CVE-2026-93252

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ocfs2: fix circular locking dependency in ocfs2_init_acl()<br /> <br /> A lockdep warning indicates a circular locking dependency between<br /> `&amp;oi-&gt;ip_xattr_sem` and `&amp;journal-&gt;j_trans_barrier`:<br /> <br /> WARNING: possible circular locking dependency detected<br /> is trying to acquire lock:<br /> (&amp;oi-&gt;ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0<br /> fs/ocfs2/acl.c:367<br /> <br /> but task is already holding lock:<br /> (&amp;journal-&gt;j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700<br /> fs/ocfs2/journal.c:369<br /> <br /> The deadlock involves two code paths: Path 1 (setxattr) where<br /> `ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a<br /> transaction, which acquires `j_trans_barrier` (read); and Path 2<br /> (mkdir/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier`<br /> read) and then calls `ocfs2_init_acl()`, which attempts to acquire<br /> `ip_xattr_sem` (read) on the parent directory to retrieve the default ACL.<br /> <br /> Because rw_semaphores are subject to writer priority, a pending writer on<br /> `j_trans_barrier` (e.g., the journal commit thread) can cause Path 1 to<br /> block, while Path 2 is blocked waiting for Path 1 to release<br /> `ip_xattr_sem`.<br /> <br /> The patch fixes the lock ordering by precomputing the ACL state before<br /> starting the OCFS2 transaction, while preserving POSIX ACL storage<br /> semantics and the existing inode/security initialization order. By reading<br /> the parent directory&amp;#39;s default ACL and preparing the new inode&amp;#39;s ACLs<br /> outside the transaction, `ip_xattr_sem` is always acquired before<br /> `j_trans_barrier`.<br /> <br /> `struct ocfs2_acl_state` encapsulates the prepared ACL state, while<br /> `ocfs2_acl_init_prepare()` and `ocfs2_acl_init_release()` avoid code<br /> duplication between `ocfs2_mknod()` and `ocfs2_init_security_and_acl()`.<br /> `ocfs2_calc_xattr_init()` and `ocfs2_init_acl()` use this precomputed<br /> state, removing internal `ip_xattr_sem` acquisition and redundant disk<br /> reads.<br /> <br /> Additionally, remove the `ip_xattr_sem` acquisition from<br /> `ocfs2_xattr_set_handle()`. This function is only used while initializing a<br /> new inode that has not yet been inserted into the inode hash or attached to<br /> a dentry, meaning there is no risk of concurrent access and the lock is<br /> unnecessary.