In the Linux kernel, the following vulnerability has been resolved:
quota: fix livelock between quotactl and freeze_super
When a filesystem is frozen, quotactl_block() enters a retry loop waiting for the filesystem to thaw. It acquires s_umount, checks the freeze state, drops s_umount and uses sb_start_write() - sb_end_write() pair to wait for the unfreeze.
However, this retry loop can trigger a livelock issue, specifically on kernels with preemption disabled.
The mechanism is as follows:
- freeze_super() sets SB_FREEZE_WRITE and calls sb_wait_write().
- sb_wait_write() calls percpu_down_write(), which initiates
- Simultaneously, quotactl_block() spins in its retry loop, immediately
- Because the kernel is non-preemptible and the loop contains no
- synchronize_rcu() in the freezer thread waits indefinitely for the
- quotactl_block() spins indefinitely waiting for the freezer to
This results in a hang of the freezer process and 100% CPU usage by the quota process.
While this can occur intermittently on multi-core systems, it is reliably reproducing on a node with the following script, running both the freezer and the quota toggle on the same CPU:
# mkfs.ext4 -O quota /dev/sda 2g && mkdir a_mount # mount /dev/sda -o quota,usrquota,grpquota a_mount # taskset -c 3 bash -c "while true; do xfs_freeze -f a_mount; \ xfs_freeze -u a_mount; done" & # taskset -c 3 bash -c "while true; do quotaon a_mount; \ quotaoff a_mount; done" &
Adding cond_resched() to the retry loop fixes the issue. It acts as an RCU quiescent state, allowing synchronize_rcu() in percpu_down_write() to complete.