In the Linux kernel, the following vulnerability has been resolved:
exfat: fix potential deadlock on _exfatgetdentryset
When accessing a file with more entries than ESMAXENTRYNUM, the bh-array is allocated in _exfatgetentryset. The problem is that the bh-array is allocated with GFPKERNEL. It does not make sense. In the following cases, a deadlock for sbi->s_lock between the two processes may occur.
CPU0 CPU1
---- ----
kswapd balancepgdat lock(fsreclaim) exfatiterate lock(&sbi->slock) exfatreaddir exfatgetuninamefromextentry exfatgetdentryset _exfatgetdentryset kmallocarray ... lock(fsreclaim) ... evict exfatevictinode lock(&sbi->slock)
To fix this, let's allocate bh-array with GFP_NOFS.