In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Do not block on tag allocation in scsi eh lock door()

scsi eh lock door() is called from scsi restart operations() while the host is still in the SHOST RECOVERY state, i.e. before the host is switched back to SHOST RUNNING and scsi run host queues() restarts the queues. It allocates a request via scsi alloc request() with no flags, so blk mq get tag() may block waiting for a free sched tag when all tags are already in use.

Those tags can be held by commands that were just requeued by scsi eh flush done q() during error handling. Such commands cannot be dispatched until the host leaves SHOST RECOVERY and scsi run host queues() is called - which only happens after scsi eh lock door() returns.

This forms a circular dependency:

For devices with a single driver tag (e.g. USB storage) it is a guaranteed deadlock and I/O that can never be submitted. This problem has also been reproduced in our environment.

Locking the door is a best-effort operation, and scsi eh lock door() already returns silently when the request allocation fails. Pass BLK MQ REQ NOWAIT to scsi alloc request() so the allocation fails instead of blocking when no tag is available. This breaks the circular dependency and allows the error handler to finish restarting the queues, after which the pending commands are dispatched normally.