CVE-2021-46964: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's qla2xxx driver was discovered where commit a6dcfe08487e lowered the number of allocated MSI-X vectors to the number of CPUs, leading to potential system crashes. The vulnerability is tracked as CVE-2021-46964 and affects the SCSI subsystem (Kernel Git).

The vulnerability stems from broken vector allocation assumptions in qla83xx_iospace_config(), qla24xx_enable_msix() and qla2x00_iospace_config() functions. The issue occurs when max_qpairs is set to zero in case of two CPUs and initiator mode, resulting in ha->queue_pair_map being NULL while the driver assumes queue pairs are available. This leads to a NULL pointer dereference in qla2xxx_queuecommand() when attempting to find a qpair in the map (Kernel Git).

When exploited, this vulnerability causes a kernel NULL pointer dereference, resulting in system crashes. This particularly affects systems running with dual core VMs and can lead to unbalanced QP allocation where nr_hw_queues becomes two less than the number of CPUs (Kernel Git).

The vulnerability is triggered during normal system operation when using the affected driver with specific hardware configurations, particularly on dual core virtual machines. The issue manifests when the system attempts to handle SCSI commands through the qla2xxx driver (Kernel Git).

The fix involves modifying the driver to allocate enough vectors to provide every CPU its own HW queue while still handling reserved (MB, RSP, ATIO) interrupts. This was implemented by adjusting the vector allocation calculation to account for the minimum required vectors in addition to the number of CPUs (Kernel Git).