In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write<\/p>\n
A circular locking dependency involves INODE_ALLOC_SYSTEM_INODE,
\nEXTENT_ALLOC_SYSTEM_INODE, and ORPHAN_DIR_SYSTEM_INODE.<\/p>\n
1. ocfs2_mknod() acquires INODE_ALLOC then EXTENT_ALLOC.<\/p>\n
2. ocfs2_dio_end_io_write() acquires EXTENT_ALLOC for unwritten
\n extents, then ORPHAN_DIR via ocfs2_del_inode_from_orphan() while still
\n holding EXTENT_ALLOC.<\/p>\n
3. ocfs2_wipe_inode() acquires ORPHAN_DIR then INODE_ALLOC via
\n ocfs2_remove_inode.<\/p>\n
Break the cycle in ocfs2_dio_end_io_write() by freeing the allocation
\ncontexts (releasing EXTENT_ALLOC) before acquiring ORPHAN_DIR.<\/p>\n
WARNING: possible circular locking dependency detected
\n——————————————————
\nis trying to acquire lock:
\nffff8881e78b33a0
\n(&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at:
\nocfs2_evict_inode+0x1539\/0x43b0 fs\/ocfs2\/inode.c:1299<\/p>\n
but task is already holding lock:
\nffff8881e78b4fa0
\n(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}, at:
\nocfs2_evict_inode+0xe97\/0x43b0 fs\/ocfs2\/inode.c:1299<\/p>\n
the existing dependency chain (in reverse order) is:<\/p>\n
-> #2 (&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}:
\n inode_lock include\/linux\/fs.h:1029 [inline]
\n ocfs2_del_inode_from_orphan+0x12e\/0x7a0 fs\/ocfs2\/namei.c:2728
\n ocfs2_dio_end_io+0xf9c\/0x1370 fs\/ocfs2\/aops.c:2418
\n dio_complete+0x25b\/0x790 fs\/direct-io.c:281<\/p>\n
-> #1 (&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:
\n inode_lock include\/linux\/fs.h:1029 [inline]
\n ocfs2_reserve_suballoc_bits+0x16d\/0x4840 fs\/ocfs2\/suballoc.c:882
\n ocfs2_reserve_new_metadata_blocks+0x415\/0x9a0
\n fs\/ocfs2\/suballoc.c:1078
\n ocfs2_mknod+0x10f3\/0x2260 fs\/ocfs2\/namei.c:351<\/p>\n
-> #0 (&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:
\n __lock_acquire+0x15a5\/0x2cf0 kernel\/locking\/lockdep.c:5237
\n lock_acquire+0x106\/0x350 kernel\/locking\/lockdep.c:5868
\n down_write+0x96\/0x200 kernel\/locking\/rwsem.c:1625
\n inode_lock include\/linux\/fs.h:1029 [inline]
\n ocfs2_remove_inode fs\/ocfs2\/inode.c:733 [inline]
\n ocfs2_wipe_inode fs\/ocfs2\/inode.c:896 [inline]
\n ocfs2_delete_inode fs\/ocfs2\/inode.c:1157 [inline]
\n ocfs2_evict_inode+0x1539\/0x43b0 fs\/ocfs2\/inode.c:1299<\/p>\n
Chain exists of:
\n &ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE] –>
\n &ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE] –>
\n &ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]<\/p>\n
Possible unsafe locking scenario:<\/p>\n
CPU0 CPU1
\n —- —-
\n lock(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]);
\n lock(&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]);
\n lock(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]);
\n lock(&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]);<\/p>\n
*** DEADLOCK ***<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write<\/p>\n
A circular locking dependency involves INODE_ALLOC_SYSTEM_INODE,<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17427","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17427","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17427"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17427"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17427"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}