In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: fix circular locking dependency in ocfs2_init_acl()<\/p>\n
A lockdep warning indicates a circular locking dependency between
\n`&oi->ip_xattr_sem` and `&journal->j_trans_barrier`:<\/p>\n
WARNING: possible circular locking dependency detected
\nis trying to acquire lock:
\n (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd\/0x7e0
\n fs\/ocfs2\/acl.c:367<\/p>\n
but task is already holding lock:
\n (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab\/0x700
\n fs\/ocfs2\/journal.c:369<\/p>\n
The deadlock involves two code paths: Path 1 (setxattr) where
\n`ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a
\ntransaction, which acquires `j_trans_barrier` (read); and Path 2
\n(mkdir\/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier`
\nread) and then calls `ocfs2_init_acl()`, which attempts to acquire
\n`ip_xattr_sem` (read) on the parent directory to retrieve the default ACL.<\/p>\n
Because rw_semaphores are subject to writer priority, a pending writer on
\n`j_trans_barrier` (e.g., the journal commit thread) can cause Path 1 to
\nblock, while Path 2 is blocked waiting for Path 1 to release
\n`ip_xattr_sem`.<\/p>\n
The patch fixes the lock ordering by precomputing the ACL state before
\nstarting the OCFS2 transaction, while preserving POSIX ACL storage
\nsemantics and the existing inode\/security initialization order. By reading
\nthe parent directory’s default ACL and preparing the new inode’s ACLs
\noutside the transaction, `ip_xattr_sem` is always acquired before
\n`j_trans_barrier`.<\/p>\n
`struct ocfs2_acl_state` encapsulates the prepared ACL state, while
\n`ocfs2_acl_init_prepare()` and `ocfs2_acl_init_release()` avoid code
\nduplication between `ocfs2_mknod()` and `ocfs2_init_security_and_acl()`.
\n`ocfs2_calc_xattr_init()` and `ocfs2_init_acl()` use this precomputed
\nstate, removing internal `ip_xattr_sem` acquisition and redundant disk
\nreads.<\/p>\n
Additionally, remove the `ip_xattr_sem` acquisition from
\n`ocfs2_xattr_set_handle()`. This function is only used while initializing a
\nnew inode that has not yet been inserted into the inode hash or attached to
\na dentry, meaning there is no risk of concurrent access and the lock is
\nunnecessary.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: fix circular locking dependency in ocfs2_init_acl()<\/p>\n
A lockdep warning indicates a circular locking dependency between
\n`&oi-<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28516","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28516","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28516"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28516"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28516"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}