Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
+0x6c/0x108 devres_release_all+0x98/0x100 device_unbind_cleanup+0x20/0x70 really_probe+0x218/0x2d0 In other words, the initialisation code flow is: platform-device probe ufshcd_pltfrm_init() ufshcd_alloc_host() scsi_host_alloc() allocation of struct ufs_hba creation of scsi-host devices devm_blk_crypto_profile_init() devm registration of cleanup handler using platform-device and during error handling of ufshcd_pltfrm_init() or during driver removal: ufshcd_dealloc_host() scsi_host_put() put_device(scsi-host) release of struct ufs_hba put_device(platform-device) crypto cleanup handler To fix this use-after free, change ufshcd_alloc_host() to register a devres action to automatically cleanup t
up handler To fix this use-after free, change ufshcd_alloc_host() to register a devres action to automatically cleanup the underlying SCSI device on ufshcd destruction, without requiring explicit calls to ufshcd_dealloc_host(). This way: * the crypto profile and all other ufs_hba-owned resources are destroyed before SCSI (as they've been registered after) * a memleak is plugged in tc-dwc-g210-pci.c remove() as a side-effect * EXPORT_SYMBOL_GPL(ufshcd_dealloc_host) can be removed fully as it's not needed anymore * no future drivers using ufshcd_alloc_host() could ever forget adding the cleanup Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0c7
adding the cleanup Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0c77c0d754fe83cb154715fcfec6c3faef94f207 - https://git.kernel.org/stable/c/9c185beae09a3eb85f54777edafa227f7e03075d - https://git.kernel.org/stable/c/f8fb2403ddebb5eea0033d90d9daae4c88749ada
CVE ID: CVE-2025-21740 State: REJECTED Published: 2025-02-27T02:12:15.222Z Last Updated: 2025-03-27T13:48:46.896Z Description: No description available.
CVE ID: CVE-2025-21741 State: PUBLISHED Published: 2025-02-27T02:12:15.715Z Last Updated: 2025-10-01T19:36:41.732Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix DPE OoB read Fix an out-of-bounds DPE read, limit the number of processed DPEs to the amount that fits into the fixed-size NDP16 header. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/22475242ddb70e35c9148234be9a3aa9fb8efff9 - https://git.kernel.org/stable/c/5835bf66c50ac2b85ed28b282c2456c3516ef0a6 - https://git.kernel.org/stable/c/971b8c572559e52d32a2b82f2d9e0685439a0117 - https://git.kernel.org/sta
2c2456c3516ef0a6 - https://git.kernel.org/stable/c/971b8c572559e52d32a2b82f2d9e0685439a0117 - https://git.kernel.org/stable/c/ee591f2b281721171896117f9946fced31441418
CVE ID: CVE-2025-21742 State: PUBLISHED Published: 2025-02-27T02:12:16.207Z Last Updated: 2025-10-01T19:36:41.519Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: use static NDP16 location in URB Original code allowed for the start of NDP16 to be anywhere within the URB based on the `wNdpIndex` value in NTH16. Only the start position of NDP16 was checked, so it was possible for even the fixed-length part of NDP16 to extend past the end of URB, leading to an out-of-bounds read. On iOS devices, the NDP16 header always directly follows NTH16. Rely on and check for this specific format. This, along with NCM-specific
e NDP16 header always directly follows NTH16. Rely on and check for this specific format. This, along with NCM-specific minimal URB length check that already exists, will ensure that the fixed-length part of NDP16 plus a set amount of DPEs fit within the URB. Note that this commit alone does not fully address the OoB read. The limit on the amount of DPEs needs to be enforced separately. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8fb062178e1ce180e2cfdc9abc83a1b9fea381ca - https://git.kernel.org/stable/c/cf1ac7f7cf601ac31d1580559c002b5e37b733b7 - https://git.kernel.org/stable/c/2b619445dcb6dab97d8ed033fb57225aca1288c4 - https://git.kernel.o
1580559c002b5e37b733b7 - https://git.kernel.org/stable/c/2b619445dcb6dab97d8ed033fb57225aca1288c4 - https://git.kernel.org/stable/c/86586dcb75cb8fd062a518aca8ee667938b91efb
CVE ID: CVE-2025-21743 State: PUBLISHED Published: 2025-02-27T02:12:16.696Z Last Updated: 2025-10-01T19:36:41.387Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix possible overflow in DPE length check Originally, it was possible for the DPE length check to overflow if wDatagramIndex + wDatagramLength > U16_MAX. This could lead to an OoB read. Move the wDatagramIndex term to the other side of the inequality. An existing condition ensures that wDatagramIndex < urb->actual_length. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/18bf6f5cce3172cb303c3f0551aa9443d5ed
alyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/18bf6f5cce3172cb303c3f0551aa9443d5ed74f8 - https://git.kernel.org/stable/c/d677e7dd59ad6837496f5a02d8e5d39824278dfd - https://git.kernel.org/stable/c/d824a964185910e317287f034c0a439c08b4fe49 - https://git.kernel.org/stable/c/c219427ed296f94bb4b91d08626776dc7719ee27
CVE ID: CVE-2025-21744 State: PUBLISHED Published: 2025-02-27T02:12:17.259Z Last Updated: 2025-11-03T19:36:47.312Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() On removal of the device or unloading of the kernel module a potential NULL pointer dereference occurs. The following sequence deletes the interface: brcmf_detach() brcmf_remove_interface() brcmf_del_if() Inside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated to BRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches. After brcmf_remove_interface() call the brcmf_proto_detach() function is cal
SIDX_INVALID (-1) if the bsscfgidx matches. After brcmf_remove_interface() call the brcmf_proto_detach() function is called providing the following sequence: brcmf_detach() brcmf_proto_detach() brcmf_proto_msgbuf_detach() brcmf_flowring_detach() brcmf_msgbuf_delete_flowring() brcmf_msgbuf_remove_flowring() brcmf_flowring_delete() brcmf_get_ifp() brcmf_txfinalize() Since brcmf_get_ip() can and actually will return NULL in this case the call to brcmf_txfinalize() will result in a NULL pointer dereference inside brcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors. This will only happen if a flowring still has an skb. Although the NULL pointer dereference has only been seen when
rs. This will only happen if a flowring still has an skb. Although the NULL pointer dereference has only been seen when trying to update the tx statistic, all other uses of the ifp pointer have been guarded as well with an early return if ifp is NULL. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/2326e19190e176fd72bb542b837a9d2b7fcb8693 - https://git.kernel.org/stable/c/59ff4fa653ff6db07c61152516ffba79c2a74bda - https://git.kernel.org/stable/c/61541d9b5a23df33934fcc620a3a81f246b1b240 - https://git.kernel.org/stable/c/4e51d6d093e763348916e69d06d87e0a5593661b - https://git.kernel.org/stable/c/3877fc67bd3d5566cc12763bce39710ceb74a97d - https://
d093e763348916e69d06d87e0a5593661b - https://git.kernel.org/stable/c/3877fc67bd3d5566cc12763bce39710ceb74a97d - https://git.kernel.org/stable/c/fbbfef2a5b858eab55741a58b2ac9a0cc8d53c58 - https://git.kernel.org/stable/c/a2beefc4fa49ebc22e664dc6b39dbd054f8488f9 - https://git.kernel.org/stable/c/68abd0c4ebf24cd499841a488b97a6873d5efabb
CVE ID: CVE-2025-21745 State: PUBLISHED Published: 2025-02-27T02:12:17.853Z Last Updated: 2025-11-03T19:36:50.044Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @block_class's subsystem refcount leakage blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with class_dev_iter_exit(), so causes the class's subsystem refcount leakage. Fix by ending the iterating with class_dev_iter_exit(). Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/ffb494f1e7a047bd7a41b13796fcfb08fe5beafb - https://git.
Program Container: References: - https://git.kernel.org/stable/c/ffb494f1e7a047bd7a41b13796fcfb08fe5beafb - https://git.kernel.org/stable/c/38287f779b34dfe959b4b681e909f2d3d52b88be - https://git.kernel.org/stable/c/431b6ef2714be4d5babb802114987541a88b43b0 - https://git.kernel.org/stable/c/993121481b5a87829f1e8163f47158b72679f309 - https://git.kernel.org/stable/c/2ce09aabe009453d641a2ceb79e6461a2d4f3876 - https://git.kernel.org/stable/c/67c7f213e052b1aa6caba4a7e25e303bc6997126 - https://git.kernel.org/stable/c/d1248436cbef1f924c04255367ff4845ccd9025e
CVE ID: CVE-2025-21746 State: PUBLISHED Published: 2025-02-27T02:12:18.477Z Last Updated: 2025-05-04T07:20:14.042Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through port an interrupt might come before psmouse driver binds to the pass-through port. However synaptics sub-driver tries to access psmouse instance presumably associated with the pass-through port to figure out if only 1 byte of response or entire protocol packet needs to be forwarded to the pass-through port and may crash if psmouse instance has not been attached to the port yet. Fi
eds to be forwarded to the pass-through port and may crash if psmouse instance has not been attached to the port yet. Fix the crash by introducing open() and close() methods for the port and check if the port is open before trying to access psmouse instance. Because psmouse calls serio_open() only after attaching psmouse instance to serio port instance this prevents the potential crash. References: - https://git.kernel.org/stable/c/a2cbcd70133dc0d4d4c95ad4cd5412b935354c7c - https://git.kernel.org/stable/c/3e179d3f1ada963475395d81bfe91daef4d1a24c - https://git.kernel.org/stable/c/87da1ea93ec9f9f0004e5b12e78789bc94e360bf - https://git.kernel.org/stable/c/08bd5b7c9a2401faabdaa1472d45c7de0755fd7
ble/c/87da1ea93ec9f9f0004e5b12e78789bc94e360bf - https://git.kernel.org/stable/c/08bd5b7c9a2401faabdaa1472d45c7de0755fd7e
CVE ID: CVE-2025-21747 State: PUBLISHED Published: 2025-02-27T02:12:19.088Z Last Updated: 2025-05-04T07:20:15.135Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/ast: astdp: Fix timeout for enabling video signal The ASTDP transmitter sometimes takes up to 1 second for enabling the video signal, while the timeout is only 200 msec. This results in a kernel error message. Increase the timeout to 1 second. An example of the error message is shown below. [ 697.084433] ------------[ cut here ]------------ [ 697.091115] ast 0000:02:00.0: [drm] drm_WARN_ON(!__ast_dp_wait_enable(ast, enabled)) [ 697.091233] WARNING: CPU: 1 PID: 160
091115] ast 0000:02:00.0: [drm] drm_WARN_ON(!__ast_dp_wait_enable(ast, enabled)) [ 697.091233] WARNING: CPU: 1 PID: 160 at drivers/gpu/drm/ast/ast_dp.c:232 ast_dp_set_enable+0x123/0x140 [ast] [...] [ 697.272469] RIP: 0010:ast_dp_set_enable+0x123/0x140 [ast] [...] [ 697.415283] Call Trace: [ 697.420727] <TASK> [ 697.425908] ? show_trace_log_lvl+0x196/0x2c0 [ 697.433304] ? show_trace_log_lvl+0x196/0x2c0 [ 697.440693] ? drm_atomic_helper_commit_modeset_enables+0x30a/0x470 [ 697.450115] ? ast_dp_set_enable+0x123/0x140 [ast] [ 697.458059] ? __warn.cold+0xaf/0xca [ 697.464713] ? ast_dp_set_enable+0x123/0x140 [ast] [ 697.472633] ? report_bug+0x134/0x1d0 [ 697.479544] ? handle_bug+0x58/0x90 [ 697.48
ast_dp_set_enable+0x123/0x140 [ast] [ 697.472633] ? report_bug+0x134/0x1d0 [ 697.479544] ? handle_bug+0x58/0x90 [ 697.486127] ? exc_invalid_op+0x13/0x40 [ 697.492975] ? asm_exc_invalid_op+0x16/0x20 [ 697.500224] ? preempt_count_sub+0x14/0xc0 [ 697.507473] ? ast_dp_set_enable+0x123/0x140 [ast] [ 697.515377] ? ast_dp_set_enable+0x123/0x140 [ast] [ 697.523227] drm_atomic_helper_commit_modeset_enables+0x30a/0x470 [ 697.532388] drm_atomic_helper_commit_tail+0x58/0x90 [ 697.540400] ast_mode_config_helper_atomic_commit_tail+0x30/0x40 [ast] [ 697.550009] commit_tail+0xfe/0x1d0 [ 697.556547] drm_atomic_helper_commit+0x198/0x1c0 This is a cosmetical problem. Enabling the video signal still works even
7.556547] drm_atomic_helper_commit+0x198/0x1c0 This is a cosmetical problem. Enabling the video signal still works even with the error message. The problem has always been present, but only recent versions of the ast driver warn about missing the timeout. References: - https://git.kernel.org/stable/c/589839379031cce220c9cab9f27cb5477195067e - https://git.kernel.org/stable/c/fd39c41bcd82d5ebaaebadb944eab5598c668a90
CVE ID: CVE-2025-21748 State: PUBLISHED Published: 2025-02-27T02:12:19.705Z Last Updated: 2025-11-03T19:36:51.420Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix integer overflows on 32 bit systems On 32bit systems the addition operations in ipc_msg_alloc() can potentially overflow leading to memory corruption. Add bounds checking using KSMBD_IPC_MAX_PAYLOAD to avoid overflow. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/f3b9fb2764591d792d160f375851013665a9e820 - https://git.kernel.org/stable/c/760568c1f62ea874e8fb492f9cfa4f47b4b8391e - https://git.kernel.org/stable
1013665a9e820 - https://git.kernel.org/stable/c/760568c1f62ea874e8fb492f9cfa4f47b4b8391e - https://git.kernel.org/stable/c/82f59d64e6297f270311b16b5dcf65be406d1ea3 - https://git.kernel.org/stable/c/b4b902737746c490258de5cb55cab39e79927a67 - https://git.kernel.org/stable/c/ecb9947fa7c99a77b04d43404c6988a0d326e4a0 - https://git.kernel.org/stable/c/aab98e2dbd648510f8f51b83fbf4721206ccae45
CVE ID: CVE-2025-21749 State: PUBLISHED Published: 2025-02-27T02:12:20.305Z Last Updated: 2025-11-03T19:36:54.163Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: rose: lock the socket in rose_bind() syzbot reported a soft lockup in rose_loopback_timer(), with a repro calling bind() from multiple threads. rose_bind() must lock the socket to avoid this issue. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/b8bf5c3fb778bbb1f3ff7d98ec577c969f687513 - https://git.kernel.org/stable/c/ed00c5f907d08a647b8bf987514ad8c6b17971a7 - https://git.kernel.org/stable/c/d308661a0f4e7c8e86dfc70
t.kernel.org/stable/c/ed00c5f907d08a647b8bf987514ad8c6b17971a7 - https://git.kernel.org/stable/c/d308661a0f4e7c8e86dfc7074a55ee5894c61538 - https://git.kernel.org/stable/c/667f61b3498df751c8b3f0be1637e7226cbe3ed0 - https://git.kernel.org/stable/c/e0384efd45f615603e6869205b72040c209e69cc - https://git.kernel.org/stable/c/970cd2ed26cdab2b0f15b6d90d7eaa36538244a5 - https://git.kernel.org/stable/c/4c04b0ab3a647e76d0e752b013de8e404abafc63 - https://git.kernel.org/stable/c/a1300691aed9ee852b0a9192e29e2bdc2411a7e6
CVE ID: CVE-2025-21750 State: PUBLISHED Published: 2025-02-27T02:12:21.155Z Last Updated: 2025-11-03T19:36:55.570Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Check the return value of of_property_read_string_index() Somewhen between 6.10 and 6.11 the driver started to crash on my MacBookPro14,3. The property doesn't exist and 'tmp' remains uninitialized, so we pass a random pointer to devm_kstrdup(). The crash I am getting looks like this: BUG: unable to handle page fault for address: 00007f033c669379 PF: supervisor read access in kernel mode PF: error_code(0x0001) - permissions violation PGD 800000010134106
f033c669379 PF: supervisor read access in kernel mode PF: error_code(0x0001) - permissions violation PGD 8000000101341067 P4D 8000000101341067 PUD 101340067 PMD 1013bb067 PTE 800000010aee9025 Oops: Oops: 0001 [#1] SMP PTI CPU: 4 UID: 0 PID: 827 Comm: (udev-worker) Not tainted 6.11.8-gentoo #1 Hardware name: Apple Inc. MacBookPro14,3/Mac-551B86E5744E2388, BIOS 529.140.2.0.0 06/23/2024 RIP: 0010:strlen+0x4/0x30 Code: f7 75 ec 31 c0 c3 cc cc cc cc 48 89 f8 c3 cc cc cc cc 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <80> 3f 00 74 14 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3 cc RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202 RAX: 00000000ffffffea RBX: 00007f033c669379
01 80 38 00 75 f7 48 29 f8 c3 cc RSP: 0018:ffffb4aac0683ad8 EFLAGS: 00010202 RAX: 00000000ffffffea RBX: 00007f033c669379 RCX: 0000000000000001 RDX: 0000000000000cc0 RSI: 00007f033c669379 RDI: 00007f033c669379 RBP: 00000000ffffffea R08: 0000000000000000 R09: 00000000c0ba916a R10: ffffffffffffffff R11: ffffffffb61ea260 R12: ffff91f7815b50c8 R13: 0000000000000cc0 R14: ffff91fafefffe30 R15: ffffb4aac0683b30 FS: 00007f033ccbe8c0(0000) GS:ffff91faeed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f033c669379 CR3: 0000000107b1e004 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000f
00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x149/0x4c0 ? raw_spin_rq_lock_nested+0xe/0x20 ? sched_balance_newidle+0x22b/0x3c0 ? update_load_avg+0x78/0x770 ? exc_page_fault+0x6f/0x150 ? asm_exc_page_fault+0x26/0x30 ? __pfx_pci_conf1_write+0x10/0x10 ? strlen+0x4/0x30 devm_kstrdup+0x25/0x70 brcmf_of_probe+0x273/0x350 [brcmfmac] Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/af525a8b2ab85291617e79a5bb18bcdcb529e80c - https://git.kernel.org/stable/c/c9480e9f2d10135476101619bcbd1c49c15d595
ble/c/af525a8b2ab85291617e79a5bb18bcdcb529e80c - https://git.kernel.org/stable/c/c9480e9f2d10135476101619bcbd1c49c15d595f - https://git.kernel.org/stable/c/7ef2ea1429684d5cef207519bdf6ce45e50e8ac5 - https://git.kernel.org/stable/c/bb8e35e33e79eb8e44396adbc8cb6c8c5f16b731 - https://git.kernel.org/stable/c/082d9e263af8de68f0c34f67b251818205160f6e
CVE ID: CVE-2025-21751 State: PUBLISHED Published: 2025-02-27T02:12:22.177Z Last Updated: 2025-09-19T14:53:56.575Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on matcher disconnect Currently, when firmware failure occurs during matcher disconnect flow, the error flow of the function reconnects the matcher back and returns an error, which continues running the calling function and eventually frees the matcher that is being disconnected. This leads to a case where we have a freed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch fixes that by not
eed matcher on the matchers list, which in turn leads to use-after-free and eventual crash. This patch fixes that by not trying to reconnect the matcher back when some FW command fails during disconnect. Note that we're dealing here with FW error. We can't overcome this problem. This might lead to bad steering state (e.g. wrong connection between matchers), and will also lead to resource leakage, as it is the case with any other error handling during resource destruction. However, the goal here is to allow the driver to continue and not crash the machine with use-after-free error. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5682aad0276ff9b
error. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5682aad0276ff9b9b0eff3188eb6a1f504d6b436 - https://git.kernel.org/stable/c/23a86c76a1a197e8fbbbd0ce3e826eb58c471624 - https://git.kernel.org/stable/c/1ce840c7a659aa53a31ef49f0271b4fd0dc10296
CVE ID: CVE-2025-21752 State: PUBLISHED Published: 2025-02-27T02:12:22.741Z Last Updated: 2025-05-04T07:20:25.715Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents Don't use btrfs_set_item_key_safe() to modify the keys in the RAID stripe-tree, as this can lead to corruption of the tree, which is caught by the checks in btrfs_set_item_key_safe(): BTRFS info (device nvme1n1): leaf 49168384 gen 15 total ptrs 194 free space 8329 owner 12 BTRFS info (device nvme1n1): refs 2 lock_owner 1030 current 1030 [ snip ] item 105 key (354549760 230 20480) itemoff 14587 itemsize 16
ice nvme1n1): refs 2 lock_owner 1030 current 1030 [ snip ] item 105 key (354549760 230 20480) itemoff 14587 itemsize 16 stride 0 devid 5 physical 67502080 item 106 key (354631680 230 4096) itemoff 14571 itemsize 16 stride 0 devid 1 physical 88559616 item 107 key (354631680 230 32768) itemoff 14555 itemsize 16 stride 0 devid 1 physical 88555520 item 108 key (354717696 230 28672) itemoff 14539 itemsize 16 stride 0 devid 2 physical 67604480 [ snip ] BTRFS critical (device nvme1n1): slot 106 key (354631680 230 32768) new key (354635776 230 4096) ------------[ cut here ]------------ kernel BUG at fs/btrfs/ctree.c:2602! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID: 1055 Comm:
---- kernel BUG at fs/btrfs/ctree.c:2602! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID: 1055 Comm: fsstress Not tainted 6.13.0-rc1+ #1464 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:btrfs_set_item_key_safe+0xf7/0x270 Code: <snip> RSP: 0018:ffffc90001337ab0 EFLAGS: 00010287 RAX: 0000000000000000 RBX: ffff8881115fd000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff RBP: ffff888110ed6f50 R08: 00000000ffffefff R09: ffffffff8244c500 R10: 00000000ffffefff R11: 00000000ffffffff R12: ffff888100586000 R13: 00000000000000c9 R14: ffffc90001337b1f R15: ffff888110f
0000000ffffefff R11: 00000000ffffffff R12: ffff888100586000 R13: 00000000000000c9 R14: ffffc90001337b1f R15: ffff888110f23b58 FS: 00007f7d75c72740(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa811652c60 CR3: 0000000111398001 CR4: 0000000000370eb0 Call Trace: <TASK> ? __die_body.cold+0x14/0x1a ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x65/0x80 ? btrfs_set_item_key_safe+0xf7/0x270 ? exc_invalid_op+0x50/0x70 ? btrfs_set_item_key_safe+0xf7/0x270 ? asm_exc_invalid_op+0x1a/0x20 ? btrfs_set_item_key_safe+0xf7/0x270 btrfs_partially_delete_raid_extent+0xc4/0xe0 btrfs_delete_raid_extent+0x227/0x240 __btrfs_free_extent.is
safe+0xf7/0x270 btrfs_partially_delete_raid_extent+0xc4/0xe0 btrfs_delete_raid_extent+0x227/0x240 __btrfs_free_extent.isra.0+0x57f/0x9c0 ? exc_coproc_segment_overrun+0x40/0x40 __btrfs_run_delayed_refs+0x2fa/0xe80 btrfs_run_delayed_refs+0x81/0xe0 btrfs_commit_transaction+0x2dd/0xbe0 ? preempt_count_add+0x52/0xb0 btrfs_sync_file+0x375/0x4c0 do_fsync+0x39/0x70 __x64_sys_fsync+0x13/0x20 do_syscall_64+0x54/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f7d7550ef90 Code: <snip> RSP: 002b:00007ffd70237248 EFLAGS: 00000202 ORIG_RAX: 000000000000004a RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f7d7550ef90 RDX: 000000000000013a RSI: 000000000040eb28 RDI: 0000000000000004 RBP: 00
da RBX: 0000000000000004 RCX: 00007f7d7550ef90 RDX: 000000000000013a RSI: 000000000040eb28 RDI: 0000000000000004 RBP: 000000000000001b R08: 0000000000000078 R09: 00007ffd7023725c R10: 00007f7d75400390 R11: 0000000000000202 R12: 028f5c28f5c28f5c R13: 8f5c28f5c28f5c29 R14: 000000000040b520 R15: 00007f7d75c726c8 </TASK> While the root cause of the tree order corruption isn't clear, using btrfs_duplicate_item() to copy the item and then adjusting both the key and the per-device physical addresses is a safe way to counter this problem. References: - https://git.kernel.org/stable/c/1c25eff52ee5a02a2c4be659a44ae972d9989742 - https://git.kernel.org/stable/c/dc14ba10781bd2629835696b7cc1febf914768e9