CVE-2021-47552

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()

For avoiding to slow down queue destroy, we don't call

blk_mq_quiesce_queue() in blk_cleanup_queue(), instead of delaying to

cancel dispatch work in blk_release_queue().

However, this way has caused kernel oops[1], reported by Changhui. The log

shows that scsi_device can be freed before running blk_release_queue(),

which is expected too since scsi_device is released after the scsi disk

is closed and the scsi_device is removed.

Fixes the issue by canceling blk-mq dispatch work in both blk_cleanup_queue()

and disk_release():

1) when disk_release() is run, the disk has been closed, and any sync

dispatch activities have been done, so canceling dispatch work is enough to

quiesce filesystem I/O dispatch activity.

2) in blk_cleanup_queue(), we only focus on passthrough request, and

passthrough request is always explicitly allocated & freed

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References