (!ha->fce) return; void fce; dma_addr_t fce_dma; unsigned long flags; / Unpublish ha->fce under hardware lock so a firmware dump in progress (which reads ha->fce under the same lock) cannot race with the buffer being freed. / spin_lock_irqsave(&ha->hardware_lock, flags); if (!ha->fce) { spin_unlock_irqrestore(&ha->hardware_lock, flags); return; } fce = ha->fce; fce_dma = ha->fce_dma; ha->fce = NULL; ha->fce_dma = 0; spin_unlock_irqrestore(&ha->hardware_lock, flags); dma_free_coherent(qla2x00_alloc_fce_trace(qla_host_t vha) { if (!ha->fce) return; void fce; dma_addr_t fce_dma; unsigned long flags; / Unpublish ha->fce under hardware lock so a firmware dump in progress (which reads ha->fce under the same lock) cannot race with the buffer being freed. / spin_lock_irqsave(&ha->hardware_lock, flags); if (!ha->fce) { spin_unlock_irqrestore(&ha->hardware_lock, flags); return; } fce = ha->fce; fce_dma = ha->fce_dma; ha->fce = NULL; ha->fce_dma = 0; spin_unlock_irqrestore(&ha->hardware_lock, flags); dma_free_coherent(qla2x00_alloc_fce_trace(qla_host_t vha) { if (!ha->fce) return; void fce; dma_addr_t fce_dma; unsigned long flags; / Unpublish ha->fce under hardware lock so a firmware dump in progress (which reads ha->fce under the same lock) cannot race with the buffer being freed. / spin_lock_irqsave(&ha->hardware_lock, flags); if (!ha->fce) { spin_unlock_irqrestore(&ha->hardware_lock, flags); return; } fce = ha->fce; fce_dma = ha->fce_dma; ha->fce = NULL; ha-

Goal Reached Thanks to every supporter — we hit 100%!

qla2x00 FCE trace UAF: Fix race in qla_init.c