NACK/Cmnt: [SRU][N][PATCH 0/1] CVE-2025-37906

[Edoardo Canepa]

Rejected for the following reasons:

The adaptation is fine - the hunks match noble's ublk_drv.c and
dropping the unused struct ublk_io *io while keeping the
ublk_abort_requests()/schedule_work() tail is the right way to bridge
the missing ublk_start_cancel() - but f40139fde527 has a Fixes:
commit, dd24f87f65c9 ("ublk: fix dead loop when canceling io
command"), which rewrites the very line this patch adds to
"if (req && blk_mq_request_started(req) && req->tag == tag)".
Without it an ACTIVE uring_cmd with no block request of its own can be
refused cancellation forever, because ublk sets only
BLK_MQ_F_SHOULD_MERGE (ublk_drv.c:2313), so on the usual single-queue
device mq-deadline is attached and ub->tag_set.tags[q_id]->rqs[tag]
is left pointing at a recycled request that blk_mq_request_started()
still reports as started.
The result on noble is a hang instead of a crash: the command stays on
ctx->cancelable_uring_cmd, io_uring_try_cancel_uring_cmd() keeps
returning true, and the do/while in io_ring_exit_work()
(io_uring.c:3198) spins forever - a ublk server that never exits, on a
path that does not depend on the ublk_ch_release() restructuring noble
lacks.
Ubuntu already shipped the pair on hwe-6.14 (c2172b2d61cc right after
78e069078a93), so please resubmit as a 2-patch series with
dd24f87f65c9 as 2/2.

On 9/10/26 04:32, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2025-37906
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> ublk: fix race between io_uring_cmd_complete_in_task and ublk_cancel_cmd
>
> ublk_cancel_cmd() calls io_uring_cmd_done() to complete uring_cmd, but we may
> have scheduled task work via io_uring_cmd_complete_in_task() for dispatching
> request, then kernel crash can be triggered.
>
> Fix it by not trying to canceling the command if ublk block request is started.
>
> [ Fix ]
>
> noble/linux: backported from f40139fde527
>
> The fix adds a check so that a uring_cmd is not canceled once its associated
> ublk block request has been started, avoiding the race where the same command
> is completed both by the cancel path and by the task work scheduled for
> request dispatch.
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> A bad fix would affect systems that use the ublk userspace block driver
> (CONFIG_BLK_DEV_UBLK), such as hosts running userspace-defined block devices
> for storage or virtualization; a regression could show up as hangs, stuck
> I/O, or crashes during device recovery or teardown. Systems that do not load
> the ublk module and do not create ublk devices are not affected.
>
> [ Other Info ]
>
> Kybele flow-v11-25-ga27c0fa6. Reference: 1f1a5612/v1
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260915/bbde0609/attachment.sig>