Executive Summary

This vulnerability is a deadlock issue in the Linux kernel's NTFS3 filesystem driver, specifically in the function ni_read_folio_cmpr (previously named ni_readpage_cmpr).

The deadlock occurs due to a lock inversion between the inode mutex (ni_lock) and page locks. In a scenario where two tasks try to access compressed pages, one task holds the inode lock and waits for a page lock held by the other task, while the second task holds the page lock and waits for the inode lock held by the first task, causing both tasks to hang indefinitely.

The fix involved changing the locking order: instead of acquiring the inode lock first, the code now acquires all necessary page locks before acquiring the inode lock, restoring the correct lock order and preventing the deadlock.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause tasks accessing compressed NTFS filesystem pages to hang indefinitely due to a deadlock, leading to system instability or unresponsiveness.

Such deadlocks can degrade system performance, potentially causing applications or services relying on NTFS filesystem access to freeze or fail.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a deadlock in the Linux kernel's ntfs3 filesystem driver caused by lock inversion between the inode mutex and page locks.

Detection would typically involve monitoring for hung or stuck tasks related to ntfs3 operations, especially those involving compressed file reads.

Since the issue manifests as a deadlock, you can look for kernel logs indicating hung tasks or use debugging tools to identify tasks stuck in ntfs_read_folio_cmpr or related functions.

• Check kernel logs for hung task messages: `dmesg | grep -i hung` or `journalctl -k | grep -i hung`
• Use `ps` or `top` to identify processes stuck in uninterruptible sleep (D state), which may indicate deadlock.
• Use kernel debugging tools like `perf`, `ftrace`, or `lockdep` to trace lock dependencies and detect lock inversions.
• Examine stack traces of hung tasks using `echo t > /proc/sysrq-trigger` and check `dmesg` output for tasks stuck in ntfs_read_folio_cmpr.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by restructuring the locking order in the ntfs3 driver to avoid deadlocks.

Immediate mitigation steps include updating the Linux kernel to a version that contains the fix for this issue.

Until the kernel is updated, avoid heavy or concurrent access patterns to compressed files on ntfs3 filesystems that might trigger the deadlock.

Monitor system logs for signs of deadlocks and consider rebooting the system if a deadlock occurs to restore normal operation.

Useful 0 Not Useful 0