PT-2026-85798 · Linux · Linux
CVE-2026-80879
·
Published
2026-09-04
·
Updated
2026-09-04
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix circular locking dependency in ocfs2 dio end io write
A circular locking dependency involves INODE ALLOC SYSTEM INODE,
EXTENT ALLOC SYSTEM INODE, and ORPHAN DIR SYSTEM INODE.
-
ocfs2 mknod() acquires INODE ALLOC then EXTENT ALLOC.
-
ocfs2 dio end io write() acquires EXTENT ALLOC for unwritten extents, then ORPHAN DIR via ocfs2 del inode from orphan() while still holding EXTENT ALLOC.
-
ocfs2 wipe inode() acquires ORPHAN DIR then INODE ALLOC via ocfs2 remove inode.
Break the cycle in ocfs2 dio end io write() by freeing the allocation
contexts (releasing EXTENT ALLOC) before acquiring ORPHAN DIR.
WARNING: possible circular locking dependency detected
is trying to acquire lock:
ffff8881e78b33a0
(&ocfs2 sysfile lock key[INODE ALLOC SYSTEM INODE]){+.+.}-{4:4}, at:
ocfs2 evict inode+0x1539/0x43b0 fs/ocfs2/inode.c:1299
but task is already holding lock:
ffff8881e78b4fa0
(&ocfs2 sysfile lock key[ORPHAN DIR SYSTEM INODE]){+.+.}-{4:4}, at:
ocfs2 evict inode+0xe97/0x43b0 fs/ocfs2/inode.c:1299
the existing dependency chain (in reverse order) is:
-> #2 (&ocfs2 sysfile lock key[ORPHAN DIR SYSTEM INODE]){+.+.}-{4:4}:
inode lock include/linux/fs.h:1029 [inline]
ocfs2 del inode from orphan+0x12e/0x7a0 fs/ocfs2/namei.c:2728
ocfs2 dio end io+0xf9c/0x1370 fs/ocfs2/aops.c:2418
dio complete+0x25b/0x790 fs/direct-io.c:281
-> #1 (&ocfs2 sysfile lock key[EXTENT ALLOC SYSTEM INODE]){+.+.}-{4:4}:
inode lock include/linux/fs.h:1029 [inline]
ocfs2 reserve suballoc bits+0x16d/0x4840 fs/ocfs2/suballoc.c:882
ocfs2 reserve new metadata blocks+0x415/0x9a0
fs/ocfs2/suballoc.c:1078
ocfs2 mknod+0x10f3/0x2260 fs/ocfs2/namei.c:351
-> #0 (&ocfs2 sysfile lock key[INODE ALLOC SYSTEM INODE]){+.+.}-{4:4}:
lock acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock acquire+0x106/0x350 kernel/locking/lockdep.c:5868
down write+0x96/0x200 kernel/locking/rwsem.c:1625
inode lock include/linux/fs.h:1029 [inline]
ocfs2 remove inode fs/ocfs2/inode.c:733 [inline]
ocfs2 wipe inode fs/ocfs2/inode.c:896 [inline]
ocfs2 delete inode fs/ocfs2/inode.c:1157 [inline]
ocfs2 evict inode+0x1539/0x43b0 fs/ocfs2/inode.c:1299
Chain exists of:
&ocfs2 sysfile lock key[INODE ALLOC SYSTEM INODE] -->
&ocfs2 sysfile lock key[EXTENT ALLOC SYSTEM INODE] -->
&ocfs2 sysfile lock key[ORPHAN DIR SYSTEM INODE]
Possible unsafe locking scenario:
CPU0 CPU1
---- ----lock(&ocfs2 sysfile lock key[ORPHAN DIR SYSTEM INODE]);
lock(&ocfs2 sysfile lock key[EXTENT ALLOC SYSTEM INODE]);
lock(&ocfs2 sysfile lock key[ORPHAN DIR SYSTEM INODE]);
lock(&ocfs2 sysfile lock key[INODE ALLOC SYSTEM INODE]);
*** DEADLOCK ***
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux