Description
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix deadlock in jbd2_journal_cancel_revoke() Commit f76d4c28a46a ("fs/jbd2: use sleeping version of __find_get_block()") changed jbd2_journal_cancel_revoke() to use __find_get_block_nonatomic() which holds the folio lock instead of i_private_lock. This breaks the lock ordering (folio -> buffer) and causes an ABBA deadlock when the filesystem blocksize < pagesize: T1 T2 ext4_mkdir() ext4_init_new_dir() ext4_append() ext4_getblk() lock_buffer() <- A sync_blockdev() blkdev_writepages() writeback_iter() writeback_get_folio() folio_lock() <- B ext4_journal_get_create_access() jbd2_journal_cancel_revoke() __find_get_block_nonatomic() folio_lock() <- B block_write_full_folio() lock_buffer() <- A This can occasionally cause generic/013 to hang. Fix by only calling __find_get_block_nonatomic() when the passed buffer_head doesn't belong to the bdev, which is the only case that we need to look up its bdev alias. Otherwise, the lookup is redundant since the found buffer_head is equal to the one we passed in.
Product status
f1c5aa614b5c251f93a6a4c8c26001d5e9e53fd6 (git) before dff07cc98fdf6af57a7c054dc09b2050a9d5c287
f76d4c28a46a9260d85e00dafc8f46d369365d33 (git) before 2b2fee890250ab647a601124471a334bb01a0790
f76d4c28a46a9260d85e00dafc8f46d369365d33 (git) before bbd943d6a2d566428324b516a37f98328dfb802d
f76d4c28a46a9260d85e00dafc8f46d369365d33 (git) before 981fcc5674e67158d24d23e841523eccba19d0e7
1bb7a4b6b3d7dd8da6f5a9d0529d42c22a359e71 (git)
6.12.31 (semver) before 6.12.86
6.14.9 (semver) before 6.15
6.15
Any version before 6.15
6.12.86 (semver)
6.18.27 (semver)
7.0.4 (semver)
7.1-rc1 (original_commit_for_fix)
References
git.kernel.org/...c/dff07cc98fdf6af57a7c054dc09b2050a9d5c287
git.kernel.org/...c/2b2fee890250ab647a601124471a334bb01a0790
git.kernel.org/...c/bbd943d6a2d566428324b516a37f98328dfb802d
git.kernel.org/...c/981fcc5674e67158d24d23e841523eccba19d0e7