Linux kernel qla2xxx driver vulnerabilities

In the Linux kernel, the qla2xxx SCSI driver has a double free bug in bsg_done(). Some error paths call bsg_done() even though most routines call it only on success, leading to a kernel panic (page fault, oops).

In the Linux kernel, the qla2xxx driver has a bug that causes a system crash during repeated module load/unload tests. When a fabric scan is in progress and the module is unloaded, DMA memory is freed in interrupt context, leading to a crash. The fix delays module unload until the fabric scan completes.

In the Linux kernel, the qla2xxx SCSI driver has a memory leak in the error path where the sp object is not freed. This leaves objects in the 'qla2xxx_srbs' slab cache and causes a system crash during module unload (rmmod).