Описание
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix circular locking dependency in ocfs2_init_acl()
A lockdep warning indicates a circular locking dependency between
&oi->ip_xattr_sem and &journal->j_trans_barrier:
WARNING: possible circular locking dependency detected is trying to acquire lock: (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0 fs/ocfs2/acl.c:367
but task is already holding lock: (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700 fs/ocfs2/journal.c:369
The deadlock involves two code paths: Path 1 (setxattr) where
ocfs2_xattr_set() acquires ip_xattr_sem (write) and then starts a
transaction, which acquires j_trans_barrier (read); and Path 2
(mkdir/mknod) where ocfs2_mknod() starts a transaction (j_trans_barrier
read) and then calls ocfs2_init_acl(), which attempts to acquire
ip_xattr_sem (read) on the parent directory to retrieve the default ACL.
Because rw_semaphores are sub...
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix circular locking dependency in ocfs2_init_acl()
A lockdep warning indicates a circular locking dependency between
&oi->ip_xattr_sem and &journal->j_trans_barrier:
WARNING: possible circular locking dependency detected is trying to acquire lock: (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0 fs/ocfs2/acl.c:367
but task is already holding lock: (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700 fs/ocfs2/journal.c:369
The deadlock involves two code paths: Path 1 (setxattr) where
ocfs2_xattr_set() acquires ip_xattr_sem (write) and then starts a
transaction, which acquires j_trans_barrier (read); and Path 2
(mkdir/mknod) where ocfs2_mknod() starts a transaction (j_trans_barrier
read) and then calls ocfs2_init_acl(), which attempts to acquire
ip_xattr_sem (read) on the parent directory to retrieve the default ACL.
Because rw_semaphores are subject to writer priority, a pending writer on
j_trans_barrier (e.g., the journal commit thread) can cause Path 1 to
block, while Path 2 is blocked waiting for Path 1 to release
ip_xattr_sem.
The patch fixes the lock ordering by precomputing the ACL state before
starting the OCFS2 transaction, while preserving POSIX ACL storage
semantics and the existing inode/security initialization order. By reading
the parent directory's default ACL and preparing the new inode's ACLs
outside the transaction, ip_xattr_sem is always acquired before
j_trans_barrier.
struct ocfs2_acl_state encapsulates the prepared ACL state, while
ocfs2_acl_init_prepare() and ocfs2_acl_init_release() avoid code
duplication between ocfs2_mknod() and ocfs2_init_security_and_acl().
ocfs2_calc_xattr_init() and ocfs2_init_acl() use this precomputed
state, removing internal ip_xattr_sem acquisition and redundant disk
reads.
Additionally, remove the ip_xattr_sem acquisition from
ocfs2_xattr_set_handle(). This function is only used while initializing a
new inode that has not yet been inserted into the inode hash or attached to
a dentry, meaning there is no risk of concurrent access and the lock is
unnecessary.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2026-93252
- https://git.kernel.org/stable/c/1222f7a3183b35c0c566899fdaead5c7c4043076
- https://git.kernel.org/stable/c/4936d4464d1ae10b5fbba64374085a0dcc060560
- https://git.kernel.org/stable/c/5b7b3c50c39ad0dc27e7418981e01c4183273f89
- https://git.kernel.org/stable/c/8931403ee3dcfe8a24a5267efec9d9460ab7a1b5
- https://git.kernel.org/stable/c/8d88f52fbbbcc18adf4091a955511d0cf605bf11
- https://git.kernel.org/stable/c/bd7c05fb4a4776dff5a87b19008d28458647d15d
- https://git.kernel.org/stable/c/caf3056936fb8b5ce92e419cf8b246ce9c437343
- https://git.kernel.org/stable/c/f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758
EPSS
CVE ID
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2_init_acl() A lockdep warning indicates a circular locking dependency between `&oi->ip_xattr_sem` and `&journal->j_trans_barrier`: WARNING: possible circular locking dependency detected is trying to acquire lock: (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0 fs/ocfs2/acl.c:367 but task is already holding lock: (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700 fs/ocfs2/journal.c:369 The deadlock involves two code paths: Path 1 (setxattr) where `ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a transaction, which acquires `j_trans_barrier` (read); and Path 2 (mkdir/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier` read) and then calls `ocfs2_init_acl()`, which attempts to acquire `ip_xattr_sem` (read) on the parent directory to retrieve the default ACL. Because rw_semaphores are subject to wr...
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2_init_acl() A lockdep warning indicates a circular locking dependency between `&oi->ip_xattr_sem` and `&journal->j_trans_barrier`: WARNING: possible circular locking dependency detected is trying to acquire lock: (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0 fs/ocfs2/acl.c:367 but task is already holding lock: (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700 fs/ocfs2/journal.c:369 The deadlock involves two code paths: Path 1 (setxattr) where `ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a transaction, which acquires `j_trans_barrier` (read); and Path 2 (mkdir/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier` read) and then calls `ocfs2_init_acl()`, which attempts to acquire `ip_xattr_sem` (read) on the parent directory to retrieve the default ACL. Because rw_semaphores are subjec
In the Linux kernel, the following vulnerability has been resolved: o ...
ELSA-2026-500374: Unbreakable Enterprise kernel security update (IMPORTANT)
EPSS