CVE-2026-31598

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix possible deadlock between unlink and dio_end_io_write

ocfs2_unlink takes orphan dir inode_lock first and then ip_alloc_sem,

while in ocfs2_dio_end_io_write, it acquires these locks in reverse order.

This creates an ABBA lock ordering violation on lock classes

ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE] and

ocfs2_file_ip_alloc_sem_key.

Lock Chain #0 (orphan dir inode_lock -> ip_alloc_sem):

ocfs2_unlink

ocfs2_prepare_orphan_dir

ocfs2_lookup_lock_orphan_dir

inode_lock(orphan_dir_inode) <- lock A

__ocfs2_prepare_orphan_dir

ocfs2_prepare_dir_for_insert

ocfs2_extend_dir

ocfs2_expand_inline_dir

down_write(&oi->ip_alloc_sem) <- Lock B

Lock Chain #1 (ip_alloc_sem -> orphan dir inode_lock):

ocfs2_dio_end_io_write

down_write(&oi->ip_alloc_sem) <- Lock B

ocfs2_del_inode_from_orphan()

inode_lock(orphan_dir_inode) <- Lock A

Deadlock Scenario:

CPU0 (unlink) CPU1 (dio_end_io_write)

------ ------

inode_lock(orphan_dir_inode)

down_write(ip_alloc_sem)

down_write(ip_alloc_sem)

inode_lock(orphan_dir_inode)

Since ip_alloc_sem is to protect allocation changes, which is unrelated

with operations in ocfs2_del_inode_from_orphan. So move

ocfs2_del_inode_from_orphan out of ip_alloc_sem to fix the deadlock.