Към съдържанието
Търсене

CVE-2025-68756: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock blk_mq_{add,del}_queue_tag_set() functions add and remove queues from tagset, the functions make sure that tagset and queues are marked as shared when two or more queues are attached to the same tagset. Initially a tagset starts as unshared and when the number of added queues reaches two, blk_mq_add_queue_tag_set() marks it as shared along with all the queues attached to it. When the number of attached queues drops to 1 blk_mq_del_queue_tag_set() need to mark both the tagset and the remaining queues as unshared. Both functions need to freeze current queues in tagset before setting on unsetting BLK_MQ_F_TAG_QUEUE_SHARED flag. While doing so, both functions hold set->tag_list_lock mutex, which makes sense as we do not want queues to be added or deleted in the process. This used to work fine until commit 98d81f0df70c ("nvme: use blk_mq_[un]quiesce_tagset") made the nvme driver quiesce tagset instead of quiscing individual queues. blk_mq_quiesce_tagset() does the job and quiesce the queues in set->tag_list while holding set->tag_list_lock also. This results in deadlock between two threads with these stacktraces: __schedule+0x47c/0xbb0 ? timerqueue_add+0x66/0xb0 schedule+0x1c/0xa0 schedule_preempt_disabled+0xa/0x10 __mutex_lock.constprop.0+0x271/0x600 blk_mq_quiesce_tagset+0x25/0xc0 nvme_dev_disable+0x9c/0x250 nvme_timeout+0x1fc/0x520 blk_mq_handle_expired+0x5c/0x90 bt_iter+0x7e/0x90 blk_mq_queue_tag_busy_iter+0x27e/0x550 ? __blk_mq_complete_request_remote+0x10/0x10 ? __blk_mq_complete_request_remote+0x10/0x10 ? __call_rcu_common.constprop.0+0x1c0/0x210 blk_mq_timeout_work+0x12d/0x170 process_one_work+0x12e/0x2d0 worker_thread+0x288/0x3a0 ? rescuer_thread+0x480/0x480 kthread+0xb8/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11

    Засегнати продукти

    • Linux Linux: 98d81f0df70ce6fc48517d938026e3c684b9051a преди ca8764c0ea1fb825f17f19704af55e9e02c9f768; 98d81f0df70ce6fc48517d938026e3c684b9051a преди 3baeec23a82e7ee9691f434c6ab0ab1387326108; 98d81f0df70ce6fc48517d938026e3c684b9051a преди 6e8d363786765a81e35083e0909e076796468edf; 98d81f0df70ce6fc48517d938026e3c684b9051a преди ef0cd7b694928573f6569e61c14f5f059253162e; 98d81f0df70ce6fc48517d938026e3c684b9051a преди 59e25ef2b413c72da6686d431e7759302cfccafa
    • Linux Linux: 6.2; преди 6.2; 6.6.120 до 6.6.*; 6.12.63 до 6.12.*; 6.17.13 до 6.17.*; 6.18.2 до 6.18.*; от 6.19 нататък

    История

    • 5 януари 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2025-68756: Linux | freedomonline.bg