In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: skip extent mft records in writeback to prevent deadlock<\/p>\n
This patch fixes the ABBA deadlock between extent_lock and extent
\nmrec_lock triggered by xfstests generic\/113, that occurs since the commit
\n6994acf33bae (“ntfs: use base mft_no when looking up base inode for
\n\t\textent record”).<\/p>\n
Path A (inode writeback):
\n VFS writeback
\n -> ntfs_write_inode()
\n -> __ntfs_write_inode()
\n -> mutex_lock(&ni->extent_lock)
\n -> mutex_lock(&tni->mrec_lock)<\/p>\n
Path B (MFT folio writeback):
\n VFS writeback of $MFT dirty folios
\n -> ntfs_mft_writepages()
\n -> ntfs_write_mft_block()
\n -> ntfs_may_write_mft_record()
\n -> holds one extent mrec_lock from a previous iteration
\n -> tries to acquire another base inode extent_lock<\/p>\n
By removing all extent_lock and extent mrec_lock acquisition from the MFT
\nfolio writeback path, the ABBA lock ordering is eliminated:<\/p>\n
Path A: __ntfs_write_inode(): extent_lock -> mrec_lock
\nPath B (removed): ntfs_write_mft_block(): mrec_lock -> extent_lock<\/p>\n
Path B is always redundant for extent records because:<\/p>\n
1. mark_mft_record_dirty(ext_ni) does NOT dirty the MFT folio.
\n It only sets NInoDirty(ext_ni) and marks the base VFS inode dirty
\n via __mark_inode_dirty(I_DIRTY_DATASYNC), which triggers Path A.
\n Therefore, normal extent modifications never create a situation where
\n the MFT folio is dirty and Path B is not scheduled.<\/p>\n
2. The MFT folio only gets dirtied via ntfs_mft_mark_dirty() inside
\n ntfs_mft_record_alloc(). But all identified callers in attrib.c
\n (ntfs_attr_add, ntfs_attr_record_move_away,
\n ntfs_attr_make_non_resident, ntfs_attr_record_resize) follow through
\n with mark_mft_record_dirty(), which triggers Path A to write the
\n complete record.<\/p>\n
3. ntfs_evict_big_inode() calls ntfs_commit_inode() before freeing extent
\n inodes, ensuring all dirty extents are flushed via Path A before the
\n base inode leaves the icache.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: skip extent mft records in writeback to prevent deadlock<\/p>\n
This patch fixes the ABBA deadlock between extent_lock and extent
\nm<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6834","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6834","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6834"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6834"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6834"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}