CVE-2026-90302: ocfs2: synchronize heartbeat callbacks with o2net teardown
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: synchronize heartbeat callbacks with o2net teardown
Patch series "ocfs2: harden heartbeat teardown races".
This series fixes two OCFS2 heartbeat/o2net teardown races found by KASAN.
This patch (of 2):
Heartbeat callbacks stay registered while configfs local-node teardown enters o2netstoplistening(). A node-down event can still run through o2netdisconnectnode() and o2netsetnnstate() while teardown is destroying o2netwq, so the later queue/flush operations can hit a dead workqueue. KASAN has caught this as a slab-use-after-free in queuework() with the call chain:
KASAN slab-use-after-free in queuework+0x56/0xa90 Read of size 4 Call trace: dumpstacklvl+0x66/0xa0 printreport+0xce/0x630 queuework+0x56/0xa90 srsoaliasreturnthunk+0x5/0xfbef5 virtaddrvalid+0x19f/0x330 kasanreport+0xe0/0x110 queuedelayedwork+0x58/0x1e0 queuedelayedworkon+0xb4/0xc0 o2netsetnnstate+0x467/0x840 o2netdisconnectnode+0x7b/0xe0 o2nethbnodedowncb+0x54/0x60 o2hbruneventlist+0x236/0x2d0 o2hbcheckslot+0xad4/0xbc0 lockrelease+0xc8/0x290 o2hbcheckslot+0x9ea/0xbc0 tracehardirqson+0x18/0x130 o2hbdodiskheartbeat+0x646/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079) lockacquire+0x466/0x2260 lockdephardirqsonprepare+0xea/0x1a0 ktimegetwithoffset+0xe9/0x230 o2hbthread+0x14e/0x770 kthread+0x1ad/0x1f0 retfromfork+0x3c9/0x540 switchto+0x2e9/0x730 retfromforkasm+0x1a/0x30 Allocated by task stack: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasankmalloc+0xaa/0xb0 kmallocnoprof+0x292/0x760 allocworkqueue+0x736/0xc60 allocworkqueuenoprof+0xb1/0x110 o2netstartlistening+0xe5/0x430 o2nmnodelocalstore+0x184/0x310 configfswriteiter+0x18a/0x210 vfswrite+0x469/0x810 ksyswrite+0xd2/0x170 dosyscall64+0x115/0x6a0 (arch/x86/entry/syscall64.c:87) entrySYSCALL64afterhwframe+0x77/0x7f Freed by task stack: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 kasanslabfree+0x5f/0x80 kfree+0x313/0x590 rcucore+0x4f4/0x1320 handlesoftirqs+0x156/0x660
queuedelayedworkon o2netsetnnstate o2netdisconnectnode o2nethbnodedowncb o2hbruneventlist
Keep heartbeat callbacks registered so quorum state still tracks node state, but stop them from driving o2net reconnect/disconnect work once local teardown starts. Mark the transport offline before destroying o2netwq, wait for any in-flight heartbeat callback to finish, and delay bring-up replay until the new local node is published through o2nmthisnode().
The replay also has to stay serialized with heartbeat callback delivery. Otherwise a live-node snapshot can be copied, a real hbdown callback can install -ENOTCONN for a peer, and the stale replay can call o2nethbnodeup() for that same peer and queue reconnect work even though heartbeat is already down.
The buggy scenario involves two paths, with each column showing the order within that path:
local-node teardown: heartbeat node-down callback: 1. configfs local-off enters 1. o2hbruneventlist() invokes o2netstoplistening(). o2nethbnodedowncb(). 2. teardown heads for 2. the callback reaches destroyworkqueue(o2netwq). o2netdisconnectnode() and o2netsetnnstate(). 3. teardown destroys and NULLs 3. the callback flushes or queues o2netwq. work through o2netwq.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1119.126~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1125.134~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1124.133~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1120.130~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-202.212~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-197.207~20.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1070.72~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1116.122~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-202.212 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1124.133 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1115.121 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1102.110 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1113.117 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.116 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-197.207 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1114.115 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 5.15.0-1070.72 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-igxto a version that resolves this vulnerability.Fixed in 5.15.0-1059.59 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1116.122 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1103.105 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1118.127 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-202.212+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130+fips1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
During configfs local-node teardown, keep heartbeat callbacks registered for quorum tracking, but prevent them from invoking o2net_disconnect_node() or o2net_set_nn_state() to queue reconnect/disconnect work after teardown begins.
- Compensating control
Before destroying o2net_wq in o2net_stop_listening(), mark the transport offline, wait for in-flight heartbeat callbacks to finish, and serialize/delay bring-up replay until the new local node is published through o2nm_this_node().
Event History
Frequently Asked Questions
What systems are exposed to this race?
Systems using OCFS2 heartbeat and o2net functionality are exposed during configfs local-node teardown when heartbeat callbacks remain registered. A node-down event during this teardown can reach o2net operations after the o2net workqueue is being destroyed.
How can I identify whether this issue has occurred?
KASAN may report a slab use-after-free in __queue_work(). The reported call path includes queue_delayed_work_on(), o2net_set_nn_state(), o2net_disconnect_node(), o2net_hb_node_down_cb(), and o2hb_run_event_list().