linux-cve-announce - CVE-2024-26671: blk-mq: fix IO hang from sbitmap wakeup race

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024040219-CVE-2024-26671-2543@gregkh>
Date: Tue,  2 Apr 2024 08:49:23 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-26671: blk-mq: fix IO hang from sbitmap wakeup race

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: fix IO hang from sbitmap wakeup race

In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered
with the following blk_mq_get_driver_tag() in case of getting driver
tag failure.

Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe
the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime
blk_mq_mark_tag_wait() can't get driver tag successfully.

This issue can be reproduced by running the following test in loop, and
fio hang can be observed in < 30min when running it on my test VM
in laptop.

	modprobe -r scsi_debug
	modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4
	dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`
	fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \
       		--runtime=100 --numjobs=40 --time_based --name=test \
        	--ioengine=libaio

Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which
is just fine in case of running out of tag.

The Linux kernel CVE team has assigned CVE-2024-26671 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.307 with commit 9525b38180e2
	Fixed in 5.4.269 with commit ecd7744a1446
	Fixed in 5.10.210 with commit 7610ba131925
	Fixed in 5.15.149 with commit 89e0e66682e1
	Fixed in 6.1.77 with commit 1d9c777d3e70
	Fixed in 6.6.16 with commit 6d8b01624a25
	Fixed in 6.7.4 with commit f1bc0d8163f8
	Fixed in 6.8 with commit 5266caaf5660

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26671
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	block/blk-mq.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676
	https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10
	https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f
	https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b
	https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56
	https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0
	https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2
	https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed