CVE-2021-47493

What it actually does

Race condition in ocfs2_test_bg_bit_allocatable allows jbd2_journal_put_journal_head to release the journal_head from a buffer_head while ocfs2_block_group_find_clear_bits dereferences it, producing a NULL pointer and kernel page fault.

Why it matters to the business

Systems using the OCFS2 cluster file system can experience unexpected kernel crashes and reboots during write or reflink operations, causing service interruption and potential data unavailability until the node recovers.

How an attack unfolds

An attacker with local access or the ability to trigger OCFS2 cluster allocation repeatedly performs write or copy-on-write operations that concurrently invoke ocfs2_claim_clusters and buffer-head journal-head release paths, winning the race to trigger the NULL dereference and panic.

How to fix it

Apply the upstream fix that acquires the BH_JournalHead bit lock before accessing the journal head in ocfs2_test_bg_bit_allocatable; update to a kernel containing commit resolving CVE-2021-47493.

How to confirm the fix worked

Confirm the patched kernel source contains the BH_JournalHead bit-lock acquisition around bh2jh calls in ocfs2_block_group_find_clear_bits; recompile, boot, and exercise ocfs2 write/reflink workloads while monitoring for the previous oops signature.

Typical attack path

1. Mount an OCFS2 volume and perform repeated file writes or reflinks
2. Trigger concurrent cluster allocation via ocfs2_reserve_clusters and ocfs2_make_clusters_writable
3. Force jbd2_journal_put_journal_head to clear bg_bh->b_private during ocfs2_test_bg_bit_allocatable
4. Execute ocfs2_block_group_find_clear_bits on the now-NULL journal head
5. Cause page fault and kernel panic

How to detect it

Search kernel logs and vmcores for the call trace containing ocfs2_block_group_find_clear_bits, ocfs2_cluster_group_search and page_fault originating from OCFS2 allocation paths; correlate with processes performing OCFS2 writes or reflinks around the crash time.

What your security team should do

• Prioritize kernel updates on all nodes running OCFS2 workloads
• Restrict local user access to OCFS2 mounts until patched
• Monitor kernel logs for ocfs2_block_group_find_clear_bits page-fault oops patterns
• Test patched kernels in staging OCFS2 clusters before production rollout