Linux Kernel Handshake Lock Management Vulnerability in BH Context

A deadlock vulnerability has been identified in the Linux kernel's handling of NVMe over Fabrics TCP connections. The issue arises in the net/handshake subsystem, where the TLS handshake cancellation function can be called from a bottom-half (BH) context, leading to a potential deadlock. This occurs because the cancellation function tries to acquire a lock that may already be held by a process-context thread on the same CPU, causing the lock acquisition to block indefinitely. The vulnerability affects the Linux kernel stable tree.

Impact

The vulnerability can lead to a deadlock situation, where a process-context thread is blocked indefinitely because it is waiting for a lock that is held by a softirq, creating a conflict that halts normal processing.

Reproduction

The vulnerability can be reproduced by initiating a TLS handshake over an NVMe TCP connection and then triggering a cancellation of the handshake while a process-context thread on the same CPU holds the lock. This can be done by manipulating the handshake request flow to create a race condition between the cancellation and completion of the handshake process.

Remediation

The vulnerability has been addressed by modifying the lock acquisition method to use spin_lock_bh, ensuring that the lock is not taken with softirqs enabled. Users should upgrade to the latest version of the Linux kernel where this fix has been applied.