{"id":"DEBIAN-CVE-2021-47041","details":"In the Linux kernel, the following vulnerability has been resolved:  nvmet-tcp: fix incorrect locking in state_change sk callback  We are not changing anything in the TCP connection state so we should not take a write_lock but rather a read lock.  This caused a deadlock when running nvmet-tcp and nvme-tcp on the same system, where state_change callbacks on the host and on the controller side have causal relationship and made lockdep report on this with blktests:  ================================ WARNING: inconsistent lock state 5.12.0-rc3 #1 Tainted: G          I -------------------------------- inconsistent {IN-SOFTIRQ-W} -\u003e {SOFTIRQ-ON-R} usage. nvme/1324 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff888363151000 (clock-AF_INET){++-?}-{2:2}, at: nvme_tcp_state_change+0x21/0x150 [nvme_tcp] {IN-SOFTIRQ-W} state was registered at:   __lock_acquire+0x79b/0x18d0   lock_acquire+0x1ca/0x480   _raw_write_lock_bh+0x39/0x80   nvmet_tcp_state_change+0x21/0x170 [nvmet_tcp]   tcp_fin+0x2a8/0x780   tcp_data_queue+0xf94/0x1f20   tcp_rcv_established+0x6ba/0x1f00   tcp_v4_do_rcv+0x502/0x760   tcp_v4_rcv+0x257e/0x3430   ip_protocol_deliver_rcu+0x69/0x6a0   ip_local_deliver_finish+0x1e2/0x2f0   ip_local_deliver+0x1a2/0x420   ip_rcv+0x4fb/0x6b0   __netif_receive_skb_one_core+0x162/0x1b0   process_backlog+0x1ff/0x770   __napi_poll.constprop.0+0xa9/0x5c0   net_rx_action+0x7b3/0xb30   __do_softirq+0x1f0/0x940   do_softirq+0xa1/0xd0   __local_bh_enable_ip+0xd8/0x100   ip_finish_output2+0x6b7/0x18a0   __ip_queue_xmit+0x706/0x1aa0   __tcp_transmit_skb+0x2068/0x2e20   tcp_write_xmit+0xc9e/0x2bb0   __tcp_push_pending_frames+0x92/0x310   inet_shutdown+0x158/0x300   __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp]   nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp]   nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp]   nvme_do_delete_ctrl+0x100/0x10c [nvme_core]   nvme_sysfs_delete.cold+0x8/0xd [nvme_core]   kernfs_fop_write_iter+0x2c7/0x460   new_sync_write+0x36c/0x610   vfs_write+0x5c0/0x870   ksys_write+0xf9/0x1d0   do_syscall_64+0x33/0x40   entry_SYSCALL_64_after_hwframe+0x44/0xae irq event stamp: 10687 hardirqs last  enabled at (10687): [\u003cffffffff9ec376bd\u003e] _raw_spin_unlock_irqrestore+0x2d/0x40 hardirqs last disabled at (10686): [\u003cffffffff9ec374d8\u003e] _raw_spin_lock_irqsave+0x68/0x90 softirqs last  enabled at (10684): [\u003cffffffff9f000608\u003e] __do_softirq+0x608/0x940 softirqs last disabled at (10649): [\u003cffffffff9cdedd31\u003e] do_softirq+0xa1/0xd0  other info that might help us debug this:  Possible unsafe locking scenario:         CPU0        ----   lock(clock-AF_INET);   \u003cInterrupt\u003e     lock(clock-AF_INET);   *** DEADLOCK ***  5 locks held by nvme/1324:  #0: ffff8884a01fe470 (sb_writers#4){.+.+}-{0:0}, at: ksys_write+0xf9/0x1d0  #1: ffff8886e435c090 (&of-\u003emutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x216/0x460  #2: ffff888104d90c38 (kn-\u003eactive#255){++++}-{0:0}, at: kernfs_remove_self+0x22d/0x330  #3: ffff8884634538d0 (&queue-\u003equeue_lock){+.+.}-{3:3}, at: nvme_tcp_stop_queue+0x52/0xb0 [nvme_tcp]  #4: ffff888363150d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_shutdown+0x59/0x300  stack backtrace: CPU: 26 PID: 1324 Comm: nvme Tainted: G          I       5.12.0-rc3 #1 Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.10.0 11/12/2020 Call Trace:  dump_stack+0x93/0xc2  mark_lock_irq.cold+0x2c/0xb3  ? verify_lock_unused+0x390/0x390  ? stack_trace_consume_entry+0x160/0x160  ? lock_downgrade+0x100/0x100  ? save_trace+0x88/0x5e0  ? _raw_spin_unlock_irqrestore+0x2d/0x40  mark_lock+0x530/0x1470  ? mark_lock_irq+0x1d10/0x1d10  ? enqueue_timer+0x660/0x660  mark_usage+0x215/0x2a0  __lock_acquire+0x79b/0x18d0  ? tcp_schedule_loss_probe.part.0+0x38c/0x520  lock_acquire+0x1ca/0x480  ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp]  ? rcu_read_unlock+0x40/0x40  ? tcp_mtu_probe+0x1ae0/0x1ae0  ? kmalloc_reserve+0xa0/0xa0  ? sysfs_file_ops+0x170/0x170  _raw_read_lock+0x3d/0xa0  ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp]  nvme_tcp_state_change+0x21/0x150 [nvme_tcp]  ? sysfs_file_ops ---truncated---","modified":"2026-09-15T09:02:35.054200985Z","published":"2024-02-28T09:15:40.037Z","upstream":["CVE-2021-47041"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2021-47041"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.38-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47041.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.38-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47041.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.38-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47041.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}