Executive brief
A vulnerability in the Linux kernel's EXT4 file system could allow a local user to cause a system deadlock, leading to a denial of service. This occurs when specific file migration operations conflict with standard file writing tasks. While the issue primarily affects systems with specific debug locking features enabled, it can result in the system becoming unresponsive.
Technical details
A deadlock vulnerability exists in the ext4_ind_migrate() function of the Linux kernel's EXT4 file system. The issue is rooted in an incorrect unlock order of i_data_sem relative to the journal handle stop operation. When a file is opened with O_SYNC and the EXT4_IOC_MIGRATE ioctl is invoked, jbd2_journal_stop() may call jbd2_might_wait_for_commit() while still holding i_data_sem. If this races with a write(2) system call, a deadlock can occur, particularly on kernels compiled with CONFIG_PROVE_LOCKING. Attackers with local access can trigger this by performing specific ioctl operations on files opened in synchronous mode. Patches have been released across multiple stable kernel branches to reorder the unlocking sequence.
Affected products
- Linux Linux Kernel up to 5.10.227, 5.11 to 5.15.168, 5.16 to 6.1.113, 6.2 to 6.6.55, 6.7 to 6.10.14, 6.11 to 6.11.3
Timeline
- 2024-10-21: disclosed
- 2024-10-21: advisory
- 2024-10-17: patched: Patch committed to stable branches
References
- https://git.kernel.org/stable/c/3c46d6060d3e38de22196c1fe7706c5a3c696285
- https://git.kernel.org/stable/c/4192adefc9c570698821c5eb9873320eac2fcbf1
- https://git.kernel.org/stable/c/53b1999cfd2c7addf2e581a32865fe8835467b44
- https://git.kernel.org/stable/c/6252cb6bde7fc76cb8dcb49d1def7c326b190820
- https://git.kernel.org/stable/c/9fedf51ab8cf7b69bff08f37fe0989fec7f5d870
- https://git.kernel.org/stable/c/cc749e61c011c255d81b192a822db650c68b313f
- https://git.kernel.org/stable/c/d43776b907659affef1de888525847d64b244194