CVE-2021-46942 in Linux
Summary
by MITRE • 02/27/2024
In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix shared sqpoll cancellation hangs
[ 736.982891] INFO: task iou-sqp-4294:4295 blocked for more than 122 seconds.
[ 736.982897] Call Trace:
[ 736.982901] schedule+0x68/0xe0
[ 736.982903] io_uring_cancel_sqpoll+0xdb/0x110
[ 736.982908] io_sqpoll_cancel_cb+0x24/0x30
[ 736.982911] io_run_task_work_head+0x28/0x50
[ 736.982913] io_sq_thread+0x4e3/0x720
We call io_uring_cancel_sqpoll() one by one for each ctx either in sq_thread() itself or via task works, and it's intended to cancel all requests of a specified context. However the function uses per-task counters to track the number of inflight requests, so it counts more requests than available via currect io_uring ctx and goes to sleep for them to appear (e.g. from IRQ), that will never happen.
Cancel a bit more than before, i.e. all ctxs that share sqpoll and continue to use shared counters. Don't forget that we should not remove ctx from the list before running that task_work sqpoll-cancel, otherwise the function wouldn't be able to find the context and will hang.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/09/2025
The vulnerability CVE-2021-46942 represents a critical race condition and deadlock scenario within the Linux kernel's io_uring subsystem, specifically affecting the shared submission queue polling (sqpoll) functionality. This issue manifests as a system hang where tasks become blocked indefinitely, with the kernel logging messages indicating that processes like iou-sqp-4294:4295 remain blocked for over 122 seconds. The problem occurs during the cancellation process of shared sqpoll contexts, where the kernel's internal accounting mechanism fails to properly track inflight requests across multiple contexts sharing the same polling thread.
The technical flaw stems from improper counter management within the io_uring_cancel_sqpoll() function which utilizes per-task counters to track inflight requests rather than maintaining accurate per-context accounting. When multiple io_uring contexts share the same sqpoll thread, the function incorrectly calculates the number of requests to cancel by referencing outdated or incorrect counter values. This miscalculation causes the cancellation routine to enter an infinite sleep state waiting for requests that will never arrive, as the system attempts to cancel more requests than actually exist in the current context. The issue is particularly severe because it affects the shared nature of sqpoll threads where multiple contexts can operate simultaneously on the same polling infrastructure.
The operational impact of this vulnerability is significant for systems relying heavily on io_uring for high-performance I/O operations, particularly in environments with shared sqpoll configurations. Systems may experience complete hangs or unresponsiveness when attempting to cancel io_uring operations, leading to service disruption and potential system crashes. The vulnerability affects the core io_uring cancellation mechanism, which is fundamental to proper resource management and process cleanup in asynchronous I/O operations. This type of deadlock scenario can persist until manual system intervention or reboot is performed, making it particularly dangerous in production environments where system stability is paramount.
The fix implemented addresses the root cause by modifying the cancellation logic to properly handle shared sqpoll contexts through a more accurate counting mechanism that considers all contexts sharing the same polling thread. The solution ensures that cancellation operations proceed correctly without removing contexts from the processing list prematurely, which would otherwise prevent the cancellation function from locating and properly processing the target contexts. This remediation aligns with CWE-400 vulnerability classification related to resource exhaustion and improper resource management, while also addressing ATT&CK technique T1490 for denial of service through resource consumption. The patch maintains backward compatibility while ensuring proper synchronization and accounting across shared io_uring contexts, preventing the infinite sleep condition that led to system hangs and maintaining the integrity of the kernel's asynchronous I/O subsystem.