Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-93252

ocfs2: fix circular locking dependency in ocfs2_init_acl()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2_init_acl() A lockdep warning indicates a circular locking dependency between `&oi->ip_xattr_sem` and `&journal->j_trans_barrier`: WARNING: possible circular locking dependency detected is trying to acquire lock: (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0 fs/ocfs2/acl.c:367 but task is already holding lock: (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700 fs/ocfs2/journal.c:369 The deadlock involves two code paths: Path 1 (setxattr) where `ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a transaction, which acquires `j_trans_barrier` (read); and Path 2 (mkdir/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier` read) and then calls `ocfs2_init_acl()`, which attempts to acquire `ip_xattr_sem` (read) on the parent directory to retrieve the default ACL. Because rw_semaphores are subject to writer priority, a pending writer on `j_trans_barrier` (e.g., the journal commit thread) can cause Path 1 to block, while Path 2 is blocked waiting for Path 1 to release `ip_xattr_sem`. The patch fixes the lock ordering by precomputing the ACL state before starting the OCFS2 transaction, while preserving POSIX ACL storage semantics and the existing inode/security initialization order. By reading the parent directory's default ACL and preparing the new inode's ACLs outside the transaction, `ip_xattr_sem` is always acquired before `j_trans_barrier`. `struct ocfs2_acl_state` encapsulates the prepared ACL state, while `ocfs2_acl_init_prepare()` and `ocfs2_acl_init_release()` avoid code duplication between `ocfs2_mknod()` and `ocfs2_init_security_and_acl()`. `ocfs2_calc_xattr_init()` and `ocfs2_init_acl()` use this precomputed state, removing internal `ip_xattr_sem` acquisition and redundant disk reads. Additionally, remove the `ip_xattr_sem` acquisition from `ocfs2_xattr_set_handle()`. This function is only used while initializing a new inode that has not yet been inserted into the inode hash or attached to a dentry, meaning there is no risk of concurrent access and the lock is unnecessary.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 16c8d569f5704a84164f30ff01b29879f3438065 to < 4936d4464d1ae10b5fbba64374085a0dcc060560affected
  • 16c8d569f5704a84164f30ff01b29879f3438065 to < caf3056936fb8b5ce92e419cf8b246ce9c437343affected
  • 16c8d569f5704a84164f30ff01b29879f3438065 to < 5b7b3c50c39ad0dc27e7418981e01c4183273f89affected
  • 16c8d569f5704a84164f30ff01b29879f3438065 to < 8d88f52fbbbcc18adf4091a955511d0cf605bf11affected
  • 16c8d569f5704a84164f30ff01b29879f3438065 to < 8931403ee3dcfe8a24a5267efec9d9460ab7a1b5affected
  • 16c8d569f5704a84164f30ff01b29879f3438065 to < f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758affected
  • 16c8d569f5704a84164f30ff01b29879f3438065 to < 1222f7a3183b35c0c566899fdaead5c7c4043076affected
  • 16c8d569f5704a84164f30ff01b29879f3438065 to < bd7c05fb4a4776dff5a87b19008d28458647d15daffected
  • 15ac59a84750b3afc0a2b6f2636c4f7e6cbd6d5eaffected
  • b35bb8a41795caa05e09c3aacf7d78f1f20bac04affected
  • 1d5fdc1307eeb04b334c5dc23e11dbd6068d90ebaffected
  • a66174eb4a149b7919d174d9a7ce6ad9909c5ee2affected
  • 3.18.111 to < 3.19affected
  • 4.4.134 to < 4.5affected
  • 4.9.104 to < 4.10affected
  • 4.14.37 to < 4.15affected

Linux Linux

Default version status: affected

  • 4.16affected
  • 0 to < 4.16unaffected
  • 5.10.270 to ≤ 5.10.*unaffected
  • 5.15.221 to ≤ 5.15.*unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.52 to ≤ 6.18.*unaffected
  • 7.2.6 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References