CVE-2026-68132: super: fix emergency thaw deadlock on frozen block devices

In the Linux kernel, the following vulnerability has been resolved:

super: fix emergency thaw deadlock on frozen block devices

dothawallcallback() calls bdevthaw() while holding sb->sumount exclusively. If the block device was frozen via bdevfreeze() dropping the last block layer freeze reference calls fsbdevthaw() which reacquires sumount:

dothawallcallback(sb) superlockexcl(sb) # holds sb->sumount bdevthaw(sb->sbdev) mutexlock(&bdev->bdfsfreezemutex) # bdfsfreezecount drops 1 -> 0 bdholderops->thaw == fsbdevthaw getbdevsuper(bdev) bdevsuperlock(bdev, true) superlock(sb, true) downwrite(&sb->sumount) # same task: deadlock

The emergency thaw worker deadlocks against itself holding both sumount and bdfsfreezemutex. That fscks any subsequent unmount, freeze, or thaw of that filesystem and block device.

[ 81.878470] sysrq: Show Blocked State [ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 taskflags:0x4208060 flags:0x00080000 [ 81.884876] Workqueue: events dothawall [ 81.886656] Call Trace: [ 81.887759] <TASK> [ 81.888763] schedule+0x579/0x1420 [ 81.890372] schedule+0x3a/0x100 [ 81.891794] schedulepreemptdisabled+0x15/0x30 [ 81.893848] rwsemdownwriteslowpath+0x1ea/0x900 [ 81.895191] ? pfxdothawallcallback+0x10/0x10 [ 81.896528] downwrite+0xbd/0xc0 [ 81.897505] superlock+0x91/0x180 [ 81.898457] ? mutexlock+0xa99/0x1140 [ 81.900748] ? mutexunlockslowpath+0x1f/0x400 [ 81.902069] bdevsuperlock+0x5b/0x150 [ 81.903132] getbdevsuper+0x10/0x60 [ 81.904042] fsbdevthaw+0x23/0xf0 [ 81.904755] bdevthaw+0x82/0x100 [ 81.905484] dothawallcallback+0x2c/0x50 [ 81.906298] iteratesupers+0x5d/0x130 [ 81.907067] dothawall+0x20/0x40 [ 81.907739] processonework+0x206/0x5e0 [ 81.908545] workerthread+0x1e2/0x3c0 [ 81.909339] ? pfxworkerthread+0x10/0x10 [ 81.910171] kthread+0xf4/0x130 [ 81.910799] ? pfxkthread+0x10/0x10 [ 81.911528] retfromfork+0x2e2/0x3b0 [ 81.912259] ? pfxkthread+0x10/0x10 [ 81.913010] retfromforkasm+0x1a/0x30 [ 81.913806] </TASK>

bdevsuperlock() even documents the violated requirement with lockdepassertnotheld(&sb->sumount).

Acquiring bdfsfreezemutex under sumount also inverts the bdfsfreezemutex vs. sumount ordering established by bdev{freeze,thaw}() and can thus ABBA against a concurrent block-layer freeze even when the recursive path isn't hit.

Fix this by not holding sumount around the bdevthaw() loop at all. Pin the superblock with an active reference instead as filesystemsfreezecallback() does. The active reference keeps the superblock from being shut down and so ->sbdev stays valid without holding sumount. The block-layer-held freeze is dropped by fsbdevthaw() with FREEZEMAYNEST | FREEZEHOLDERUSERSPACE exactly as a regular unfreeze would and thawsuperlocked() handles filesystem-level freezes as before.

The emergency thaw path has deadlocked like this in one form or another for a long long time but the current exclusively-held shape dates back to commit [1] where thawbdev() already ended in thawsuper() with sumount held by dothawallcallback().