CVE-2023-54311

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix deadlock when converting an inline directory in nojournal mode

In no journal mode, ext4_finish_convert_inline_dir() can self-deadlock by calling ext4_handle_dirty_dirblock() when it already has taken the directory lock. There is a similar self-deadlock in ext4_incvert_inline_data_nolock() for data files which we'll fix at the same time.

A simple reproducer demonstrating the problem:

mke2fs -Fq -t ext2 -O inline_data -b 4k /dev/vdc 64
mount -t ext4 -o dirsync /dev/vdc /vdc
cd /vdc
mkdir file0
cd file0
touch file0
touch file1
attr -s BurnSpaceInEA -V abcde .
touch supercalifragilisticexpialidocious

A local denial of service can occur in ext4 when converting inline directories or inline data in nojournal mode because ext4_finish_convert_inline_dir and related helpers can self deadlock. The code called ext4_handle_dirty_dirblock or ext4_handle_dirty_metadata while still holding the buffer lock, which can lead to a lock inversion against itself and cause tasks to hang. For the CVSS the PR is N in the paranoid scenario because once an ext4 filesystem is mounted with inline_data enabled an unprivileged user can trigger the conversion path using normal file operations and extended attributes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.