Executive Summary

This vulnerability exists in the Linux kernel's ublk subsystem. When a ublk server starts recovering devices but crashes before issuing fetch commands for all IO operations, some fetch commands that were successfully issued may never be properly canceled. This happens because the per-IO canceled flag remains set even after the fetch for that IO has been submitted. The flags for all IOs in a queue are only reset together once all IOs have been fetched. If only a subset of IOs are fetched before the server dies, those IOs will never be successfully canceled, preventing the cancellation function from completing properly.

The fix involves resetting the per-IO canceled flags immediately when each IO is fetched, rather than waiting for all IOs in the queue to be fetched, which may never happen if the server crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to IO commands remaining outstanding and not being properly canceled if the ublk server crashes during device recovery. This could cause resource leaks or inconsistent IO states, potentially impacting system stability or performance related to block device operations.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by a fix in the Linux kernel that resets the per-IO cancel flags immediately when each IO is fetched, instead of waiting for all IOs for the queue. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0