CVE-2024-55642
Vulnerability from cvelistv5
Published
2025-01-11 12:29
Modified
2025-01-20 06:22
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: block: Prevent potential deadlocks in zone write plug error recovery Zone write plugging for handling writes to zones of a zoned block device always execute a zone report whenever a write BIO to a zone fails. The intent of this is to ensure that the tracking of a zone write pointer is always correct to ensure that the alignment to a zone write pointer of write BIOs can be checked on submission and that we can always correctly emulate zone append operations using regular write BIOs. However, this error recovery scheme introduces a potential deadlock if a device queue freeze is initiated while BIOs are still plugged in a zone write plug and one of these write operation fails. In such case, the disk zone write plug error recovery work is scheduled and executes a report zone. This in turn can result in a request allocation in the underlying driver to issue the report zones command to the device. But with the device queue freeze already started, this allocation will block, preventing the report zone execution and the continuation of the processing of the plugged BIOs. As plugged BIOs hold a queue usage reference, the queue freeze itself will never complete, resulting in a deadlock. Avoid this problem by completely removing from the zone write plugging code the use of report zones operations after a failed write operation, instead relying on the device user to either execute a report zones, reset the zone, finish the zone, or give up writing to the device (which is a fairly common pattern for file systems which degrade to read-only after write failures). This is not an unreasonnable requirement as all well-behaved applications, FSes and device mapper already use report zones to recover from write errors whenever possible by comparing the current position of a zone write pointer with what their assumption about the position is. The changes to remove the automatic error recovery are as follows: - Completely remove the error recovery work and its associated resources (zone write plug list head, disk error list, and disk zone_wplugs_work work struct). This also removes the functions disk_zone_wplug_set_error() and disk_zone_wplug_clear_error(). - Change the BLK_ZONE_WPLUG_ERROR zone write plug flag into BLK_ZONE_WPLUG_NEED_WP_UPDATE. This new flag is set for a zone write plug whenever a write opration targetting the zone of the zone write plug fails. This flag indicates that the zone write pointer offset is not reliable and that it must be updated when the next report zone, reset zone, finish zone or disk revalidation is executed. - Modify blk_zone_write_plug_bio_endio() to set the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag for the target zone of a failed write BIO. - Modify the function disk_zone_wplug_set_wp_offset() to clear this new flag, thus implementing recovery of a correct write pointer offset with the reset (all) zone and finish zone operations. - Modify blkdev_report_zones() to always use the disk_report_zones_cb() callback so that disk_zone_wplug_sync_wp_offset() can be called for any zone marked with the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag. This implements recovery of a correct write pointer offset for zone write plugs marked with BLK_ZONE_WPLUG_NEED_WP_UPDATE and within the range of the report zones operation executed by the user. - Modify blk_revalidate_seq_zone() to call disk_zone_wplug_sync_wp_offset() for all sequential write required zones when a zoned block device is revalidated, thus always resolving any inconsistency between the write pointer offset of zone write plugs and the actual write pointer position of sequential zones.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7fa80134cf266325fa61139320091001c9b3c477Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fe0418eb9bd69a19a948b297c8de815e05f3cde1Patch
Impacted products
Vendor Product Version
Linux Linux Version: dd291d77cc90eb6a86e9860ba8e6e38eebd57d12
Version: dd291d77cc90eb6a86e9860ba8e6e38eebd57d12
 Create a notification for this product.
   Linux Linux Version: 6.10
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "block/blk-zoned.c",
                  "include/linux/blkdev.h",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "7fa80134cf266325fa61139320091001c9b3c477",
                     status: "affected",
                     version: "dd291d77cc90eb6a86e9860ba8e6e38eebd57d12",
                     versionType: "git",
                  },
                  {
                     lessThan: "fe0418eb9bd69a19a948b297c8de815e05f3cde1",
                     status: "affected",
                     version: "dd291d77cc90eb6a86e9860ba8e6e38eebd57d12",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "block/blk-zoned.c",
                  "include/linux/blkdev.h",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "6.10",
                  },
                  {
                     lessThan: "6.10",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.12.*",
                     status: "unaffected",
                     version: "6.12.6",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.13",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: Prevent potential deadlocks in zone write plug error recovery\n\nZone write plugging for handling writes to zones of a zoned block\ndevice always execute a zone report whenever a write BIO to a zone\nfails. The intent of this is to ensure that the tracking of a zone write\npointer is always correct to ensure that the alignment to a zone write\npointer of write BIOs can be checked on submission and that we can\nalways correctly emulate zone append operations using regular write\nBIOs.\n\nHowever, this error recovery scheme introduces a potential deadlock if a\ndevice queue freeze is initiated while BIOs are still plugged in a zone\nwrite plug and one of these write operation fails. In such case, the\ndisk zone write plug error recovery work is scheduled and executes a\nreport zone. This in turn can result in a request allocation in the\nunderlying driver to issue the report zones command to the device. But\nwith the device queue freeze already started, this allocation will\nblock, preventing the report zone execution and the continuation of the\nprocessing of the plugged BIOs. As plugged BIOs hold a queue usage\nreference, the queue freeze itself will never complete, resulting in a\ndeadlock.\n\nAvoid this problem by completely removing from the zone write plugging\ncode the use of report zones operations after a failed write operation,\ninstead relying on the device user to either execute a report zones,\nreset the zone, finish the zone, or give up writing to the device (which\nis a fairly common pattern for file systems which degrade to read-only\nafter write failures). This is not an unreasonnable requirement as all\nwell-behaved applications, FSes and device mapper already use report\nzones to recover from write errors whenever possible by comparing the\ncurrent position of a zone write pointer with what their assumption\nabout the position is.\n\nThe changes to remove the automatic error recovery are as follows:\n - Completely remove the error recovery work and its associated\n   resources (zone write plug list head, disk error list, and disk\n   zone_wplugs_work work struct). This also removes the functions\n   disk_zone_wplug_set_error() and disk_zone_wplug_clear_error().\n\n - Change the BLK_ZONE_WPLUG_ERROR zone write plug flag into\n   BLK_ZONE_WPLUG_NEED_WP_UPDATE. This new flag is set for a zone write\n   plug whenever a write opration targetting the zone of the zone write\n   plug fails. This flag indicates that the zone write pointer offset is\n   not reliable and that it must be updated when the next report zone,\n   reset zone, finish zone or disk revalidation is executed.\n\n - Modify blk_zone_write_plug_bio_endio() to set the\n   BLK_ZONE_WPLUG_NEED_WP_UPDATE flag for the target zone of a failed\n   write BIO.\n\n - Modify the function disk_zone_wplug_set_wp_offset() to clear this\n   new flag, thus implementing recovery of a correct write pointer\n   offset with the reset (all) zone and finish zone operations.\n\n - Modify blkdev_report_zones() to always use the disk_report_zones_cb()\n   callback so that disk_zone_wplug_sync_wp_offset() can be called for\n   any zone marked with the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag.\n   This implements recovery of a correct write pointer offset for zone\n   write plugs marked with BLK_ZONE_WPLUG_NEED_WP_UPDATE and within\n   the range of the report zones operation executed by the user.\n\n - Modify blk_revalidate_seq_zone() to call\n   disk_zone_wplug_sync_wp_offset() for all sequential write required\n   zones when a zoned block device is revalidated, thus always resolving\n   any inconsistency between the write pointer offset of zone write\n   plugs and the actual write pointer position of sequential zones.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-01-20T06:22:14.759Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/7fa80134cf266325fa61139320091001c9b3c477",
            },
            {
               url: "https://git.kernel.org/stable/c/fe0418eb9bd69a19a948b297c8de815e05f3cde1",
            },
         ],
         title: "block: Prevent potential deadlocks in zone write plug error recovery",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-55642",
      datePublished: "2025-01-11T12:29:56.848Z",
      dateReserved: "2025-01-09T09:49:29.657Z",
      dateUpdated: "2025-01-20T06:22:14.759Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-55642\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T13:15:27.990\",\"lastModified\":\"2025-01-16T15:18:22.557\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock: Prevent potential deadlocks in zone write plug error recovery\\n\\nZone write plugging for handling writes to zones of a zoned block\\ndevice always execute a zone report whenever a write BIO to a zone\\nfails. The intent of this is to ensure that the tracking of a zone write\\npointer is always correct to ensure that the alignment to a zone write\\npointer of write BIOs can be checked on submission and that we can\\nalways correctly emulate zone append operations using regular write\\nBIOs.\\n\\nHowever, this error recovery scheme introduces a potential deadlock if a\\ndevice queue freeze is initiated while BIOs are still plugged in a zone\\nwrite plug and one of these write operation fails. In such case, the\\ndisk zone write plug error recovery work is scheduled and executes a\\nreport zone. This in turn can result in a request allocation in the\\nunderlying driver to issue the report zones command to the device. But\\nwith the device queue freeze already started, this allocation will\\nblock, preventing the report zone execution and the continuation of the\\nprocessing of the plugged BIOs. As plugged BIOs hold a queue usage\\nreference, the queue freeze itself will never complete, resulting in a\\ndeadlock.\\n\\nAvoid this problem by completely removing from the zone write plugging\\ncode the use of report zones operations after a failed write operation,\\ninstead relying on the device user to either execute a report zones,\\nreset the zone, finish the zone, or give up writing to the device (which\\nis a fairly common pattern for file systems which degrade to read-only\\nafter write failures). This is not an unreasonnable requirement as all\\nwell-behaved applications, FSes and device mapper already use report\\nzones to recover from write errors whenever possible by comparing the\\ncurrent position of a zone write pointer with what their assumption\\nabout the position is.\\n\\nThe changes to remove the automatic error recovery are as follows:\\n - Completely remove the error recovery work and its associated\\n   resources (zone write plug list head, disk error list, and disk\\n   zone_wplugs_work work struct). This also removes the functions\\n   disk_zone_wplug_set_error() and disk_zone_wplug_clear_error().\\n\\n - Change the BLK_ZONE_WPLUG_ERROR zone write plug flag into\\n   BLK_ZONE_WPLUG_NEED_WP_UPDATE. This new flag is set for a zone write\\n   plug whenever a write opration targetting the zone of the zone write\\n   plug fails. This flag indicates that the zone write pointer offset is\\n   not reliable and that it must be updated when the next report zone,\\n   reset zone, finish zone or disk revalidation is executed.\\n\\n - Modify blk_zone_write_plug_bio_endio() to set the\\n   BLK_ZONE_WPLUG_NEED_WP_UPDATE flag for the target zone of a failed\\n   write BIO.\\n\\n - Modify the function disk_zone_wplug_set_wp_offset() to clear this\\n   new flag, thus implementing recovery of a correct write pointer\\n   offset with the reset (all) zone and finish zone operations.\\n\\n - Modify blkdev_report_zones() to always use the disk_report_zones_cb()\\n   callback so that disk_zone_wplug_sync_wp_offset() can be called for\\n   any zone marked with the BLK_ZONE_WPLUG_NEED_WP_UPDATE flag.\\n   This implements recovery of a correct write pointer offset for zone\\n   write plugs marked with BLK_ZONE_WPLUG_NEED_WP_UPDATE and within\\n   the range of the report zones operation executed by the user.\\n\\n - Modify blk_revalidate_seq_zone() to call\\n   disk_zone_wplug_sync_wp_offset() for all sequential write required\\n   zones when a zoned block device is revalidated, thus always resolving\\n   any inconsistency between the write pointer offset of zone write\\n   plugs and the actual write pointer position of sequential zones.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: block: Prevenir posibles bloqueos en la recuperación de errores de conexión de escritura de zona La conexión de escritura de zona para gestionar escrituras en zonas de un dispositivo de bloque zonificado siempre ejecuta un informe de zona siempre que falla una BIO de escritura en una zona. La intención de esto es garantizar que el seguimiento de un puntero de escritura de zona siempre sea correcto para garantizar que la alineación con un puntero de escritura de zona de las BIO de escritura se pueda comprobar en el envío y que siempre podamos emular correctamente las operaciones de anexión de zona utilizando BIO de escritura normales. Sin embargo, este esquema de recuperación de errores introduce un posible bloqueo si se inicia un congelamiento de la cola del dispositivo mientras las BIO todavía están conectadas a una conexión de escritura de zona y una de estas operaciones de escritura falla. En tal caso, el trabajo de recuperación de errores de conexión de escritura de zona de disco se programa y ejecuta una zona de informe. Esto, a su vez, puede dar como resultado una asignación de solicitud en el controlador subyacente para emitir el comando de zonas de informe al dispositivo. Pero con la congelación de la cola del dispositivo ya iniciada, esta asignación se bloqueará, lo que evitará la ejecución de la zona de informe y la continuación del procesamiento de las BIO conectadas. Como los BIO conectados contienen una referencia de uso de cola, la congelación de la cola en sí nunca se completará, lo que dará como resultado un bloqueo. Evite este problema eliminando por completo del código de conexión de escritura de zona el uso de operaciones de zonas de informe después de una operación de escritura fallida, y en su lugar, confíe en el usuario del dispositivo para ejecutar zonas de informe, restablecer la zona, finalizar la zona o dejar de escribir en el dispositivo (que es un patrón bastante común para los sistemas de archivos que se degradan a solo lectura después de fallas de escritura). Este no es un requisito irrazonable ya que todas las aplicaciones, los FS y el mapeador de dispositivos que se comportan bien ya usan zonas de informe para recuperarse de errores de escritura siempre que sea posible al comparar la posición actual de un puntero de escritura de zona con lo que suponen sobre la posición. Los cambios para eliminar la recuperación automática de errores son los siguientes: - Eliminar por completo el trabajo de recuperación de errores y sus recursos asociados (cabeza de lista de conexión de escritura de zona, lista de errores de disco y estructura de trabajo zone_wplugs_work de disco). Esto también elimina las funciones disk_zone_wplug_set_error() y disk_zone_wplug_clear_error(). - Cambie el indicador de complemento de escritura de zona BLK_ZONE_WPLUG_ERROR a BLK_ZONE_WPLUG_NEED_WP_UPDATE. Este nuevo indicador se establece para un complemento de escritura de zona siempre que falla una operación de escritura dirigida a la zona del complemento de escritura de zona. Este indicador indica que el desplazamiento del puntero de escritura de zona no es confiable y que debe actualizarse cuando se ejecuta la siguiente zona de informe, zona de reinicio, zona de finalización o revalidación de disco. - Modifique blk_zone_write_plug_bio_endio() para establecer el indicador BLK_ZONE_WPLUG_NEED_WP_UPDATE para la zona de destino de un BIO de escritura fallida. - Modifique la función disk_zone_wplug_set_wp_offset() para borrar este nuevo indicador, implementando así la recuperación de un desplazamiento correcto del puntero de escritura con las operaciones de zona de reinicio (todas) y zona de finalización. - Modificar blkdev_report_zones() para que siempre use la devolución de llamada disk_report_zones_cb() de modo que se pueda llamar a disk_zone_wplug_sync_wp_offset() para cualquier zona marcada con el indicador BLK_ZONE_WPLUG_NEED_WP_UPDATE. ---- truncada ----\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.10\",\"versionEndExcluding\":\"6.12.6\",\"matchCriteriaId\":\"EFB33A9C-69D1-4691-B0BD-2D5C9590E239\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7fa80134cf266325fa61139320091001c9b3c477\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe0418eb9bd69a19a948b297c8de815e05f3cde1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.