Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
96352, 65536) = 0 v1: https://www.spinics.net/lists/linux-fsdevel/msg193999.html v2: https://lore.kernel.org/linux-fsdevel/20210525093034.GB4112@quack2.suse.cz/T/ Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/624fa7baa3788dc9e57840ba5b94bc22b03cda57 - https://git.kernel.org/stable/c/33e03adafb29eedae1bae9cdb50c1385279fcf65 - https://git.kernel.org/stable/c/a1700479524bb9cb5e8ae720236a6fabd003acae - https://git.kernel.org/stable/c/cec4e857ffaa8c447f51cd8ab4e72350077b6770 - https://git.kernel.org/stable/c/cc2edb99ea606a45182b5ea38cc8f4e583aa0774 - https://git.kernel.org/stable/c/c8d5faee46242c3f33b8a71a4d7d52214785bfcc
le/c/cc2edb99ea606a45182b5ea38cc8f4e583aa0774 - https://git.kernel.org/stable/c/c8d5faee46242c3f33b8a71a4d7d52214785bfcc - https://git.kernel.org/stable/c/0a31dd6fd2f4e7db538fb6eb1f06973d81f8dd3b - https://git.kernel.org/stable/c/6bba4471f0cc1296fe3c2089b9e52442d3074b2e
CVE ID: CVE-2021-47115 State: REJECTED Published: 2024-03-15T20:14:22.839Z Last Updated: 2024-03-18T10:33:22.634Z Description: No description available.
CVE ID: CVE-2021-47116 State: PUBLISHED Published: 2024-03-15T20:14:23.564Z Last Updated: 2025-05-04T07:04:28.065Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in ext4_mb_init_backend on error path. Fix a memory leak discovered by syzbot when a file system is corrupted with an illegally large s_log_groups_per_flex. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2050c6e5b161e5e25ce3c420fef58b24fa388a49 - https://git.kernel.org/stable/c/04fb2baa0b147f51db065a1b13a11954abe592d0 - https://git.kernel.org/stable/c/a8867f4e3809050571c98d
it.kernel.org/stable/c/04fb2baa0b147f51db065a1b13a11954abe592d0 - https://git.kernel.org/stable/c/a8867f4e3809050571c98de7a2d465aff5e4daf5
CVE ID: CVE-2021-47117 State: PUBLISHED Published: 2024-03-15T20:14:24.291Z Last Updated: 2025-05-04T07:04:29.104Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failed We got follow bug_on when run fsstress with injecting IO fault: [130747.323114] kernel BUG at fs/ext4/extents_status.c:762! [130747.323117] Internal error: Oops - BUG: 0 [#1] SMP ...... [130747.334329] Call trace: [130747.334553] ext4_es_cache_extent+0x150/0x168 [ext4] [130747.334975] ext4_cache_extents+0x64/0xe8 [ext4] [130747.335368] ext4_find_extent+0x300/0x330 [ext4] [130747.335759] ext4_ext_ma
975] ext4_cache_extents+0x64/0xe8 [ext4] [130747.335368] ext4_find_extent+0x300/0x330 [ext4] [130747.335759] ext4_ext_map_blocks+0x74/0x1178 [ext4] [130747.336179] ext4_map_blocks+0x2f4/0x5f0 [ext4] [130747.336567] ext4_mpage_readpages+0x4a8/0x7a8 [ext4] [130747.336995] ext4_readpage+0x54/0x100 [ext4] [130747.337359] generic_file_buffered_read+0x410/0xae8 [130747.337767] generic_file_read_iter+0x114/0x190 [130747.338152] ext4_file_read_iter+0x5c/0x140 [ext4] [130747.338556] __vfs_read+0x11c/0x188 [130747.338851] vfs_read+0x94/0x150 [130747.339110] ksys_read+0x74/0xf0 This patch's modification is according to Jan Kara's suggestion in: https://patchwork.ozlabs.org/project/linux-ext4/patch/2021
atch's modification is according to Jan Kara's suggestion in: https://patchwork.ozlabs.org/project/linux-ext4/patch/20210428085158.3728201-1-yebin10@huawei.com/ "I see. Now I understand your patch. Honestly, seeing how fragile is trying to fix extent tree after split has failed in the middle, I would probably go even further and make sure we fix the tree properly in case of ENOSPC and EDQUOT (those are easily user triggerable). Anything else indicates a HW problem or fs corruption so I'd rather leave the extent tree as is and don't try to fix it (which also means we will not create overlapping extents)." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
t create overlapping extents)." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e33bafad30d34cfa5e9787cb099cab05e2677fcb - https://git.kernel.org/stable/c/5b3a9a2be59478b013a430ac57b0f3d65471b071 - https://git.kernel.org/stable/c/d8116743ef5432336289256b2f7c117299213eb9 - https://git.kernel.org/stable/c/569496aa3776eea1ff0d49d0174ac1b7e861e107 - https://git.kernel.org/stable/c/920697b004e49cb026e2e15fe91be065bf0741b7 - https://git.kernel.org/stable/c/d3b668b96ad3192c0581a248ae2f596cd054792a - https://git.kernel.org/stable/c/48105dc98c9ca35af418746277b087cb2bc6df7c - https://git.kernel.org/stable/c/082cd4ec240b8734a82a8
git.kernel.org/stable/c/48105dc98c9ca35af418746277b087cb2bc6df7c - https://git.kernel.org/stable/c/082cd4ec240b8734a82a89ffb890216ac98fec68
CVE ID: CVE-2021-47118 State: PUBLISHED Published: 2024-03-15T20:14:25.116Z Last Updated: 2025-05-04T07:04:30.329Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: pid: take a reference when initializing `cad_pid` During boot, kernel_init_freeable() initializes `cad_pid` to the init task's struct pid. Later on, we may change `cad_pid` via a sysctl, and when this happens proc_do_cad_pid() will increment the refcount on the new pid via get_pid(), and will decrement the refcount on the old pid via put_pid(). As we never called get_pid() when we initialized `cad_pid`, we decrement a reference we never incremented, can therefore free
never called get_pid() when we initialized `cad_pid`, we decrement a reference we never incremented, can therefore free the init task's struct pid early. As there can be dangling references to the struct pid, we can later encounter a use-after-free (e.g. when delivering signals). This was spotted when fuzzing v5.13-rc3 with Syzkaller, but seems to have been around since the conversion of `cad_pid` to struct pid in commit 9ec52099e4b8 ("[PATCH] replace cad_pid by a struct pid") from the pre-KASAN stone age of v2.6.19. Fix this by getting a reference to the init task's struct pid when we assign it to `cad_pid`. Full KASAN splat below. ===========================================================
pid when we assign it to `cad_pid`. Full KASAN splat below. ================================================================== BUG: KASAN: use-after-free in ns_of_pid include/linux/pid.h:153 [inline] BUG: KASAN: use-after-free in task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 Read of size 4 at addr ffff23794dda0004 by task syz-executor.0/273 CPU: 1 PID: 273 Comm: syz-executor.0 Not tainted 5.12.0-00001-g9aef892b2d15 #1 Hardware name: linux,dummy-virt (DT) Call trace: ns_of_pid include/linux/pid.h:153 [inline] task_active_pid_ns+0xc0/0xc8 kernel/pid.c:509 do_notify_parent+0x308/0xe60 kernel/signal.c:1950 exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_e
308/0xe60 kernel/signal.c:1950 exit_notify kernel/exit.c:682 [inline] do_exit+0x2334/0x2bd0 kernel/exit.c:845 do_group_exit+0x108/0x2c8 kernel/exit.c:922 get_signal+0x4e4/0x2a88 kernel/signal.c:2781 do_signal arch/arm64/kernel/signal.c:882 [inline] do_notify_resume+0x300/0x970 arch/arm64/kernel/signal.c:936 work_pending+0xc/0x2dc Allocated by task 0: slab_post_alloc_hook+0x50/0x5c0 mm/slab.h:516 slab_alloc_node mm/slub.c:2907 [inline] slab_alloc mm/slub.c:2915 [inline] kmem_cache_alloc+0x1f4/0x4c0 mm/slub.c:2920 alloc_pid+0xdc/0xc00 kernel/pid.c:180 copy_process+0x2794/0x5e18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500 kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init
18 kernel/fork.c:2129 kernel_clone+0x194/0x13c8 kernel/fork.c:2500 kernel_thread+0xd4/0x110 kernel/fork.c:2552 rest_init+0x44/0x4a0 init/main.c:687 arch_call_rest_init+0x1c/0x28 start_kernel+0x520/0x554 init/main.c:1064 0x0 Freed by task 270: slab_free_hook mm/slub.c:1562 [inline] slab_free_freelist_hook+0x98/0x260 mm/slub.c:1600 slab_free mm/slub.c:3161 [inline] kmem_cache_free+0x224/0x8e0 mm/slub.c:3177 put_pid.part.4+0xe0/0x1a8 kernel/pid.c:114 put_pid+0x30/0x48 kernel/pid.c:109 proc_do_cad_pid+0x190/0x1b0 kernel/sysctl.c:1401 proc_sys_call_handler+0x338/0x4b0 fs/proc/proc_sysctl.c:591 proc_sys_write+0x34/0x48 fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_
oc_sysctl.c:591 proc_sys_write+0x34/0x48 fs/proc/proc_sysctl.c:617 call_write_iter include/linux/fs.h:1977 [inline] new_sync_write+0x3ac/0x510 fs/read_write.c:518 vfs_write fs/read_write.c:605 [inline] vfs_write+0x9c4/0x1018 fs/read_write.c:585 ksys_write+0x124/0x240 fs/read_write.c:658 __do_sys_write fs/read_write.c:670 [inline] __se_sys_write fs/read_write.c:667 [inline] __arm64_sys_write+0x78/0xb0 fs/read_write.c:667 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline] el0_svc_common.constprop.1+0x16c/0x388 arch/arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150 arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/ent
arm64/kernel/syscall.c:129 do_el0_svc+0xf8/0x150 arch/arm64/kernel/syscall.c:168 el0_svc+0x28/0x38 arch/arm64/kernel/entry-common.c:416 el0_sync_handler+0x134/0x180 arch/arm64/kernel/entry-common.c:432 el0_sync+0x154/0x180 arch/arm64/kernel/entry.S:701 The buggy address belongs to the object at ffff23794dda0000 which belongs to the cache pid of size 224 The buggy address is located 4 bytes inside of 224-byte region [ff ---truncated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/764c2e892d1fe895392aff62fb353fdce43bb529 - https://git.kernel.org/stable/c/f86c80515a8a3703e0ca2e56deb50fc2879c5ea4 - https://git.kernel.or
aff62fb353fdce43bb529 - https://git.kernel.org/stable/c/f86c80515a8a3703e0ca2e56deb50fc2879c5ea4 - https://git.kernel.org/stable/c/4dbd8808a591b49b717862e6e0081bcf14a87788 - https://git.kernel.org/stable/c/d106f05432e60f9f62d456ef017687f5c73cb414 - https://git.kernel.org/stable/c/2cd6eedfa6344f5ef5c3dac3aee57a39b5b46dff - https://git.kernel.org/stable/c/7178be006d495ffb741c329012da289b62dddfe6 - https://git.kernel.org/stable/c/b8ff869f20152fbe66b6c2e2715d26a2f9897cca - https://git.kernel.org/stable/c/0711f0d7050b9e07c44bc159bbc64ac0a1022c7f
CVE ID: CVE-2021-47119 State: PUBLISHED Published: 2024-03-15T20:14:25.901Z Last Updated: 2025-05-04T07:04:31.455Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in ext4_fill_super Buffer head references must be released before calling kill_bdev(); otherwise the buffer head (and its page referenced by b_data) will not be freed by kill_bdev, and subsequently that bh will be leaked. If blocksizes differ, sb_set_blocksize() will kill current buffers and page cache by using kill_bdev(). And then super block will be reread again but using correct blocksize this time. sb_set_blocksize() didn't fully free superbl
hen super block will be reread again but using correct blocksize this time. sb_set_blocksize() didn't fully free superblock page and buffer head, and being busy, they were not freed and instead leaked. This can easily be reproduced by calling an infinite loop of: systemctl start <ext4_on_lvm>.mount, and systemctl stop <ext4_on_lvm>.mount ... since systemd creates a cgroup for each slice which it mounts, and the bh leak get amplified by a dying memory cgroup that also never gets freed, and memory consumption is much more easily noticed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/01d349a481f0591230300a9171330136f915
ulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/01d349a481f0591230300a9171330136f9159bcd - https://git.kernel.org/stable/c/1385b23396d511d5233b8b921ac3058b3f86a5e1 - https://git.kernel.org/stable/c/afd09b617db3786b6ef3dc43e28fe728cfea84df
CVE ID: CVE-2021-47120 State: PUBLISHED Published: 2024-03-15T20:14:26.578Z Last Updated: 2025-05-04T07:04:32.600Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: magicmouse: fix NULL-deref on disconnect Commit 9d7b18668956 ("HID: magicmouse: add support for Apple Magic Trackpad 2") added a sanity check for an Apple trackpad but returned success instead of -ENODEV when the check failed. This means that the remove callback will dereference the never-initialised driver data pointer when the driver is later unbound (e.g. on USB disconnect). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
nbound (e.g. on USB disconnect). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/368c5d45a87e1bcc7f1e98e0c255c37b7b12c5d6 - https://git.kernel.org/stable/c/b5d013c4c76b276890135b5d32803c4c63924b77 - https://git.kernel.org/stable/c/9cf27473f21913a3eaf4702dd2a25415afd5f33f - https://git.kernel.org/stable/c/4b4f6cecca446abcb686c6e6c451d4f1ec1a7497
CVE ID: CVE-2021-47121 State: PUBLISHED Published: 2024-03-15T20:14:27.287Z Last Updated: 2025-05-04T07:04:33.666Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: caif: fix memory leak in cfusbl_device_notify In case of caif_enroll_dev() fail, allocated link_support won't be assigned to the corresponding structure. So simply free allocated pointer in case of error. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cc302e30a504e6b60a9ac8df7988646f46cd0294 - https://git.kernel.org/stable/c/81afc61cb6e2b553f2c5f992fa79e0ae73857141 - https://git.kernel.org/
8df7988646f46cd0294 - https://git.kernel.org/stable/c/81afc61cb6e2b553f2c5f992fa79e0ae73857141 - https://git.kernel.org/stable/c/e8b37f5009ea7095529790f022859711e6939c76 - https://git.kernel.org/stable/c/9ea0ab48e755d8f29fe89eb235fb86176fdb597f - https://git.kernel.org/stable/c/4d94f530cd24c85aede6e72b8923f371b45d6886 - https://git.kernel.org/stable/c/46403c1f80b0d3f937ff9c4f5edc63bb64bc5051 - https://git.kernel.org/stable/c/dde8686985ec24d6b00487080a906609bd613ea1 - https://git.kernel.org/stable/c/7f5d86669fa4d485523ddb1d212e0a2d90bd62bb
CVE ID: CVE-2021-47122 State: PUBLISHED Published: 2024-03-15T20:14:28.089Z Last Updated: 2025-05-04T07:04:34.716Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: caif: fix memory leak in caif_device_notify In case of caif_enroll_dev() fail, allocated link_support won't be assigned to the corresponding structure. So simply free allocated pointer in case of error Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b042e2b2039565eb8f0eb51c14fbe1ef463c8cd8 - https://git.kernel.org/stable/c/9348c1f10932f13b299cbc8b1bd5f780751fae49 - https://git.kernel.org/sta
14fbe1ef463c8cd8 - https://git.kernel.org/stable/c/9348c1f10932f13b299cbc8b1bd5f780751fae49 - https://git.kernel.org/stable/c/4bca2034b41c15b62d47a19158bb76235fd4455d - https://git.kernel.org/stable/c/3be863c11cab725add9fef4237ed4e232c3fc3bb - https://git.kernel.org/stable/c/f52f4fd67264c70cd0b4ba326962ebe12d9cba94 - https://git.kernel.org/stable/c/af2806345a37313f01b1c9f15e046745b8ee2daa - https://git.kernel.org/stable/c/6a0e317f61094d377335547e015dd2ff12caf893 - https://git.kernel.org/stable/c/b53558a950a89824938e9811eddfc8efcd94e1bb
CVE ID: CVE-2021-47123 State: PUBLISHED Published: 2024-03-15T20:14:28.888Z Last Updated: 2025-05-04T07:04:35.817Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix ltout double free on completion race Always remove linked timeout on io_link_timeout_fn() from the master request link list, otherwise we may get use-after-free when first io_link_timeout_fn() puts linked timeout in the fail path, and then will be found and put on master's free. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1f64f5e903b9d1d157875721e02adadc9d6f0a5d - https://git.ke
DP Vulnrichment: References: - https://git.kernel.org/stable/c/1f64f5e903b9d1d157875721e02adadc9d6f0a5d - https://git.kernel.org/stable/c/447c19f3b5074409c794b350b10306e1da1ef4ba
CVE ID: CVE-2021-47124 State: PUBLISHED Published: 2024-03-15T20:14:29.605Z Last Updated: 2025-05-04T12:41:06.098Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix link timeout refs WARNING: CPU: 0 PID: 10242 at lib/refcount.c:28 refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28 RIP: 0010:refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28 Call Trace: __refcount_sub_and_test include/linux/refcount.h:283 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] io_put_req fs/io_uring.c:2140 [inline] io_queue_linked_timeout fs/io_uring.c:6300
include/linux/refcount.h:333 [inline] io_put_req fs/io_uring.c:2140 [inline] io_queue_linked_timeout fs/io_uring.c:6300 [inline] __io_queue_sqe+0xbef/0xec0 fs/io_uring.c:6354 io_submit_sqe fs/io_uring.c:6534 [inline] io_submit_sqes+0x2bbd/0x7c50 fs/io_uring.c:6660 __do_sys_io_uring_enter fs/io_uring.c:9240 [inline] __se_sys_io_uring_enter+0x256/0x1d60 fs/io_uring.c:9182 io_link_timeout_fn() should put only one reference of the linked timeout request, however in case of racing with the master request's completion first io_req_complete() puts one and then io_put_req_deferred() is called. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kern
() is called. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0b2a990e5d2f76d020cb840c456e6ec5f0c27530 - https://git.kernel.org/stable/c/6f5d7a45f58d3abe3a936de1441b8d6318f978ff - https://git.kernel.org/stable/c/876808dba2ff7509bdd7f230c4f374a0caf4f410 - https://git.kernel.org/stable/c/ff4a96ba5c8f9b266706280ff8021d2ef3f17e86 - https://git.kernel.org/stable/c/a298232ee6b9a1d5d732aa497ff8be0d45b5bd82
CVE ID: CVE-2021-47125 State: PUBLISHED Published: 2024-03-15T20:14:30.285Z Last Updated: 2025-05-04T07:04:37.929Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sch_htb: fix refcount leak in htb_parent_to_leaf_offload The commit ae81feb7338c ("sch_htb: fix null pointer dereference on a null new_q") fixes a NULL pointer dereference bug, but it is not correct. Because htb_graft_helper properly handles the case when new_q is NULL, and after the previous patch by skipping this call which creates an inconsistency : dev_queue->qdisc will still point to the old qdisc, but cl->parent->leaf.q will point to the new one (which will be no
: dev_queue->qdisc will still point to the old qdisc, but cl->parent->leaf.q will point to the new one (which will be noop_qdisc, because new_q was NULL). The code is based on an assumption that these two pointers are the same, so it can lead to refcount leaks. The correct fix is to add a NULL pointer check to protect qdisc_refcount_inc inside htb_parent_to_leaf_offload. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2411c02d03892a5057499f8102d0cc1e0f852416 - https://git.kernel.org/stable/c/944d671d5faa0d78980a3da5c0f04960ef1ad893
CVE ID: CVE-2021-47126 State: PUBLISHED Published: 2024-03-15T20:14:30.948Z Last Updated: 2025-05-04T07:04:39.308Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions Reported by syzbot: HEAD commit: 90c911ad Merge tag 'fixes' of git://git.kernel.org/pub/scm.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master dashboard link: https://syzkaller.appspot.com/bug?extid=123aa35098fd3c000eb7 compiler: Debian clang version 11.0.1-2 ================================================================== BUG: KASAN: slab-out-of-bounds in fib6_nh_ge
11.0.1-2 ================================================================== BUG: KASAN: slab-out-of-bounds in fib6_nh_get_excptn_bucket net/ipv6/route.c:1604 [inline] BUG: KASAN: slab-out-of-bounds in fib6_nh_flush_exceptions+0xbd/0x360 net/ipv6/route.c:1732 Read of size 8 at addr ffff8880145c78f8 by task syz-executor.4/17760 CPU: 0 PID: 17760 Comm: syz-executor.4 Not tainted 5.12.0-rc8-syzkaller #0 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x202/0x31e lib/dump_stack.c:120 print_address_description+0x5f/0x3b0 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report+0x15c/0x200 mm/kasan/report.c:416 fib6_nh_get_excptn_bucket net/ipv6/route.
mm/kasan/report.c:399 [inline] kasan_report+0x15c/0x200 mm/kasan/report.c:416 fib6_nh_get_excptn_bucket net/ipv6/route.c:1604 [inline] fib6_nh_flush_exceptions+0xbd/0x360 net/ipv6/route.c:1732 fib6_nh_release+0x9a/0x430 net/ipv6/route.c:3536 fib6_info_destroy_rcu+0xcb/0x1c0 net/ipv6/ip6_fib.c:174 rcu_do_batch kernel/rcu/tree.c:2559 [inline] rcu_core+0x8f6/0x1450 kernel/rcu/tree.c:2794 __do_softirq+0x372/0x7a6 kernel/softirq.c:345 invoke_softirq kernel/softirq.c:221 [inline] __irq_exit_rcu+0x22c/0x260 kernel/softirq.c:422 irq_exit_rcu+0x5/0x20 kernel/softirq.c:434 sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1100 </IRQ> asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/
ic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1100 </IRQ> asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632 RIP: 0010:lock_acquire+0x1f6/0x720 kernel/locking/lockdep.c:5515 Code: f6 84 24 a1 00 00 00 02 0f 85 8d 02 00 00 f7 c3 00 02 00 00 49 bd 00 00 00 00 00 fc ff df 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 4b c7 44 3d 09 00 00 00 00 43 c7 44 3d RSP: 0018:ffffc90009e06560 EFLAGS: 00000206 RAX: 1ffff920013c0cc0 RBX: 0000000000000246 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90009e066e0 R08: dffffc0000000000 R09: fffffbfff1f992b1 R10: fffffbfff1f992b1 R11: 0000000000000000 R1
0000000 RBP: ffffc90009e066e0 R08: dffffc0000000000 R09: fffffbfff1f992b1 R10: fffffbfff1f992b1 R11: 0000000000000000 R12: 0000000000000000 R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff920013c0cb4 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:267 rcu_read_lock include/linux/rcupdate.h:656 [inline] ext4_get_group_info+0xea/0x340 fs/ext4/ext4.h:3231 ext4_mb_prefetch+0x123/0x5d0 fs/ext4/mballoc.c:2212 ext4_mb_regular_allocator+0x8a5/0x28f0 fs/ext4/mballoc.c:2379 ext4_mb_new_blocks+0xc6e/0x24f0 fs/ext4/mballoc.c:4982 ext4_ext_map_blocks+0x2be3/0x7210 fs/ext4/extents.c:4238 ext4_map_blocks+0xab3/0x1cb0 fs/ext4/inode.c:638 ext4_getblk+0x187/0x6c0 fs/ext4/inode.c:848 ext4_bread+0x2a/
nts.c:4238 ext4_map_blocks+0xab3/0x1cb0 fs/ext4/inode.c:638 ext4_getblk+0x187/0x6c0 fs/ext4/inode.c:848 ext4_bread+0x2a/0x1c0 fs/ext4/inode.c:900 ext4_append+0x1a4/0x360 fs/ext4/namei.c:67 ext4_init_new_dir+0x337/0xa10 fs/ext4/namei.c:2768 ext4_mkdir+0x4b8/0xc00 fs/ext4/namei.c:2814 vfs_mkdir+0x45b/0x640 fs/namei.c:3819 ovl_do_mkdir fs/overlayfs/overlayfs.h:161 [inline] ovl_mkdir_real+0x53/0x1a0 fs/overlayfs/dir.c:146 ovl_create_real+0x280/0x490 fs/overlayfs/dir.c:193 ovl_workdir_create+0x425/0x600 fs/overlayfs/super.c:788 ovl_make_workdir+0xed/0x1140 fs/overlayfs/super.c:1355 ovl_get_workdir fs/overlayfs/super.c:1492 [inline] ovl_fill_super+0x39ee/0x5370 fs/overlayfs/super.c:2035 mount_node