In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: cluster: don’t sleep while holding o2hb_live_lock in o2hb_region_pin()<\/p>\n
Patch series “ocfs2: cluster: o2hb_region_pin() fixes”, v2.<\/p>\n
This series fixes three related issues in o2hb_region_pin(), all are from
\nthe original implementation in commit: 58a3158a5d17 (“ocfs2\/cluster:
\nPin\/unpin o2hb regions”):<\/p>\n
1) It is called with o2hb_live_lock (a spinlock) held, but the
\n underlying configfs_depend_item() sleeps (takes inode rwsem and
\n pins the filesystem). This triggers BUG under
\n CONFIG_DEBUG_ATOMIC_SLEEP.<\/p>\n
2) When called from the configfs drop_item callback, it creates a
\n lock order inversion: parent inode_lock -> configfs root
\n inode_lock, which can deadlock against subsystem unregistration
\n paths taking root -> parent.<\/p>\n
3) If pinning fails partway through o2hb_region_inc_user(), the
\n o2hb_dependent_users counter is leaked and partially-pinned
\n regions are never released, leaving heartbeat regions
\n unprotected on subsequent mounts.<\/p>\n
Patch 1 reworks o2hb_region_pin() to drop o2hb_live_lock across each
\nsleeping configfs_depend_item() call, using a config_item reference to
\nkeep the region alive while unlocked.<\/p>\n
Patch 2 adds a from_callback parameter to select
\nconfigfs_depend_item_unlocked() when called from configfs context,
\navoiding the inode_lock nesting.<\/p>\n
Patch 3 fixes the error path in o2hb_region_inc_user() to unpin and
\ndecrement the counter on failure.<\/p>\n
This patch (of 3):<\/p>\n
o2hb_region_pin() is always called with the o2hb_live_lock spinlock held
\n(from o2hb_region_inc_user() and o2hb_heartbeat_group_drop_item()), but it
\ncalls o2nm_depend_item() -> configfs_depend_item(), which sleeps: it pins
\nthe configfs filesystem and takes the configfs root inode rwsem. Under
\nCONFIG_DEBUG_ATOMIC_SLEEP this triggers:<\/p>\n
BUG: sleeping function called from invalid context at kernel\/locking\/rwsem.c
\n in_atomic(): 1, … name: mount.ocfs2
\n down_write
\n configfs_depend_item
\n o2hb_region_pin
\n o2hb_region_inc_user
\n o2hb_register_callback
\n dlm_register_domain_handlers
\n …
\n ocfs2_dlm_init
\n ocfs2_mount_volume
\n ocfs2_fill_super<\/p>\n
Rework o2hb_region_pin() to pin one region at a time with the lock dropped
\nacross the sleeping call: under o2hb_live_lock find the next eligible
\nregion and take a config_item reference to keep it alive, drop the lock,
\ncall o2nm_depend_item(), then retake the lock and record the pin. The
\nconfig_item_put() is done with the lock released as well, since
\no2hb_region_release() also acquires o2hb_live_lock and can sleep. The
\nregion list may change while unlocked, so the scan restarts from the top
\nafter each pin. Local heartbeat still pins only the matching region;
\nglobal heartbeat pins all eligible regions.<\/p>\n
The unpin path is unaffected: configfs_undepend_item() only takes a
\nspinlock and does not sleep.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: cluster: don’t sleep while holding o2hb_live_lock in o2hb_region_pin()<\/p>\n
Patch series “ocfs2: cluster: o2hb_region_pin() fixe<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21413","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}