CVE-2026-89491: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: cluster: don't sleep while holding o2hblivelock in o2hbregionpin()

Patch series "ocfs2: cluster: o2hbregionpin() fixes", v2.

This series fixes three related issues in o2hbregionpin(), all are from the original implementation in commit: 58a3158a5d17 ("ocfs2/cluster: Pin/unpin o2hb regions"):

1) It is called with o2hblivelock (a spinlock) held, but the underlying configfsdependitem() sleeps (takes inode rwsem and pins the filesystem). This triggers BUG under CONFIGDEBUGATOMICSLEEP.

2) When called from the configfs dropitem callback, it creates a lock order inversion: parent inodelock -> configfs root inodelock, which can deadlock against subsystem unregistration paths taking root -> parent.

3) If pinning fails partway through o2hbregionincuser(), the o2hbdependentusers counter is leaked and partially-pinned regions are never released, leaving heartbeat regions unprotected on subsequent mounts.

Patch 1 reworks o2hbregionpin() to drop o2hblivelock across each sleeping configfsdependitem() call, using a configitem reference to keep the region alive while unlocked.

Patch 2 adds a fromcallback parameter to select configfsdependitemunlocked() when called from configfs context, avoiding the inodelock nesting.

Patch 3 fixes the error path in o2hbregionincuser() to unpin and decrement the counter on failure.

This patch (of 3):

o2hbregionpin() is always called with the o2hblivelock spinlock held (from o2hbregionincuser() and o2hbheartbeatgroupdropitem()), but it calls o2nmdependitem() -> configfsdependitem(), which sleeps: it pins the configfs filesystem and takes the configfs root inode rwsem. Under CONFIGDEBUGATOMICSLEEP this triggers:

BUG: sleeping function called from invalid context at kernel/locking/rwsem.c inatomic(): 1, ... name: mount.ocfs2 downwrite configfsdependitem o2hbregionpin o2hbregionincuser o2hbregistercallback dlmregisterdomainhandlers ... ocfs2dlminit ocfs2mountvolume ocfs2fillsuper

Rework o2hbregionpin() to pin one region at a time with the lock dropped across the sleeping call: under o2hblivelock find the next eligible region and take a configitem reference to keep it alive, drop the lock, call o2nmdependitem(), then retake the lock and record the pin. The configitemput() is done with the lock released as well, since o2hbregionrelease() also acquires o2hblivelock and can sleep. The region list may change while unlocked, so the scan restarts from the top after each pin. Local heartbeat still pins only the matching region; global heartbeat pins all eligible regions.

The unpin path is unaffected: configfsundependitem() only takes a spinlock and does not sleep.