CVE-2021-47493

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix race between searching chunks and release journal_head from buffer_head

Encountered a race between ocfs2_test_bg_bit_allocatable() and

jbd2_journal_put_journal_head() resulting in the below vmcore.

PID: 106879 TASK: ffff880244ba9c00 CPU: 2 COMMAND: "loop3"

Call trace:

panic

oops_end

no_context

__bad_area_nosemaphore

bad_area_nosemaphore

__do_page_fault

do_page_fault

page_fault

[exception RIP: ocfs2_block_group_find_clear_bits+316]

ocfs2_block_group_find_clear_bits [ocfs2]

ocfs2_cluster_group_search [ocfs2]

ocfs2_search_chain [ocfs2]

ocfs2_claim_suballoc_bits [ocfs2]

__ocfs2_claim_clusters [ocfs2]

ocfs2_claim_clusters [ocfs2]

ocfs2_local_alloc_slide_window [ocfs2]

ocfs2_reserve_local_alloc_bits [ocfs2]

ocfs2_reserve_clusters_with_limit [ocfs2]

ocfs2_reserve_clusters [ocfs2]

ocfs2_lock_refcount_allocators [ocfs2]

ocfs2_make_clusters_writable [ocfs2]

ocfs2_replace_cow [ocfs2]

ocfs2_refcount_cow [ocfs2]

ocfs2_file_write_iter [ocfs2]

lo_rw_aio

loop_queue_work

kthread_worker_fn

kthread

ret_from_fork

When ocfs2_test_bg_bit_allocatable() called bh2jh(bg_bh), the

bg_bh->b_private NULL as jbd2_journal_put_journal_head() raced and

released the jounal head from the buffer head. Needed to take bit lock

for the bit 'BH_JournalHead' to fix this race.