CVE-2026-89491: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: cluster: don't sleep while holding o2hblivelock in o2hbregionpin()
Patch series "ocfs2: cluster: o2hbregionpin() fixes", v2.
This series fixes three related issues in o2hbregionpin(), all are from the original implementation in commit: 58a3158a5d17 ("ocfs2/cluster: Pin/unpin o2hb regions"):
1) It is called with o2hblivelock (a spinlock) held, but the underlying configfsdependitem() sleeps (takes inode rwsem and pins the filesystem). This triggers BUG under CONFIGDEBUGATOMICSLEEP.
2) When called from the configfs dropitem callback, it creates a lock order inversion: parent inodelock -> configfs root inodelock, which can deadlock against subsystem unregistration paths taking root -> parent.
3) If pinning fails partway through o2hbregionincuser(), the o2hbdependentusers counter is leaked and partially-pinned regions are never released, leaving heartbeat regions unprotected on subsequent mounts.
Patch 1 reworks o2hbregionpin() to drop o2hblivelock across each sleeping configfsdependitem() call, using a configitem reference to keep the region alive while unlocked.
Patch 2 adds a fromcallback parameter to select configfsdependitemunlocked() when called from configfs context, avoiding the inodelock nesting.
Patch 3 fixes the error path in o2hbregionincuser() to unpin and decrement the counter on failure.
This patch (of 3):
o2hbregionpin() is always called with the o2hblivelock spinlock held (from o2hbregionincuser() and o2hbheartbeatgroupdropitem()), but it calls o2nmdependitem() -> configfsdependitem(), which sleeps: it pins the configfs filesystem and takes the configfs root inode rwsem. Under CONFIGDEBUGATOMICSLEEP this triggers:
BUG: sleeping function called from invalid context at kernel/locking/rwsem.c inatomic(): 1, ... name: mount.ocfs2 downwrite configfsdependitem o2hbregionpin o2hbregionincuser o2hbregistercallback dlmregisterdomainhandlers ... ocfs2dlminit ocfs2mountvolume ocfs2fillsuper
Rework o2hbregionpin() to pin one region at a time with the lock dropped across the sleeping call: under o2hblivelock find the next eligible region and take a configitem reference to keep it alive, drop the lock, call o2nmdependitem(), then retake the lock and record the pin. The configitemput() is done with the lock released as well, since o2hbregionrelease() also acquires o2hblivelock and can sleep. The region list may change while unlocked, so the scan restarts from the top after each pin. Local heartbeat still pins only the matching region; global heartbeat pins all eligible regions.
The unpin path is unaffected: configfsundependitem() only takes a spinlock and does not sleep.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1119.126~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1125.134~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1124.133~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1120.130~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-202.212~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-197.207~20.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1070.72~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1116.122~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-202.212 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1124.133 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1115.121 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1102.110 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1113.117 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.116 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-197.207 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1114.115 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 5.15.0-1070.72 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-igxto a version that resolves this vulnerability.Fixed in 5.15.0-1059.59 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1116.122 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1103.105 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1118.127 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-202.212+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130+fips1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Rework o2hb_region_pin() so it does not call the sleeping configfs_depend_item() while holding o2hb_live_lock: while holding the lock, find the next eligible region and take a config_item reference; release the lock, call o2nm_depend_item(), then reacquire the lock and record the pin. Release the lock before config_item_put() as well.
- Compensating control
Add a from_callback path that uses configfs_depend_item_unlocked() when o2hb_region_pin() is called from the configfs drop_item callback, avoiding the parent inode_lock -> configfs root inode_lock nesting.
- Compensating control
Fix the o2hb_region_inc_user() failure path to unpin every partially pinned region and decrement o2hb_dependent_users when pinning fails.
Event History
Frequently Asked Questions
How might this issue present in an affected system?
Systems built with CONFIG_DEBUG_ATOMIC_SLEEP can trigger a BUG because configfs_depend_item() may sleep while o2hb_live_lock, a spinlock, is held. A lock-order inversion can also deadlock with subsystem unregistration paths.
What is the impact if region pinning fails partway through user registration?
The o2hb_dependent_users counter can leak, and partially pinned heartbeat regions may never be released. This can leave heartbeat regions unprotected during subsequent mounts.
Which operations are involved in the deadlock scenario?
The inversion occurs when o2hb_region_pin() is called from the configfs drop_item callback: that path takes the parent inode lock before the configfs root inode lock. Subsystem unregistration can take those locks in the opposite root-to-parent order.