CVE-2026-93057: scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context
TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcdtxeqtr(), ufshcdtxeqtr() and ufsqcomgetrxfom() allocate memory with GFPKERNEL. If direct reclaim is triggered, reclaim/writeback can depend on I/O to UFS device. Because the queue is quiesced, this can cause deadlock.
Use memallocnoiosave/restore() in ufshcdtxeqtr() to cover all allocations in the TX EQTR call tree, including:
- params->eqtrrecord in ufshcdtxeqtr()
- eqtrdata in ufshcdtxeqtr()
- params in ufsqcomgetrxfom()
This is preferred over tagging individual call sites with GFPNOIO, as it automatically covers any future allocations added anywhere in the call tree without requiring each caller to be aware of this constraint.
[mkp: fix label as suggested by Bart]
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update scsi/ufs core so that ufshcd_tx_eqtr() uses memalloc_noio_save/restore to prevent memory reclaim deadlock when TX EQTR runs while devfreq gear scaling has quiesced the UFS.
Linux kernel (scsi: ufs: core) Use memalloc_noio_save/restore in ufshcd_tx_eqtr() = enabled
Event History
Frequently Asked Questions
Which systems are exposed to this deadlock scenario?
Systems using the Linux kernel UFS driver are exposed when TX EQTR runs while devfreq gear scaling has quiesced the UFS tagset. The deadlock depends on memory allocation in the TX EQTR call tree triggering direct reclaim.
What is required for the deadlock to occur?
TX EQTR must allocate memory with GFP_KERNEL while the UFS queue is quiesced by devfreq gear scaling. If direct reclaim or writeback then requires I/O to the UFS device, that I/O cannot proceed because the queue is quiesced, creating a deadlock.
What does the resolved change do?
The fix wraps ufshcd_tx_eqtr() with memalloc_noio_save() and memalloc_noio_restore(), preventing allocations throughout the TX EQTR call tree from initiating I/O-dependent reclaim. This covers the identified allocations and future allocations added in that call path.