CVE-2026-97521: gfs2: fix quota init duplicate scan
In the Linux kernel, the following vulnerability has been resolved:
gfs2: fix quota init duplicate scan
gfs2quotainit() checks for duplicate quotachange IDs while holding qdlock and the quota hash bucket bitlock. That path used gfs2qdsearchbucket(), which takes a lockref reference via lockrefgetnotdead().
On PREEMPTRT this may sleep, which is not allowed under the bucket bitlock, triggering "sleeping function called from invalid context".
Use a no-ref bucket lookup in this path, then continue duplicate handling without taking a lockref there.
Refactor gfs2qdsearchbucket() to build on top of the no-ref helper so lookup traversal stays in one place.
This patch fixes a bug reported by syzbot.
Affected Software
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
Systems using the GFS2 filesystem with PREEMPT_RT are the relevant environment. The problematic path is quota initialization while checking for duplicate quota_change IDs.
What symptom indicates that the vulnerable path has been triggered?
On PREEMPT_RT, the kernel may report "sleeping function called from invalid context." This occurs because a lockref reference acquisition can sleep while a quota hash bucket bitlock is held.
What change resolves the issue?
The fix uses a bucket lookup that does not acquire a lockref in the locked duplicate-check path. The referenced stable kernel commits contain the remediation.