PT-2026-90207 · Linux · Linux
CVE-2026-89491
·
Publicado
2026-09-11
·
Atualizado
2026-09-11
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: cluster: don't sleep while holding o2hb live lock in o2hb region pin()
Patch series "ocfs2: cluster: o2hb region pin() fixes", v2.
This series fixes three related issues in o2hb region pin(), all are from
the original implementation in commit: 58a3158a5d17 ("ocfs2/cluster:
Pin/unpin o2hb regions"):
-
It is called with o2hb live lock (a spinlock) held, but the underlying configfs depend item() sleeps (takes inode rwsem and pins the filesystem). This triggers BUG under CONFIG DEBUG ATOMIC SLEEP.
-
When called from the configfs drop item callback, it creates a lock order inversion: parent inode lock -> configfs root inode lock, which can deadlock against subsystem unregistration paths taking root -> parent.
-
If pinning fails partway through o2hb region inc user(), the o2hb dependent users counter is leaked and partially-pinned regions are never released, leaving heartbeat regions unprotected on subsequent mounts.
Patch 1 reworks o2hb region pin() to drop o2hb live lock across each
sleeping configfs depend item() call, using a config item reference to
keep the region alive while unlocked.
Patch 2 adds a from callback parameter to select
configfs depend item unlocked() when called from configfs context,
avoiding the inode lock nesting.
Patch 3 fixes the error path in o2hb region inc user() to unpin and
decrement the counter on failure.
This patch (of 3):
o2hb region pin() is always called with the o2hb live lock spinlock held
(from o2hb region inc user() and o2hb heartbeat group drop item()), but it
calls o2nm depend item() -> configfs depend item(), which sleeps: it pins
the configfs filesystem and takes the configfs root inode rwsem. Under
CONFIG DEBUG ATOMIC SLEEP this triggers:
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c
in atomic(): 1, ... name: mount.ocfs2
down write
configfs depend item
o2hb region pin
o2hb region inc user
o2hb register callback
dlm register domain handlers
...
ocfs2 dlm init
ocfs2 mount volume
ocfs2 fill super
Rework o2hb region pin() to pin one region at a time with the lock dropped
across the sleeping call: under o2hb live lock find the next eligible
region and take a config item reference to keep it alive, drop the lock,
call o2nm depend item(), then retake the lock and record the pin. The
config item put() is done with the lock released as well, since
o2hb region release() also acquires o2hb live lock and can sleep. The
region list may change while unlocked, so the scan restarts from the top
after each pin. Local heartbeat still pins only the matching region;
global heartbeat pins all eligible regions.
The unpin path is unaffected: configfs undepend item() only takes a
spinlock and does not sleep.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux