In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free<\/p>\n
nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the
\nfinal controller reference through nvmet_cq_put(). If that triggers
\nnvmet_ctrl_free(), the teardown path flushes ctrl->async_event_work on
\nthe same nvmet-wq.<\/p>\n
Call chain:<\/p>\n
nvmet_tcp_schedule_release_queue()
\n kref_put(&queue->kref, nvmet_tcp_release_queue)
\n nvmet_tcp_release_queue()
\n queue_work(nvmet_wq, &queue->release_work) nvme_cq)
\n nvmet_cq_destroy()
\n nvmet_ctrl_put(cq->ctrl)
\n nvmet_ctrl_free()
\n flush_work(&ctrl->async_event_work) async_event_work);<\/p>\n
This trips lockdep with a possible recursive locking warning.<\/p>\n
[ 5223.015876] run blktests nvme\/003 at 2026-04-07 20:53:55
\n[ 5223.061801] loop0: detected capacity change from 0 to 2097152
\n[ 5223.072206] nvmet: adding nsid 1 to subsystem blktests-subsystem-1
\n[ 5223.088368] nvmet_tcp: enabling port 0 (127.0.0.1:4420)
\n[ 5223.126086] nvmet: Created discovery controller 1 for subsystem nqn.2014-08.org.nvmexpress.discovery for NQN nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349.
\n[ 5223.128453] nvme nvme1: new ctrl: NQN “nqn.2014-08.org.nvmexpress.discovery”, addr 127.0.0.1:4420, hostnqn: nqn.2014-08.org.nvmexpress:uuid:0f01fb42-9f7f-4856-b0b3-51e60b8de349
\n[ 5233.199447] nvme nvme1: Removing ctrl: NQN “nqn.2014-08.org.nvmexpress.discovery”<\/p>\n
[ 5233.227718] ============================================
\n[ 5233.231283] WARNING: possible recursive locking detected
\n[ 5233.234696] 7.0.0-rc3nvme+ #20 Tainted: G O N
\n[ 5233.238434] ——————————————–
\n[ 5233.241852] kworker\/u192:6\/2413 is trying to acquire lock:
\n[ 5233.245429] ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: touch_wq_lockdep_map+0x26\/0x90
\n[ 5233.251438]
\n but task is already holding lock:
\n[ 5233.255254] ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x5cc\/0x6e0
\n[ 5233.261125]
\n other info that might help us debug this:
\n[ 5233.265333] Possible unsafe locking scenario:<\/p>\n
[ 5233.269217] CPU0
\n[ 5233.270795] —-
\n[ 5233.272436] lock((wq_completion)nvmet-wq);
\n[ 5233.275241] lock((wq_completion)nvmet-wq);
\n[ 5233.278020]
\n *** DEADLOCK ***<\/p>\n
[ 5233.281793] May be due to missing lock nesting notation<\/p>\n
[ 5233.286195] 3 locks held by kworker\/u192:6\/2413:
\n[ 5233.289192] #0: ffff888111632548 ((wq_completion)nvmet-wq){+.+.}-{0:0}, at: process_one_work+0x5cc\/0x6e0
\n[ 5233.294569] #1: ffffc9000e2a7e40 ((work_completion)(&queue->release_work)){+.+.}-{0:0}, at: process_one_work+0x1c5\/0x6e0
\n[ 5233.300128] #2: ffffffff82d7dc40 (rcu_read_lock){….}-{1:3}, at: __flush_work+0x62\/0x530
\n[ 5233.304290]
\n stack backtrace:
\n[ 5233.306520] CPU: 4 UID: 0 PID: 2413 Comm: kworker\/u192:6 Tainted: G O N 7.0.0-rc3nvme+ #20 PREEMPT(full)
\n[ 5233.306524] Tainted: [O]=OOT_MODULE, [N]=TEST
\n[ 5233.306525] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04\/01\/2014
\n[ 5233.306527] Workqueue: nvmet-wq nvmet_tcp_release_queue_work [nvmet_tcp]
\n[ 5233.306532] Call Trace:
\n[ 5233.306534]
\n[ 5233.306536] dump_stack_lvl+0x73\/0xb0
\n[ 5233.306552] print_deadlock_bug+0x225\/0x2f0
\n[ 5233.306556] __lock_acquire+0x13f0\/0x2290
\n[ 5233.306563] lock_acquire+0xd0\/0x300
\n[ 5233.306565] ? touch_wq_lockdep_map+0x26\/0x90
\n[ 5233.306571] ? __flush_work+0x20b\/0x530
\n[ 5233.306573] ? touch_wq_lockdep_map+0x26\/0x90
\n[ 5233.306577] touch_wq_lockdep_map+0x3b\/0x90
\n[ 5233.306580] ? touch_wq_lockdep_map+0x26\/0x90
\n[ 52
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free<\/p>\n
nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the
\nfinal co<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15999","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15999","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15999"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15999"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15999"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}