In the Linux kernel, the following vulnerability has been resolved:

dm: remove fake timeout to avoid leak request

Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of blkmqcompleterequest"), drivers are responsible for calling blkshouldfaketimeout() at appropriate code paths and opportunities.

However, the dm driver does not implement its own timeout handler and relies on the timeout handling of its slave devices.

If an io-timeout-fail error is injected to a dm device, the request will be leaked and never completed, causing tasks to hang indefinitely.

Reproduce: 1. prepare dm which has iscsi slave device 2. inject io-timeout-fail to dm echo 1 >/sys/class/block/dm-0/io-timeout-fail echo 100 >/sys/kernel/debug/failiotimeout/probability echo 10 >/sys/kernel/debug/failiotimeout/times 3. read/write dm 4. iscsiadm -m node -u

Result: hang task like below [ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds. [ 862.244133] Tainted: G E 6.19.0-rc1+ #51 [ 862.244337] "echo 0 > /proc/sys/kernel/hungtasktimeoutsecs" disables this message. [ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 taskflags:0x4288060 flags:0x00080000 [ 862.245024] Workqueue: iscsictrl3:1 iscsiunbindsession [scsitransportiscsi] [ 862.245264] Call Trace: [ 862.245587] <TASK> [ 862.245814] schedule+0x810/0x15c0 [ 862.246557] schedule+0x69/0x180 [ 862.246760] blkmqfreezequeuewait+0xde/0x120 [ 862.247688] elevatorchange+0x16d/0x460 [ 862.247893] elevatorsetnone+0x87/0xf0 [ 862.248798] blkunregisterqueue+0x12e/0x2a0 [ 862.248995] delgendisk+0x231/0x7e0 [ 862.250143] delgendisk+0x12f/0x1d0 [ 862.250339] sdremove+0x85/0x130 [sdmod] [ 862.250650] devicereleasedriverinternal+0x36d/0x530 [ 862.250849] busremovedevice+0x1dd/0x3f0 [ 862.251042] devicedel+0x38a/0x930 [ 862.252095] scsiremovedevice+0x293/0x360 [ 862.252291] scsiremovetarget+0x486/0x760 [ 862.252654] iscsiunbindsession+0x18a/0x3e0 [scsitransportiscsi] [ 862.252886] processonework+0x633/0xe50 [ 862.253101] workerthread+0x6df/0xf10 [ 862.253647] kthread+0x36d/0x720 [ 862.254533] retfromfork+0x2a6/0x470 [ 862.255852] retfromforkasm+0x1a/0x30 [ 862.256037] </TASK>

Remove the blkshouldfaketimeout() check from dm, as dm has no native timeout handling and should not attempt to fake timeouts.