In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-apple: Destroy the admin queue on removal<\/p>\n
The admin queue is allocated with blk_mq_alloc_queue() but never
\ndestroyed. nvme_free_ctrl() only drops the last reference and
\nblk_mq_exit_queue() and blk_sync_queue() never run: the hctx is never
\nmoved to q->unused_hctx_list and the timeout timer and work stay armed on
\na queue that is about to be freed which will eventually oops inside
\nblk_mq_timeout_work().<\/p>\n
This can only be triggered when the controller fails to come up and is
\nthen immediately torn down again which is why no one ever ran into this
\nbefore.<\/p>\n
Let’s just copy what the pcie driver does: unquiesce and destroy the admin
\nqueue before nvme_uninit_ctrl().<\/p>\n
With this the following WARN followed by a panic no longer happens:<\/p>\n
WARNING: block\/blk-mq.c:4390 at blk_mq_release+0x194\/0x238, CPU#4: kworker\/u34:4\/119
\n CPU: 4 UID: 0 PID: 119 Comm: kworker\/u34:4 Not tainted 7.2.0-rc1-dirty #248 PREEMPT
\n Hardware name: Apple Mac mini (M1, 2020) (DT)
\n Workqueue: nvme-wq apple_nvme_remove_dead_ctrl_work
\n pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=–)
\n pc : blk_mq_release+0x194\/0x238
\n lr : blk_mq_release+0x58\/0x238
\n sp : ffffc000833a3b50
\n x29: ffffc000833a3b50 x28: ffff80001d0450f8 x27: ffff800020c95200
\n x26: 0000000000000088 x25: 0000000000000000 x24: ffff800020f36805
\n x23: 0000000000000000 x22: ffffc00081a86878 x21: ffff800020be9c60
\n x20: 0000000000000000 x19: ffff800022501698 x18: 000000000000000a
\n x17: 7365757165722066 x16: 666f7265776f7020 x15: 0000000000000000
\n x14: 0000000000000028 x13: 0000000000004def x12: 0000000000000003
\n x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc000805b4fc8
\n x8 : ffffc00081915820 x7 : ffffc00081c4f3c8 x6 : 0000000000000001
\n x5 : 0000000000000004 x4 : ffff800022498d80 x3 : ffffc000833a3b14
\n x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff800022501698
\n Call trace:
\n blk_mq_release+0x194\/0x238 (P)
\n blk_put_queue+0x8c\/0xf0
\n nvme_free_ctrl+0x4c\/0x260
\n device_release+0x44\/0x128
\n kobject_put+0xa0\/0x120
\n put_device+0x1c\/0x40
\n nvme_uninit_ctrl+0x48\/0x60
\n apple_nvme_remove+0x54\/0xb0
\n platform_remove+0x28\/0x40
\n device_remove+0x54\/0x98
\n device_release_driver_internal+
\n device_release_driver+0x20\/0x38
\n apple_nvme_remove_dead_ctrl_wor
\n process_one_work+0x1f4\/0x770
\n worker_thread+0x1b8\/0x360
\n kthread+0x140\/0x160
\n ret_from_fork+0x10\/0x20
\n irq event stamp: 448
\n hardirqs last enabled at (447):in_unlock_irqrestore+0x74\/0x80
\n hardirqs last disabled at (448): [] el1_brk64+0x20\/0x60
\n softirqs last enabled at (0): [ess+0xb28\/0x2698
\n softirqs last disabled at (0): [] 0x0
\n —[ end trace 0000000000000000
\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
\n Mem abort info:
\n ESR = 0x0000000096000005
\n EC = 0x25: DABT (current EL),
\n SET = 0, FnV = 0
\n EA = 0, S1PTW = 0
\n FSC = 0x05: level 1 translation fault
\n Data abort info:
\n ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
\n CM = 0, WnR = 0, TnD = 0, TagA
\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
\n [0000000000000000] user address
\n Internal error: Oops: 0000000096000005 [#1] SMP
\n CPU: 7 UID: 0 PID: 54 Comm: kwor 7.2.0-rc1-dirty #248PREEMPT
\n Tainted: [W]=WARN
\n Hardware name: Apple Mac mini (M1, 2020) (DT)
\n Workqueue: kblockd blk_mq_timeou
\n pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=–)
\n pc : percpu_ref_tryget_many.cons
\n lr : percpu_ref_tryget_many.constprop.0+0xc0\/0x168
\n sp : ffffc000829cbce0
\n x29: ffffc000829cbce0 x28: ffff800020be9f48 x27: ffff800013e503c0
\n x26: 0000000000000108 x25: 000009c05
\n x23: 0000000000000000 x22: ffffc000819f5000 x21: ffff800020be9f48
\n x20: ffff8001deda4808 x19: ffff8000a
\n x17: 00000000580e1fac x16: ffffc00082bbbb7c x15: 0000000000000000
\n x14: 0000000000000028 x13: 000000001
\n x11: 0000000000000000 x10: 0000000000000000 x9 : ffffc000829cbc20
\n x8 :
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-apple: Destroy the admin queue on removal<\/p>\n
The admin queue is allocated with blk_mq_alloc_queue() but never
\ndestroyed. nvme_fr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25638","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25638","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25638"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25638"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25638"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}