In the Linux kernel, the following vulnerability has been resolved:
blk-mq: fix IO hang from sbitmap wakeup race
In blkmqmarktagwait(), _addwaitqueue() may be re-ordered with the following blkmqgetdriver_tag() in case of getting driver tag failure.
Then in _sbitmapqueuewakeup(), waitqueueactive() may not observe the added waiter in blkmqmarktagwait() and wake up nothing, meantime blkmqmarktag_wait() can't get driver tag successfully.
This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop.
modprobe -r scsi_debug
modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4
dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`
fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \
--runtime=100 --numjobs=40 --time_based --name=test \
--ioengine=libaio
Fix the issue by adding one explicit barrier in blkmqmarktagwait(), which is just fine in case of running out of tag.
{ "vanir_signatures": [ { "id": "CVE-2024-26671-088ddda3", "signature_type": "Function", "target": { "file": "block/blk-mq.c", "function": "blk_mq_mark_tag_wait" }, "signature_version": "v1", "digest": { "length": 1132.0, "function_hash": "317766477485950130176728564292599542534" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d8b01624a2540336a32be91f25187a433af53a0" }, { "id": "CVE-2024-26671-1a7defa1", "signature_type": "Line", "target": { "file": "block/blk-mq.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "220544317467600312798489079079791091195", "142151300184979753724063565579518789304", "256439953879865239311161222429273354902" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d8b01624a2540336a32be91f25187a433af53a0" }, { "id": "CVE-2024-26671-229097df", "signature_type": "Line", "target": { "file": "block/blk-mq.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "220544317467600312798489079079791091195", "142151300184979753724063565579518789304", "256439953879865239311161222429273354902" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e0e66682e1538aeeaa3109503473663cd24c8b" }, { "id": "CVE-2024-26671-46a6c6f7", "signature_type": "Function", "target": { "file": "block/blk-mq.c", "function": "blk_mq_mark_tag_wait" }, "signature_version": "v1", "digest": { "length": 965.0, "function_hash": "136873343218598927669503008124322997049" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e0e66682e1538aeeaa3109503473663cd24c8b" }, { "id": "CVE-2024-26671-55651e27", "signature_type": "Line", "target": { "file": "block/blk-mq.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "220544317467600312798489079079791091195", "142151300184979753724063565579518789304", "256439953879865239311161222429273354902" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1bc0d8163f8ee84a8d5affdf624cfad657df1d2" }, { "id": "CVE-2024-26671-5c77634c", "signature_type": "Line", "target": { "file": "block/blk-mq.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "325931103722087141719808178094923618421", "142151300184979753724063565579518789304", "256439953879865239311161222429273354902" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9525b38180e2753f0daa1a522b7767a2aa969676" }, { "id": "CVE-2024-26671-8ccd0d83", "signature_type": "Function", "target": { "file": "block/blk-mq.c", "function": "blk_mq_mark_tag_wait" }, "signature_version": "v1", "digest": { "length": 973.0, "function_hash": "106083950870431828665100067153571268036" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9525b38180e2753f0daa1a522b7767a2aa969676" }, { "id": "CVE-2024-26671-a2bf6127", "signature_type": "Function", "target": { "file": "block/blk-mq.c", "function": "blk_mq_mark_tag_wait" }, "signature_version": "v1", "digest": { "length": 1132.0, "function_hash": "317766477485950130176728564292599542534" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5266caaf5660529e3da53004b8b7174cab6374ed" }, { "id": "CVE-2024-26671-cb167dba", "signature_type": "Function", "target": { "file": "block/blk-mq.c", "function": "blk_mq_mark_tag_wait" }, "signature_version": "v1", "digest": { "length": 1132.0, "function_hash": "317766477485950130176728564292599542534" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1bc0d8163f8ee84a8d5affdf624cfad657df1d2" }, { "id": "CVE-2024-26671-de2ba520", "signature_type": "Line", "target": { "file": "block/blk-mq.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "220544317467600312798489079079791091195", "142151300184979753724063565579518789304", "256439953879865239311161222429273354902" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d9c777d3e70bdc57dddf7a14a80059d65919e56" }, { "id": "CVE-2024-26671-e14598c1", "signature_type": "Line", "target": { "file": "block/blk-mq.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "220544317467600312798489079079791091195", "142151300184979753724063565579518789304", "256439953879865239311161222429273354902" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5266caaf5660529e3da53004b8b7174cab6374ed" }, { "id": "CVE-2024-26671-ee53faea", "signature_type": "Function", "target": { "file": "block/blk-mq.c", "function": "blk_mq_mark_tag_wait" }, "signature_version": "v1", "digest": { "length": 1132.0, "function_hash": "317766477485950130176728564292599542534" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d9c777d3e70bdc57dddf7a14a80059d65919e56" } ] }