In the Linux kernel, the following vulnerability has been resolved:
blk-mq: fix IO hang from sbitmap wakeup race
In blkmqmarktagwait(), _addwaitqueue() may be re-ordered with the following blkmqgetdriver_tag() in case of getting driver tag failure.
Then in _sbitmapqueuewakeup(), waitqueueactive() may not observe the added waiter in blkmqmarktagwait() and wake up nothing, meantime blkmqmarktag_wait() can't get driver tag successfully.
This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop.
modprobe -r scsi_debug
modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4
dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename`
fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \
--runtime=100 --numjobs=40 --time_based --name=test \
--ioengine=libaio
Fix the issue by adding one explicit barrier in blkmqmarktagwait(), which is just fine in case of running out of tag.
[
{
"digest": {
"function_hash": "317766477485950130176728564292599542534",
"length": 1132.0
},
"id": "CVE-2024-26671-088ddda3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d8b01624a2540336a32be91f25187a433af53a0",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "blk_mq_mark_tag_wait",
"file": "block/blk-mq.c"
},
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"220544317467600312798489079079791091195",
"142151300184979753724063565579518789304",
"256439953879865239311161222429273354902"
],
"threshold": 0.9
},
"id": "CVE-2024-26671-1a7defa1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d8b01624a2540336a32be91f25187a433af53a0",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "block/blk-mq.c"
},
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"220544317467600312798489079079791091195",
"142151300184979753724063565579518789304",
"256439953879865239311161222429273354902"
],
"threshold": 0.9
},
"id": "CVE-2024-26671-229097df",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e0e66682e1538aeeaa3109503473663cd24c8b",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "block/blk-mq.c"
},
"signature_type": "Line"
},
{
"digest": {
"function_hash": "136873343218598927669503008124322997049",
"length": 965.0
},
"id": "CVE-2024-26671-46a6c6f7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@89e0e66682e1538aeeaa3109503473663cd24c8b",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "blk_mq_mark_tag_wait",
"file": "block/blk-mq.c"
},
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"220544317467600312798489079079791091195",
"142151300184979753724063565579518789304",
"256439953879865239311161222429273354902"
],
"threshold": 0.9
},
"id": "CVE-2024-26671-50ac0983",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "block/blk-mq.c"
},
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"220544317467600312798489079079791091195",
"142151300184979753724063565579518789304",
"256439953879865239311161222429273354902"
],
"threshold": 0.9
},
"id": "CVE-2024-26671-55651e27",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1bc0d8163f8ee84a8d5affdf624cfad657df1d2",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "block/blk-mq.c"
},
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"325931103722087141719808178094923618421",
"142151300184979753724063565579518789304",
"256439953879865239311161222429273354902"
],
"threshold": 0.9
},
"id": "CVE-2024-26671-5c77634c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9525b38180e2753f0daa1a522b7767a2aa969676",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "block/blk-mq.c"
},
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"220544317467600312798489079079791091195",
"142151300184979753724063565579518789304",
"256439953879865239311161222429273354902"
],
"threshold": 0.9
},
"id": "CVE-2024-26671-5ec86a9c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7610ba1319253225a9ba8a9d28d472fc883b4e2f",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "block/blk-mq.c"
},
"signature_type": "Line"
},
{
"digest": {
"function_hash": "106083950870431828665100067153571268036",
"length": 973.0
},
"id": "CVE-2024-26671-8ccd0d83",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9525b38180e2753f0daa1a522b7767a2aa969676",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "blk_mq_mark_tag_wait",
"file": "block/blk-mq.c"
},
"signature_type": "Function"
},
{
"digest": {
"function_hash": "317766477485950130176728564292599542534",
"length": 1132.0
},
"id": "CVE-2024-26671-a2bf6127",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5266caaf5660529e3da53004b8b7174cab6374ed",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "blk_mq_mark_tag_wait",
"file": "block/blk-mq.c"
},
"signature_type": "Function"
},
{
"digest": {
"function_hash": "207734912550080890786068744321856075804",
"length": 1089.0
},
"id": "CVE-2024-26671-adec8c17",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "blk_mq_mark_tag_wait",
"file": "block/blk-mq.c"
},
"signature_type": "Function"
},
{
"digest": {
"function_hash": "317766477485950130176728564292599542534",
"length": 1132.0
},
"id": "CVE-2024-26671-cb167dba",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1bc0d8163f8ee84a8d5affdf624cfad657df1d2",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "blk_mq_mark_tag_wait",
"file": "block/blk-mq.c"
},
"signature_type": "Function"
},
{
"digest": {
"function_hash": "136873343218598927669503008124322997049",
"length": 965.0
},
"id": "CVE-2024-26671-d0a894ca",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7610ba1319253225a9ba8a9d28d472fc883b4e2f",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "blk_mq_mark_tag_wait",
"file": "block/blk-mq.c"
},
"signature_type": "Function"
},
{
"digest": {
"line_hashes": [
"220544317467600312798489079079791091195",
"142151300184979753724063565579518789304",
"256439953879865239311161222429273354902"
],
"threshold": 0.9
},
"id": "CVE-2024-26671-de2ba520",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d9c777d3e70bdc57dddf7a14a80059d65919e56",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "block/blk-mq.c"
},
"signature_type": "Line"
},
{
"digest": {
"line_hashes": [
"220544317467600312798489079079791091195",
"142151300184979753724063565579518789304",
"256439953879865239311161222429273354902"
],
"threshold": 0.9
},
"id": "CVE-2024-26671-e14598c1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5266caaf5660529e3da53004b8b7174cab6374ed",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "block/blk-mq.c"
},
"signature_type": "Line"
},
{
"digest": {
"function_hash": "317766477485950130176728564292599542534",
"length": 1132.0
},
"id": "CVE-2024-26671-ee53faea",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d9c777d3e70bdc57dddf7a14a80059d65919e56",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "blk_mq_mark_tag_wait",
"file": "block/blk-mq.c"
},
"signature_type": "Function"
}
]