CVE-2024-49569: nvme-rdma: unquiesce admin_q before destroy it
In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma: unquiesce adminq before destroy it
Kernel will hang on destroy adminq while we create ctrl failed, such as following calltrace:
PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" #0 [ff61d23de260fb78] schedule at ffffffff8323bc15 #1 [ff61d23de260fc08] schedule at ffffffff8323c014 #2 [ff61d23de260fc28] blkmqfreezequeuewait at ffffffff82a3dba1 #3 [ff61d23de260fc78] blkfreezequeue at ffffffff82a4113a #4 [ff61d23de260fc90] blkcleanupqueue at ffffffff82a33006 #5 [ff61d23de260fcb0] nvmerdmadestroyadminqueue at ffffffffc12686ce #6 [ff61d23de260fcc8] nvmerdmasetupctrl at ffffffffc1268ced #7 [ff61d23de260fd28] nvmerdmacreatectrl at ffffffffc126919b #8 [ff61d23de260fd68] nvmfdevwrite at ffffffffc024f362 #9 [ff61d23de260fe38] vfswrite at ffffffff827d5f25 RIP: 00007fda7891d574 RSP: 00007ffe2ef06958 RFLAGS: 00000202 RAX: ffffffffffffffda RBX: 000055e8122a4d90 RCX: 00007fda7891d574 RDX: 000000000000012b RSI: 000055e8122a4d90 RDI: 0000000000000004 RBP: 00007ffe2ef079c0 R8: 000000000000012b R9: 000055e8122a4d90 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000004 R13: 000055e8122923c0 R14: 000000000000012b R15: 00007fda78a54500 ORIGRAX: 0000000000000001 CS: 0033 SS: 002b
This due to we have quiesced admiq before cancel requests, but forgot to unquiesce before destroy it, as a result we fail to drain the pending requests, and hang on blkmqfreezequeuewait() forever. Here try to reuse nvmerdmateardownadminqueue() to fix this issue and simplify the code.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.92.2-1 - Configuration
In nvme-rdma code paths where admin_q is quiesced before canceling requests, ensure admin_q is unquiesced prior to calling nvme_rdma_destroy_admin_queue(); reuse nvme_rdma_teardown_admin_queue() to unquiesce and simplify the teardown flow so pending requests drain instead of hanging in blk_mq_freeze_queue_wait() forever.
Linux kernel nvme-rdma Admin queue quiesce/unquiesce state before destroy = unquiesce admin_q before destroy it (fix hang in blk_mq_freeze_queue_wait)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49569?
CVE-2024-49569 has been classified as a high severity vulnerability.
How do I fix CVE-2024-49569?
To fix CVE-2024-49569, you should upgrade to the latest version of the Linux kernel that includes the patch.
What systems are affected by CVE-2024-49569?
CVE-2024-49569 affects the Linux kernel, specifically instances using the nvme-rdma module.
What are the potential impacts of CVE-2024-49569?
If exploited, CVE-2024-49569 can lead to system hangs during the destruction of admin queues.
Is there a workaround for CVE-2024-49569 until a patch can be applied?
Currently, there are no known workarounds for CVE-2024-49569, so upgrading is recommended.