Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
] lru_gen_shrink_node mm/vmscan.c:4957 [inline] shrink_node+0x3799/0x3de0 mm/vmscan.c:5937 kswapd_shrink_node mm/vmscan.c:6765 [inline] balance_pgdat mm/vmscan.c:6957 [inline] kswapd+0x1ca3/0x3700 mm/vmscan.c:7226 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 -> #1 (fs_reclaim){+.+.}-{0:0}: lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5825 __fs_reclaim_acquire mm/page_alloc.c:3834 [inline] fs_reclaim_acquire+0x88/0x130 mm/page_alloc.c:3848 might_alloc include/linux/sched/mm.h:318 [inline] prepare_alloc_pages+0x147/0x5b0 mm/page_alloc.c:4493 __alloc_pages_noprof+0x16f/0x710 mm/page_
x/sched/mm.h:318 [inline] prepare_alloc_pages+0x147/0x5b0 mm/page_alloc.c:4493 __alloc_pages_noprof+0x16f/0x710 mm/page_alloc.c:4722 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_pages_noprof mm/mempolicy.c:2345 [inline] folio_alloc_noprof+0x128/0x180 mm/mempolicy.c:2352 filemap_alloc_folio_noprof+0xdf/0x500 mm/filemap.c:1010 do_read_cache_folio+0x2eb/0x850 mm/filemap.c:3787 read_mapping_folio include/linux/pagemap.h:1011 [inline] f2fs_commit_super+0x3c0/0x7d0 fs/f2fs/super.c:4032 f2fs_record_stop_reason+0x13b/0x1d0 fs/f2fs/super.c:4079 f2fs_handle_critical_error+0x2ac/0x5c0 fs/f2fs/super.c:4174 f2fs_write_inode+0x35f/0x4d0 fs/f2fs/inode.c:785 write_inode fs/fs-writeback.c:15
error+0x2ac/0x5c0 fs/f2fs/super.c:4174 f2fs_write_inode+0x35f/0x4d0 fs/f2fs/inode.c:785 write_inode fs/fs-writeback.c:1503 [inline] __writeback_single_inode+0x711/0x10d0 fs/fs-writeback.c:1723 writeback_single_inode+0x1f3/0x660 fs/fs-writeback.c:1779 sync_inode_metadata+0xc4/0x120 fs/fs-writeback.c:2849 f2fs_release_file+0xa8/0x100 fs/f2fs/file.c:1941 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:228 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inlin
mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f ---truncated--- References: - https://git.kernel.org/stable/c/ecf4e6782b01fd578b565b3dd2be7bb0ac91082e - https://git.kernel.org/stable/c/1539a088b108996bcdaddb7775070b5163b14233 - https://git.kernel.org/stable/c/801092a2c9c251ef6a8678fcb8fcc1220474a697 - https://git.kernel.org/stable/c/f10a890308a7cd8794e21f646f09827c6cb4bf5d
CVE ID: CVE-2024-56745 State: PUBLISHED Published: 2024-12-29T11:30:12.434Z Last Updated: 2025-11-03T20:53:34.257Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reset_method_store() memory leak In reset_method_store(), a string is allocated via kstrndup() and assigned to the local "options". options is then used in with strsep() to find spaces: while ((name = strsep(&options, " ")) != NULL) { If there are no remaining spaces, then options is set to NULL by strsep(), so the subsequent kfree(options) doesn't free the memory allocated via kstrndup(). Fix by using a separate tmp_options to iterate with strsep() so options
oesn't free the memory allocated via kstrndup(). Fix by using a separate tmp_options to iterate with strsep() so options is preserved. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/403efb4457c0c8f8f51e904cc57d39193780c6bd - https://git.kernel.org/stable/c/931d07ccffcc3614f20aaf602b31e89754e21c59 - https://git.kernel.org/stable/c/8e098baf6bc3f3a6aefc383509aba07e202f7ee0 - https://git.kernel.org/stable/c/543d0eb40e45c6a51f1bff02f417b602e54472d5 - https://git.kernel.org/stable/c/fe6fae61f3b993160aef5fe2b7141a83872c144f - https://git.kernel.org/stable/c/2985b1844f3f3447f2d938eff1ef6762592065a5
CVE ID: CVE-2024-56746 State: PUBLISHED Published: 2024-12-29T11:30:13.074Z Last Updated: 2025-11-03T20:53:35.738Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() When information such as info->screen_base is not ready, calling sh7760fb_free_mem() does not release memory correctly. Call dma_free_coherent() instead. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0d3fb3b3e9d66f7b6346e3b90bc0ff48683539ce - https://git.kernel.org/stable/c/d48cbfa90dce506030151915fa3346d67f964af4 - https://git
9d66f7b6346e3b90bc0ff48683539ce - https://git.kernel.org/stable/c/d48cbfa90dce506030151915fa3346d67f964af4 - https://git.kernel.org/stable/c/29216bb390e36daeebef66abaa02d9751330252b - https://git.kernel.org/stable/c/f4fbd70e15fafe36a7583954ce189aaf5536aeec - https://git.kernel.org/stable/c/40f4326ed05a3b3537556ff2a844958b9e779a98 - https://git.kernel.org/stable/c/3dd9df8e5f34c6fc4217a7498c1fb3c352d4afc2 - https://git.kernel.org/stable/c/d10cd53e5a7fb3b7c6f83d4d9a5ea1d97a3ed9a5 - https://git.kernel.org/stable/c/bad37309c8b8bf1cfc893750df0951a804009ca0 - https://git.kernel.org/stable/c/f89d17ae2ac42931be2a0153fecbf8533280c927
CVE ID: CVE-2024-56747 State: PUBLISHED Published: 2024-12-29T11:30:13.739Z Last Updated: 2025-11-03T20:53:38.638Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() Hook "qedi_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4e48e5b26b3edc0e1dd329201ffc924a7a1f9337 - https://git.kernel.org/stable/c/ea
erences: - https://git.kernel.org/stable/c/4e48e5b26b3edc0e1dd329201ffc924a7a1f9337 - https://git.kernel.org/stable/c/eaf92fad1f21be63427920c12f22227e5f757424 - https://git.kernel.org/stable/c/a4d2011cbe039b25024831427b60ab91ee247066 - https://git.kernel.org/stable/c/bb8b45883eb072adba297922b67d1467082ac880 - https://git.kernel.org/stable/c/b778b5240485106abf665eb509cc01779ed0cb00 - https://git.kernel.org/stable/c/10a6fc486ac40a410f0fb84cc15161238eccd20a - https://git.kernel.org/stable/c/cfc76acaf2c4b43d1e140f1e4cbde15adb540bc5 - https://git.kernel.org/stable/c/20b775cf274cfbfa3da871a1108877e17b8b19e1 - https://git.kernel.org/stable/c/95bbdca4999bc59a72ebab01663d421d6ce5775d
CVE ID: CVE-2024-56748 State: PUBLISHED Published: 2024-12-29T11:30:14.378Z Last Updated: 2025-11-03T20:53:41.396Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() Hook "qed_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent() to free it. This is the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/97384449ddfc07f12ca75f510eb070020d7abb34 - https://git.kernel.org/stable/c/a56
rences: - https://git.kernel.org/stable/c/97384449ddfc07f12ca75f510eb070020d7abb34 - https://git.kernel.org/stable/c/a56777a3ef5b35e24a20c4418bcf88bad033807a - https://git.kernel.org/stable/c/64654bf5efb3f748e6fc41227adda689618ce9c4 - https://git.kernel.org/stable/c/b514f45e0fe18d763a1afc34401b1585333cb329 - https://git.kernel.org/stable/c/7c1832287b21ff68c4e3625e63cc7619edf5908b - https://git.kernel.org/stable/c/0e04bd5a11dffe8c1c0e4c9fc79f7d3cd6182dd5 - https://git.kernel.org/stable/c/78a169dc69fbdaf114c40e2d56955bf6bd4fc3c0 - https://git.kernel.org/stable/c/c62c30429db3eb4ced35c7fcf6f04a61ce3a01bb
CVE ID: CVE-2024-56749 State: PUBLISHED Published: 2024-12-29T11:30:15.127Z Last Updated: 2025-10-01T20:07:03.795Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dlm: fix dlm_recover_members refcount on error If dlm_recover_members() fails we don't drop the references of the previous created root_list that holds and keep all rsbs alive during the recovery. It might be not an unlikely event because ping_members() could run into an -EINTR if another recovery progress was triggered again. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3230718a75a6c30ed60ac920c26be2119fa82b8e - http
: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3230718a75a6c30ed60ac920c26be2119fa82b8e - https://git.kernel.org/stable/c/fb2ec564887af1f365d754f7c306f1b5cd375b5e - https://git.kernel.org/stable/c/200b977ebbc313a59174ba971006a231b3533dc5
CVE ID: CVE-2024-56750 State: PUBLISHED Published: 2024-12-29T11:30:16.053Z Last Updated: 2025-10-01T20:07:03.599Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: erofs: fix blksize < PAGE_SIZE for file-backed mounts Adjust sb->s_blocksize{,_bits} directly for file-backed mounts when the fs block size is smaller than PAGE_SIZE. Previously, EROFS used sb_set_blocksize(), which caused a panic if bdev-backed mounts is not used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/679d8537e5748241c71ac97a6b6dc919eae31716 - https://git.kernel.org/stable/c/bae0854160939a64a092516ff1b2f221402
/stable/c/679d8537e5748241c71ac97a6b6dc919eae31716 - https://git.kernel.org/stable/c/bae0854160939a64a092516ff1b2f221402b843b
CVE ID: CVE-2024-56751 State: PUBLISHED Published: 2024-12-29T11:30:16.805Z Last Updated: 2025-11-03T20:53:42.799Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: release nexthop on device removal The CI is hitting some aperiodic hangup at device removal time in the pmtu.sh self-test: unregister_netdevice: waiting for veth_A-R1 to become free. Usage count = 6 ref_tracker: veth_A-R1@ffff888013df15d8 has 1/5 users at dst_init+0x84/0x4a0 dst_alloc+0x97/0x150 ip6_dst_alloc+0x23/0x90 ip6_rt_pcpu_alloc+0x1e6/0x520 ip6_pol_route+0x56f/0x840 fib6_rule_lookup+0x334/0x630 ip6_route_output_flags+0x259/0x480 ip6_dst_lookup_tail.constp
520 ip6_pol_route+0x56f/0x840 fib6_rule_lookup+0x334/0x630 ip6_route_output_flags+0x259/0x480 ip6_dst_lookup_tail.constprop.0+0x5c2/0x940 ip6_dst_lookup_flow+0x88/0x190 udp_tunnel6_dst_lookup+0x2a7/0x4c0 vxlan_xmit_one+0xbde/0x4a50 [vxlan] vxlan_xmit+0x9ad/0xf20 [vxlan] dev_hard_start_xmit+0x10e/0x360 __dev_queue_xmit+0xf95/0x18c0 arp_solicit+0x4a2/0xe00 neigh_probe+0xaa/0xf0 While the first suspect is the dst_cache, explicitly tracking the dst owing the last device reference via probes proved such dst is held by the nexthop in the originating fib6_info. Similar to commit f5b51fe804ec ("ipv6: route: purge exception on removal"), we need to explicitly release the originating fib info when dis
5b51fe804ec ("ipv6: route: purge exception on removal"), we need to explicitly release the originating fib info when disconnecting a to-be-removed device from a live ipv6 dst: move the fib6_info cleanup into ip6_dst_ifdown(). Tested running: ./pmtu.sh cleanup_ipv6_exception in a tight loop for more than 400 iterations with no spat, running an unpatched kernel I observed a splat every ~10 iterations. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/77aa9855a878fb43f547ddfbda3127a1e88ad31a - https://git.kernel.org/stable/c/b2f26a27ea3f72f75d18330f76f5d1007c791848 - https://git.kernel.org/stable/c/43e25adc80269f917d2a195f0d59f74cdd182955 - https:/
a27ea3f72f75d18330f76f5d1007c791848 - https://git.kernel.org/stable/c/43e25adc80269f917d2a195f0d59f74cdd182955 - https://git.kernel.org/stable/c/a3c3f8a4d025acc8c857246ec2b812c59102487a - https://git.kernel.org/stable/c/0e4c6faaef8a24b762a24ffb767280e263ef8e10 - https://git.kernel.org/stable/c/eb02688c5c45c3e7af7e71f036a7144f5639cbfe
CVE ID: CVE-2024-56752 State: PUBLISHED Published: 2024-12-29T11:30:17.555Z Last Updated: 2025-10-01T20:07:03.440Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gr/gf100: Fix missing unlock in gf100_gr_chan_new() When the call to gf100_grctx_generate() fails, unlock gr->fecs.mutex before returning the error. Fixes smatch warning: drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c:480 gf100_gr_chan_new() warn: inconsistent returns '&gr->fecs.mutex'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/237f2dbfa00576bb1aa8dc2dce403c64e53270e6 - https://git.kernel.org/stable/c/2
ferences: - https://git.kernel.org/stable/c/237f2dbfa00576bb1aa8dc2dce403c64e53270e6 - https://git.kernel.org/stable/c/22b4a623c0f230540f02f4358744cce62ae12dbf - https://git.kernel.org/stable/c/24b1df744ef444f9846f52de4985790a5fd1c0de - https://git.kernel.org/stable/c/a2f599046c671d6b46d93aed95b37241ce4504cf
CVE ID: CVE-2024-56753 State: PUBLISHED Published: 2024-12-29T11:30:18.291Z Last Updated: 2025-10-01T20:07:03.196Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9: Add Cleaner Shader Deinitialization in gfx_v9_0 Module This commit addresses an omission in the previous patch related to the cleaner shader support for GFX9 hardware. Specifically, it adds the necessary deinitialization code for the cleaner shader in the gfx_v9_0_sw_fini function. The added line amdgpu_gfx_cleaner_shader_sw_fini(adev); ensures that any allocated resources for the cleaner shader are freed correctly, avoiding potential memory leaks and
); ensures that any allocated resources for the cleaner shader are freed correctly, avoiding potential memory leaks and ensuring that the GPU state is clean for the next initialization sequence. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/720c0376b3d29cbab921a60062fda5980742ed9d - https://git.kernel.org/stable/c/e47cb9d2533200d49dd5364d4a148119492f8a3d
CVE ID: CVE-2024-56754 State: PUBLISHED Published: 2024-12-29T11:30:19.049Z Last Updated: 2025-11-03T20:53:45.637Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: crypto: caam - Fix the pointer passed to caam_qi_shutdown() The type of the last parameter given to devm_add_action_or_reset() is "struct caam_drv_private *", but in caam_qi_shutdown(), it is casted to "struct device *". Pass the correct parameter to devm_add_action_or_reset() so that the resources are released as expected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cc386170b3312fd7b5bc4a69a
CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cc386170b3312fd7b5bc4a69a9f52d7f50814526 - https://git.kernel.org/stable/c/6187727e57aec122c8a99c464c74578c810cbe40 - https://git.kernel.org/stable/c/66eddb8dcb61065c53098510165f14b54232bcc2 - https://git.kernel.org/stable/c/1f8e2f597b918ca5827a5c6d00b819d064264d1c - https://git.kernel.org/stable/c/84a185aea7b83f620699de0ea36907d588d89cf6 - https://git.kernel.org/stable/c/ad39df0898d3f469776c19d99229be055cc2dcea - https://git.kernel.org/stable/c/ad980b04f51f7fb503530bd1cb328ba5e75a250e
CVE ID: CVE-2024-56755 State: PUBLISHED Published: 2024-12-29T11:30:19.795Z Last Updated: 2025-11-03T20:53:47.041Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfs/fscache: Add a memory barrier for FSCACHE_VOLUME_CREATING In fscache_create_volume(), there is a missing memory barrier between the bit-clearing operation and the wake-up operation. This may cause a situation where, after a wake-up, the bit-clearing operation hasn't been detected yet, leading to an indefinite wait. The triggering process is as follows: [cookie1] [cookie2] [volume_work] fscache_perform_lookup fscache_create_volume fscache_perform_lookup fscache_cr
ollows: [cookie1] [cookie2] [volume_work] fscache_perform_lookup fscache_create_volume fscache_perform_lookup fscache_create_volume fscache_create_volume_work cachefiles_acquire_volume clear_and_wake_up_bit test_and_set_bit test_and_set_bit goto maybe_wait goto no_wait In the above process, cookie1 and cookie2 has the same volume. When cookie1 enters the -no_wait- process, it will clear the bit and wake up the waiting process. If a barrier is missing, it may cause cookie2 to remain in the -wait- process indefinitely. In commit 3288666c7256 ("fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()"), barriers were added to similar operations in fscache_create_volume_work(), but f
it() in fscache_create_volume_work()"), barriers were added to similar operations in fscache_create_volume_work(), but fscache_create_volume() was missed. By combining the clear and wake operations into clear_and_wake_up_bit() to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ddab02607eed9e415dc62fde421d4329e5345315 - https://git.kernel.org/stable/c/539fabba965e119b98066fc6ba5257b5eaf4eda2 - https://git.kernel.org/stable/c/8beb682cc9a0798a280bbb95e3e41617237090b2 - https://git.kernel.org/stable/c/8cc1df3113cb71a0df2c46dd5b102c9e11c8a8c6 - https://git.kernel.org/stable/c/22f9400a6f3560629478e0a64247b8fc
org/stable/c/8cc1df3113cb71a0df2c46dd5b102c9e11c8a8c6 - https://git.kernel.org/stable/c/22f9400a6f3560629478e0a64247b8fcc811a24d
CVE ID: CVE-2024-56756 State: PUBLISHED Published: 2024-12-29T11:30:20.516Z Last Updated: 2025-11-03T20:53:49.848Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix freeing of the HMB descriptor table The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could break out of the loop earlier on memory allocation failure and end up using less descriptors than planned for, which leads to an incorrect size passed to dma_free_coherent. In practice this was not showing up because the number of descriptors tends to be low and the dma coherent a
e_coherent. In practice this was not showing up because the number of descriptors tends to be low and the dma coherent allocator always allocates and frees at least a page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/ac22240540e0c5230d8c4138e3778420b712716a - https://git.kernel.org/stable/c/452f9ddd12bebc04cef741e8ba3806bf0e1fd015 - https://git.kernel.org/stable/c/869cf50b9c9d1059f5223f79ef68fc0bc6210095 - https://git.kernel.org/stable/c/fb96d5cfa97a7363245b3dd523f475b04296d87b - https://git.kernel.org/stable/c/cee3bff51a35cab1c5d842d409a7b11caefe2386 - https://git.kernel.org/stable/c/6d0f599db73b099aa724a12736369c
l.org/stable/c/cee3bff51a35cab1c5d842d409a7b11caefe2386 - https://git.kernel.org/stable/c/6d0f599db73b099aa724a12736369c4d4d92849d - https://git.kernel.org/stable/c/582d9ed999b004fb1d415ecbfa86d4d8df455269 - https://git.kernel.org/stable/c/3c2fb1ca8086eb139b2a551358137525ae8e0d7a
CVE ID: CVE-2024-56757 State: PUBLISHED Published: 2025-01-06T16:20:38.228Z Last Updated: 2025-10-01T20:07:01.318Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect MediaTek claim an special usb intr interface for ISO data transmission. The interface need to be released before unregistering hci device when usb disconnect. Removing BT usb dongle without properly releasing the interface may cause Kernel panic while unregister hci device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/cc569d791ab2a0de74f76e470515d25
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/cc569d791ab2a0de74f76e470515d25d24c9b84b - https://git.kernel.org/stable/c/489304e67087abddc2666c5af0159cb95afdcf59
CVE ID: CVE-2024-56758 State: PUBLISHED Published: 2025-01-06T16:20:38.942Z Last Updated: 2025-11-03T17:31:25.624Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocate_one_folio() When we call btrfs_read_folio() to bring a folio uptodate, we unlock the folio. The result of that is that a different thread can modify the mapping (like remove it with invalidate) before we call folio_lock(). This results in an invalid page and we need to try again. In particular, if we are relocating concurrently with aborting a transaction, this can result in a crash like the following: BUG: kernel NUL
are relocating concurrently with aborting a transaction, this can result in a crash like the following: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 76 PID: 1411631 Comm: kworker/u322:5 Workqueue: events_unbound btrfs_reclaim_bgs_work RIP: 0010:set_page_extent_mapped+0x20/0xb0 RSP: 0018:ffffc900516a7be8 EFLAGS: 00010246 RAX: ffffea009e851d08 RBX: ffffea009e0b1880 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffc900516a7b90 RDI: ffffea009e0b1880 RBP: 0000000003573000 R08: 0000000000000001 R09: ffff88c07fd2f3f0 R10: 0000000000000000 R11: 0000194754b575be R12: 0000000003572000 R13: 0000000003572fff R14: 0000000000100cca R15: 00000000
: 0000000000000000 R11: 0000194754b575be R12: 0000000003572000 R13: 0000000003572fff R14: 0000000000100cca R15: 0000000005582fff FS: 0000000000000000(0000) GS:ffff88c07fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000407d00f002 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die+0x78/0xc0 ? page_fault_oops+0x2a8/0x3a0 ? __switch_to+0x133/0x530 ? wq_worker_running+0xa/0x40 ? exc_page_fault+0x63/0x130 ? asm_exc_page_fault+0x22/0x30 ? set_page_extent_mapped+0x20/0xb0 relocate_file_ext
0xa/0x40 ? exc_page_fault+0x63/0x130 ? asm_exc_page_fault+0x22/0x30 ? set_page_extent_mapped+0x20/0xb0 relocate_file_extent_cluster+0x1a7/0x940 relocate_data_extent+0xaf/0x120 relocate_block_group+0x20f/0x480 btrfs_relocate_block_group+0x152/0x320 btrfs_relocate_chunk+0x3d/0x120 btrfs_reclaim_bgs_work+0x2ae/0x4e0 process_scheduled_works+0x184/0x370 worker_thread+0xc6/0x3e0 ? blk_add_timer+0xb0/0xb0 kthread+0xae/0xe0 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork+0x2f/0x40 ? flush_tlb_kernel_range+0x90/0x90 ret_from_fork_asm+0x11/0x20 </TASK> This occurs because cleanup_one_transaction() calls destroy_delalloc_inodes() which calls invalidate_inode_pages2() which takes the folio_lock before
e_transaction() calls destroy_delalloc_inodes() which calls invalidate_inode_pages2() which takes the folio_lock before setting mapping to NULL. We fail to check this, and subsequently call set_extent_mapping(), which assumes that mapping != NULL (in fact it asserts that in debug mode) Note that the "fixes" patch here is not the one that introduced the race (the very first iteration of this code from 2009) but a more recent change that made this particular crash happen in practice. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/36679fab54fa7bcffafd469e2c474c1fc4beaee0 - https://git.kernel.org/stable/c/c7b1bd52a031ad0144d42eef0ba8471ce75122dd
e/c/36679fab54fa7bcffafd469e2c474c1fc4beaee0 - https://git.kernel.org/stable/c/c7b1bd52a031ad0144d42eef0ba8471ce75122dd - https://git.kernel.org/stable/c/d508e56270389b3a16f5b3cf247f4eb1bbad1578 - https://git.kernel.org/stable/c/3e74859ee35edc33a022c3f3971df066ea0ca6b9