Description
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime blk_mq_mark_tag_wait() can't get driver tag successfully. This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop. modprobe -r scsi_debug modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ --runtime=100 --numjobs=40 --time_based --name=test \ --ioengine=libaio Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which is just fine in case of running out of tag.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
da55f2cc78418dee88400aafbbaed19d7ac8188e to < 9525b38180e2753f0daa1a522b7767a2aa969676affectedda55f2cc78418dee88400aafbbaed19d7ac8188e to < ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10affectedda55f2cc78418dee88400aafbbaed19d7ac8188e to < 7610ba1319253225a9ba8a9d28d472fc883b4e2faffectedda55f2cc78418dee88400aafbbaed19d7ac8188e to < 89e0e66682e1538aeeaa3109503473663cd24c8baffectedda55f2cc78418dee88400aafbbaed19d7ac8188e to < 1d9c777d3e70bdc57dddf7a14a80059d65919e56affectedda55f2cc78418dee88400aafbbaed19d7ac8188e to < 6d8b01624a2540336a32be91f25187a433af53a0affectedda55f2cc78418dee88400aafbbaed19d7ac8188e to < f1bc0d8163f8ee84a8d5affdf624cfad657df1d2affectedda55f2cc78418dee88400aafbbaed19d7ac8188e to < 5266caaf5660529e3da53004b8b7174cab6374edaffected
Linux Linux
Default version status: affected
4.11affected0 to < 4.11unaffected4.19.307 to ≤ 4.19.*unaffected5.4.269 to ≤ 5.4.*unaffected5.10.210 to ≤ 5.10.*unaffected5.15.149 to ≤ 5.15.*unaffected6.1.77 to ≤ 6.1.*unaffected6.6.16 to ≤ 6.6.*unaffected6.7.4 to ≤ 6.7.*unaffected6.8 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9525b38180e2753f0daa1a522b7767a2aa969676 ↗
- https://git.kernel.org/stable/c/ecd7744a1446eb02ccc63e493e2eb6ede4ef1e10 ↗
- https://git.kernel.org/stable/c/7610ba1319253225a9ba8a9d28d472fc883b4e2f ↗
- https://git.kernel.org/stable/c/89e0e66682e1538aeeaa3109503473663cd24c8b ↗
- https://git.kernel.org/stable/c/1d9c777d3e70bdc57dddf7a14a80059d65919e56 ↗
- https://git.kernel.org/stable/c/6d8b01624a2540336a32be91f25187a433af53a0 ↗
- https://git.kernel.org/stable/c/f1bc0d8163f8ee84a8d5affdf624cfad657df1d2 ↗
- https://git.kernel.org/stable/c/5266caaf5660529e3da53004b8b7174cab6374ed ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html ↗