In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()<\/p>\n
Syzbot\/stress-ng reported an ABBA deadlock in ext4 when exercising
\nconcurrent xattr workloads (using the ea_inode mount\/format option).<\/p>\n
The deadlock occurs between the running transaction and the eviction
\nthread:
\n– Task 1 (stress-ng): Holds a reference to a shared mbcache_entry (ce)
\n and calls ext4_xattr_inode_cache_find() -> ext4_iget() to retrieve
\n the corresponding EA inode. Since the EA inode is currently being
\n evicted, ext4_iget() blocks in __wait_on_freeing_inode() waiting for
\n eviction to complete.
\n– Task 2 (eviction thread): Currently evicting the same EA inode in
\n ext4_evict_ea_inode(). It calls mb_cache_entry_wait_unused(oe) which
\n blocks waiting for Task 1 to release the reference to the mbcache_entry.<\/p>\n
To break this deadlock, implement a new ext4_iget() configuration flag
\nnamed EXT4_IGET_NOWAIT. When set, perform a non-blocking lookup of the
\ninode via VFS’s find_inode_nowait() API.<\/p>\n
If the inode is currently being evicted (marked with I_FREEING or
\nI_WILL_FREE) or created (I_CREATING), or if it is not present in the VFS
\ninode cache (cache miss), simply skip it (returning -ENOENT) rather than
\nwaiting for eviction\/creation to complete, breaking the ABBA cycle.<\/p>\n
Since we return -ENOENT immediately on a cache miss, we never attempt to
\nallocate a new inode or call iget_locked(), completely eliminating any
\nTOCTOU race window.<\/p>\n
If the returned inode is I_NEW, wait for its initialization to clear via
\nwait_on_new_inode(). If initialization fails and the inode is unhashed
\nduring wait_on_new_inode() waking up (e.g., due to an I\/O read error in
\nanother thread), safely drop the reference and return -ENOENT. This
\nunhashed check is executed unconditionally on all cache-hit pathways to
\nproperly handle concurrent initialization failures.<\/p>\n
Finally, standard validation checks (including is_bad_inode,
\nEXT4_EA_INODE_FL, file_acl, and xattr flags) are executed as normal inside
\ncheck_igot_inode() to fully guarantee VFS-layer safety.<\/p>\n
In ext4_xattr_inode_cache_find(), invoke ext4_iget() with the new
\nEXT4_IGET_NOWAIT flag to perform the non-blocking cache search.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()<\/p>\n
Syzbot\/stress-ng reported an ABBA deadlock in ext4 when exercising
\nconcur<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25872","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25872","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25872"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25872"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25872"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}