PT-2026-64502 · Linux · Linux
CVE-2026-64281
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: wake sq waiters when the transport closes
Threads parked in svc rdma sq wait() on sc sq ticket wait or
sc send wait can hang indefinitely in TASK UNINTERRUPTIBLE state
across transport teardown, pinning svc xprt references and
blocking svc rdma free().
The close path sets XPT CLOSE before invoking xpo detach and both
wait event predicates include an XPT CLOSE term, but the
predicates are re-evaluated only on wakeup. sc sq ticket wait has
no completion-driven wake path; it is advanced solely by the
chained ticket handoff inside svc rdma sq wait() itself. Without
an explicit wake at close, parked threads never observe
XPT CLOSE, hold their svc xprt get reference forever, and
svc rdma free() blocks on xpt ref dropping to zero.
Two close entry points reach this transport. Local teardown runs
svc rdma detach() from svc handle xprt() -> svc delete xprt() ->
xpo detach() on a worker thread. A remote disconnect arrives at
svc rdma cma handler(), which calls svc xprt deferred close():
that sets XPT CLOSE and enqueues the transport but does not
access either RDMA waitqueue, so a worker already parked in
svc rdma sq wait() never re-evaluates its predicate. With every
worker parked on this transport, no thread is available to run
the local teardown either, and the wake site there is
unreachable.
Introduce svc rdma xprt deferred close(), a thin svcrdma wrapper
that calls svc xprt deferred close() and then wakes both
sc sq ticket wait and sc send wait. Convert the svcrdma producers
that called svc xprt deferred close() directly:
svc rdma cma handler(), qp event handler(),
svc rdma post send err(), svc rdma wc send(), the sendto drop
path, the rw completion error paths, and the recvfrom flush and
read-list error paths.
Wake both waitqueues from svc rdma detach() as well. The
synchronous svc xprt close() path (backchannel ENOTCONN, device
removal via svc rdma xprt done) reaches detach without flowing
through svc xprt deferred close() and therefore does not invoke
the new helper.
[ cel: add svc rdma xprt deferred close() to complete the fix ]
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux