Description
In the Linux kernel, the following vulnerability has been resolved: ext4: skip extra isize expansion during mount to prevent deadlock ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty() while holding an active jbd2 handle. During mount (!SB_ACTIVE), the expand path may move xattrs to external blocks and release ea_inodes via iput(). When !SB_ACTIVE, iput() calls write_inode_now() which acquires s_writepages_rwsem, creating a circular lock dependency: s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem This can be triggered via: ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() or: ext4_evict_inode() -> ext4_mark_inode_dirty() -> ext4_try_to_expand_extra_isize() Skip expansion when !SB_ACTIVE. This is a minor loss of functionality (extra isize won't grow for these inodes during mount), which e2fsck can resolve later if needed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c8585c6fcaf2011de54c3592e80a634a2b9e1a7f to < 41897f1bcf4ace5f1f28d0be784b6f4f0e929641affectedc8585c6fcaf2011de54c3592e80a634a2b9e1a7f to < 9c3469377b1d8caba6bec6ef3c460810bbfb02ccaffectedc8585c6fcaf2011de54c3592e80a634a2b9e1a7f to < 1dd4882dbdc8bfdf2182fa388883c143fac0902aaffectedc8585c6fcaf2011de54c3592e80a634a2b9e1a7f to < 7ba09330d9ea6e996228316719eae812d7e04983affectedc8585c6fcaf2011de54c3592e80a634a2b9e1a7f to < c5e6434cc55f30220b228be237bb666351f9f4ddaffectedc8585c6fcaf2011de54c3592e80a634a2b9e1a7f to < 7ace189b9ea79cf78df9c32b940ce12735f9459aaffectedc8585c6fcaf2011de54c3592e80a634a2b9e1a7f to < 2fb8ff81659a57c42bb7b49e8339a2be2a318ef8affectedc8585c6fcaf2011de54c3592e80a634a2b9e1a7f to < 7461c60b9c6a839b13ad4c3490681a0cf5aa0637affected
Linux Linux
Default version status: affected
4.7affected0 to < 4.7unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/41897f1bcf4ace5f1f28d0be784b6f4f0e929641 ↗
- https://git.kernel.org/stable/c/9c3469377b1d8caba6bec6ef3c460810bbfb02cc ↗
- https://git.kernel.org/stable/c/1dd4882dbdc8bfdf2182fa388883c143fac0902a ↗
- https://git.kernel.org/stable/c/7ba09330d9ea6e996228316719eae812d7e04983 ↗
- https://git.kernel.org/stable/c/c5e6434cc55f30220b228be237bb666351f9f4dd ↗
- https://git.kernel.org/stable/c/7ace189b9ea79cf78df9c32b940ce12735f9459a ↗
- https://git.kernel.org/stable/c/2fb8ff81659a57c42bb7b49e8339a2be2a318ef8 ↗
- https://git.kernel.org/stable/c/7461c60b9c6a839b13ad4c3490681a0cf5aa0637 ↗