| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-26671: blk-mq: fix IO hang from sbitmap wakeup race |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| blk-mq: fix IO hang from sbitmap wakeup race |
| |
| In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered |
| with the following blk_mq_get_driver_tag() in case of getting driver |
| tag failure. |
| |
| Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe |
| the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime |
| blk_mq_mark_tag_wait() can't get driver tag successfully. |
| |
| This issue can be reproduced by running the following test in loop, and |
| fio hang can be observed in < 30min when running it on my test VM |
| in laptop. |
| |
| modprobe -r scsi_debug |
| modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 |
| dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` |
| fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ |
| --runtime=100 --numjobs=40 --time_based --name=test \ |
| --ioengine=libaio |
| |
| Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which |
| is just fine in case of running out of tag. |
| |
| The Linux kernel CVE team has assigned CVE-2024-26671 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 4.19.307 with commit 9525b38180e2753f0daa1a522b7767a2aa969676 |
| Fixed in 5.4.269 with commit ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10 |
| Fixed in 5.10.210 with commit 7610ba1319253225a9ba8a9d28d472fc883b4e2f |
| Fixed in 5.15.149 with commit 89e0e66682e1538aeeaa3109503473663cd24c8b |
| Fixed in 6.1.77 with commit 1d9c777d3e70bdc57dddf7a14a80059d65919e56 |
| Fixed in 6.6.16 with commit 6d8b01624a2540336a32be91f25187a433af53a0 |
| Fixed in 6.7.4 with commit f1bc0d8163f8ee84a8d5affdf624cfad657df1d2 |
| Fixed in 6.8 with commit 5266caaf5660529e3da53004b8b7174cab6374ed |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-26671 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| block/blk-mq.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676 |
| https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10 |
| https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f |
| https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b |
| https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56 |
| https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0 |
| https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2 |
| https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed |
