{ "cveId": "CVE-2021-47041", "url": "https://patchblox.com/security/cve/CVE-2021-47041", "summary": "CVE-2021-47041 is fixed in linux on 1 platform, first by DEBIAN-CVE-2021-47041, released February 28, 2024. It is not reported as exploited. Patch Radar priority: Routine.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix incorrect locking in state_change...", "description": "In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix incorrect locking in state_change sk callback We are not changing anything in the TCP connection state so we should not take a write_lock but rather a read lock. This caused a deadlock when running nvmet-tcp and nvme-tcp on the same system, where state_change callbacks on the host and on the controller side have causal relationship and made lockdep report on this with blktests: ================================ WARNING: inconsistent lock state 5.12.0-rc3 #1 Tainted: G I -------------------------------- inconsistent {IN-SOFTIRQ-W} -\u003E {SOFTIRQ-ON-R} usage. nvme/1324 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff888363151000 (clock-AF_INET){\u002B\u002B-?}-{2:2}, at: nvme_tcp_state_change\u002B0x21/0x150 [nvme_tcp] {IN-SOFTIRQ-W} state was registered at: __lock_acquire\u002B0x79b/0x18d0 lock_acquire\u002B0x1ca/0x480 _raw_write_lock_bh\u002B0x39/0x80 nvmet_tcp_state_change\u002B0x21/0x170 [nvmet_tcp] tcp_fin\u002B0x2a8/0x780 tcp_data_queue\u002B0xf94/0x1f20 tcp_rcv_established\u002B0x6ba/0x1f00 tcp_v4_do_rcv\u002B0x502/0x760 tcp_v4_rcv\u002B0x257e/0x3430 ip_protocol_deliver_rcu\u002B0x69/0x6a0 ip_local_deliver_finish\u002B0x1e2/0x2f0 ip_local_deliver\u002B0x1a2/0x420 ip_rcv\u002B0x4fb/0x6b0 __netif_receive_skb_one_core\u002B0x162/0x1b0 process_backlog\u002B0x1ff/0x770 __napi_poll.constprop.0\u002B0xa9/0x5c0 net_rx_action\u002B0x7b3/0xb30 __do_softirq\u002B0x1f0/0x940 do_softirq\u002B0xa1/0xd0 __local_bh_enable_ip\u002B0xd8/0x100 ip_finish_output2\u002B0x6b7/0x18a0 __ip_queue_xmit\u002B0x706/0x1aa0 __tcp_transmit_skb\u002B0x2068/0x2e20 tcp_write_xmit\u002B0xc9e/0x2bb0 __tcp_push_pending_frames\u002B0x92/0x310 inet_shutdown\u002B0x158/0x300 __nvme_tcp_stop_queue\u002B0x36/0x270 [nvme_tcp] nvme_tcp_stop_queue\u002B0x87/0xb0 [nvme_tcp] nvme_tcp_teardown_admin_queue\u002B0x69/0xe0 [nvme_tcp] nvme_do_delete_ctrl\u002B0x100/0x10c [nvme_core] nvme_sysfs_delete.cold\u002B0x8/0xd [nvme_core] kernfs_fop_write_iter\u002B0x2c7/0x460 new_sync_write\u002B0x36c/0x610 vfs_write\u002B0x5c0/0x870 ksys_write\u002B0xf9/0x1d0 do_syscall_64\u002B0x33/0x40 entry_SYSCALL_64_after_hwframe\u002B0x44/0xae irq event stamp: 10687 hardirqs last enabled at (10687): [\u003Cffffffff9ec376bd\u003E] _raw_spin_unlock_irqrestore\u002B0x2d/0x40 hardirqs last disabled at (10686): [\u003Cffffffff9ec374d8\u003E] _raw_spin_lock_irqsave\u002B0x68/0x90 softirqs last enabled at (10684): [\u003Cffffffff9f000608\u003E] __do_softirq\u002B0x608/0x940 softirqs last disabled at (10649): [\u003Cffffffff9cdedd31\u003E] do_softirq\u002B0xa1/0xd0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(clock-AF_INET); \u003CInterrupt\u003E lock(clock-AF_INET); *** DEADLOCK *** 5 locks held by nvme/1324: #0: ffff8884a01fe470 (sb_writers#4){.\u002B.\u002B}-{0:0}, at: ksys_write\u002B0xf9/0x1d0 #1: ffff8886e435c090 (\u0026of-\u003Emutex){\u002B.\u002B.}-{3:3}, at: kernfs_fop_write_iter\u002B0x216/0x460 #2: ffff888104d90c38 (kn-\u003Eactive#255){\u002B\u002B\u002B\u002B}-{0:0}, at: kernfs_remove_self\u002B0x22d/0x330 #3: ffff8884634538d0 (\u0026queue-\u003Equeue_lock){\u002B.\u002B.}-{3:3}, at: nvme_tcp_stop_queue\u002B0x52/0xb0 [nvme_tcp] #4: ffff888363150d30 (sk_lock-AF_INET){\u002B.\u002B.}-{0:0}, at: inet_shutdown\u002B0x59/0x300 stack backtrace: CPU: 26 PID: 1324 Comm: nvme Tainted: G I 5.12.0-rc3 #1 Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.10.0 11/12/2020 Call Trace: dump_stack\u002B0x93/0xc2 mark_lock_irq.cold\u002B0x2c/0xb3 ? verify_lock_unused\u002B0x390/0x390 ? stack_trace_consume_entry\u002B0x160/0x160 ? lock_downgrade\u002B0x100/0x100 ? save_trace\u002B0x88/0x5e0 ? _raw_spin_unlock_irqrestore\u002B0x2d/0x40 mark_lock\u002B0x530/0x1470 ? mark_lock_irq\u002B0x1d10/0x1d10 ? enqueue_timer\u002B0x660/0x660 mark_usage\u002B0x215/0x2a0 __lock_acquire\u002B0x79b/0x18d0 ? tcp_schedule_loss_probe.part.0\u002B0x38c/0x520 lock_acquire\u002B0x1ca/0x480 ? nvme_tcp_state_change\u002B0x21/0x150 [nvme_tcp] ? rcu_read_unlock\u002B0x40/0x40 ? tcp_mtu_probe\u002B0x1ae0/0x1ae0 ? kmalloc_reserve\u002B0xa0/0xa0 ? sysfs_file_ops\u002B0x170/0x170 _raw_read_lock\u002B0x3d/0xa0 ? nvme_tcp_state_change\u002B0x21/0x150 [nvme_tcp] nvme_tcp_state_change\u002B0x21/0x150 [nvme_tcp] ? sysfs_file_ops ---truncated---", "published": "2024-02-28T09:15:40Z", "severity": "medium", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.00494, "epssPercentile": 0.42661, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "linux", "release": "Debian 12.15 (bookworm)", "fixedVersion": "5.10.38-1", "fix": "DEBIAN-CVE-2021-47041", "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47041", "released": "2024-02-28T09:15:40Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "5.10.38-1", "fix": "DEBIAN-CVE-2021-47041", "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47041", "released": "2024-02-28T09:15:40Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "5.10.38-1", "fix": "DEBIAN-CVE-2021-47041", "url": "https://patchblox.com/security/fix/linux/debian-cve-2021-47041", "released": "2024-02-28T09:15:40Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T13:06:02Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }