Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
SCALL_64_after_hwframe+0x4b/0x53 [CAUSE] Although I cannot reproduce the error, the report itself is good enough to pin down the cause. The call trace is the regular endio workqueue context, but the free-by-task trace is showing that during btrfs_submit_chunk() we already hit a critical error, and is calling btrfs_bio_end_io() to error out. And the original endio function called bio_put() to free the whole bio. This means a double freeing thus causing use-after-free, e.g.: 1. Enter btrfs_submit_bio() with a read bio The read bio length is 128K, crossing two 64K stripes. 2. The first run of btrfs_submit_chunk() 2.1 Call btrfs_map_block(), which returns 64K 2.2 Call btrfs_split_bio() Now there
The first run of btrfs_submit_chunk() 2.1 Call btrfs_map_block(), which returns 64K 2.2 Call btrfs_split_bio() Now there are two bios, one referring to the first 64K, the other referring to the second 64K. 2.3 The first half is submitted. 3. The second run of btrfs_submit_chunk() 3.1 Call btrfs_map_block(), which by somehow failed Now we call btrfs_bio_end_io() to handle the error 3.2 btrfs_bio_end_io() calls the original endio function Which is end_bbio_data_read(), and it calls bio_put() for the original bio. Now the original bio is freed. 4. The submitted first 64K bio finished Now we call into btrfs_check_read_bio() and tries to advance the bio iter. But since the original bio (thus its
inished Now we call into btrfs_check_read_bio() and tries to advance the bio iter. But since the original bio (thus its iter) is already freed, we trigger the above use-after free. And even if the memory is not poisoned/corrupted, we will later call the original endio function, causing a double freeing. [FIX] Instead of calling btrfs_bio_end_io(), call btrfs_orig_bbio_end_io(), which has the extra check on split bios and do the pr ---truncated--- Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/51722b99f41f5e722ffa10b8f61e802a0e70b331 - https://git.kernel.org/stable/c/4a3b9e1a8e6cd1a8d427a905e159de58d38941cc - https://git.kernel.org/stable/c/10
0e70b331 - https://git.kernel.org/stable/c/4a3b9e1a8e6cd1a8d427a905e159de58d38941cc - https://git.kernel.org/stable/c/10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10
CVE ID: CVE-2024-46688 State: PUBLISHED Published: 2024-09-13T05:29:19.031Z Last Updated: 2025-05-04T09:31:55.298Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: erofs: fix out-of-bound access when z_erofs_gbuf_growsize() partially fails If z_erofs_gbuf_growsize() partially fails on a global buffer due to memory allocation failure or fault injection (as reported by syzbot [1]), new pages need to be freed by comparing to the existing pages to avoid memory leaks. However, the old gbuf->pages[] array may not be large enough, which can lead to null-ptr-deref or out-of-bound access. Fix this by checking against gbuf->nrpages in adva
arge enough, which can lead to null-ptr-deref or out-of-bound access. Fix this by checking against gbuf->nrpages in advance. [1] https://lore.kernel.org/r/000000000000f7b96e062018c6e3@google.com Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/49c0e081998008cde0c872c0ff9affa1ece4b878 - https://git.kernel.org/stable/c/0005e01e1e875c5e27130c5e2ed0189749d1e08a
CVE ID: CVE-2024-46689 State: PUBLISHED Published: 2024-09-13T05:29:19.713Z Last Updated: 2025-11-03T22:16:27.670Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cmd-db region. This region of memory is write protected by XPU. XPU may sometime falsely detect clean cache eviction as "write" into the write protected region leading to secure interrupt which causes an endless loop somewhere in Trust Zone. The only reason it is working right now is because Qualcomm Hypervisor maps the same region as Non-Cacheable memory in Stage 2 translation tables. The iss
t now is because Qualcomm Hypervisor maps the same region as Non-Cacheable memory in Stage 2 translation tables. The issue manifests if we want to use another hypervisor (like Xen or KVM), which does not know anything about those specific mappings. Changing the mapping of cmd-db memory from MEMREMAP_WB to MEMREMAP_WT/WC removes dependency on correct mappings in Stage 2 tables. This patch fixes the issue by updating the mapping to MEMREMAP_WC. I tested this on SA8155P with Xen. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0ee9594c974368a17e85a431e9fe1c14fb65c278 - https://git.kernel.org/stable/c/f5a5a5a0e95f36e2792d4
git.kernel.org/stable/c/0ee9594c974368a17e85a431e9fe1c14fb65c278 - https://git.kernel.org/stable/c/f5a5a5a0e95f36e2792d48e6e4b64e665eb01374 - https://git.kernel.org/stable/c/eaff392c1e34fb77cc61505a31b0191e5e46e271 - https://git.kernel.org/stable/c/d9d48d70e922b272875cda60d2ada89291c840cf - https://git.kernel.org/stable/c/ef80520be0ff78ae5ed44cb6eee1525e65bebe70 - https://git.kernel.org/stable/c/62c2d63605ca25b5db78a347ed303c0a0a77d5b4 - https://git.kernel.org/stable/c/f9bb896eab221618927ae6a2f1d566567999839d
CVE ID: CVE-2024-46690 State: PUBLISHED Published: 2024-09-13T05:29:20.368Z Last Updated: 2025-05-04T09:31:58.523Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd4_deleg_getattr_conflict in presence of third party lease It is not safe to dereference fl->c.flc_owner without first confirming fl->fl_lmops is the expected manager. nfsd4_deleg_getattr_conflict() tests fl_lmops but largely ignores the result and assumes that flc_owner is an nfs4_delegation anyway. This is wrong. With this patch we restore the "!= &nfsd_lease_mng_ops" case to behave as it did before the change mentioned below. This is the same as the cur
ore the "!= &nfsd_lease_mng_ops" case to behave as it did before the change mentioned below. This is the same as the current code, but without any reference to a possible delegation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1b46a871e980e3daa16fd5e77539966492e8910a - https://git.kernel.org/stable/c/40927f3d0972bf86357a32a5749be71a551241b6
CVE ID: CVE-2024-46691 State: PUBLISHED Published: 2024-09-13T05:29:20.991Z Last Updated: 2025-05-04T12:58:36.744Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Move unregister out of atomic section Commit '9329933699b3 ("soc: qcom: pmic_glink: Make client-lock non-sleeping")' moved the pmic_glink client list under a spinlock, as it is accessed by the rpmsg/glink callback, which in turn is invoked from IRQ context. This means that ucsi_unregister() is now called from atomic context, which isn't feasible as it's expecting a sleepable context. An effort is under way to get GLINK to invoke its callbacks in a sle
n't feasible as it's expecting a sleepable context. An effort is under way to get GLINK to invoke its callbacks in a sleepable context, but until then lets schedule the unregistration. A side effect of this is that ucsi_unregister() can now happen after the remote processor, and thereby the communication link with it, is gone. pmic_glink_send() is amended with a check to avoid the resulting NULL pointer dereference. This does however result in the user being informed about this error by the following entry in the kernel log: ucsi_glink.pmic_glink_ucsi pmic_glink.ucsi.0: failed to send UCSI write request: -5 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.o
led to send UCSI write request: -5 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/095b0001aefddcd9361097c971b7debc84e72714 - https://git.kernel.org/stable/c/11bb2ffb679399f99041540cf662409905179e3a
CVE ID: CVE-2024-46692 State: PUBLISHED Published: 2024-09-13T05:29:21.631Z Last Updated: 2025-05-04T09:32:01.488Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firmware: qcom: scm: Mark get_wq_ctx() as atomic call Currently get_wq_ctx() is wrongly configured as a standard call. When two SMC calls are in sleep and one SMC wakes up, it calls get_wq_ctx() to resume the corresponding sleeping thread. But if get_wq_ctx() is interrupted, goes to sleep and another SMC call is waiting to be allocated a waitq context, it leads to a deadlock. To avoid this get_wq_ctx() must be an atomic call and can't be a standard SMC call. Hence mark
, it leads to a deadlock. To avoid this get_wq_ctx() must be an atomic call and can't be a standard SMC call. Hence mark get_wq_ctx() as a fast call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/cdf7efe4b02aa93813db0bf1ca596ad298ab6b06 - https://git.kernel.org/stable/c/e40115c33c0d79c940545b6b12112aace7acd9f5 - https://git.kernel.org/stable/c/9960085a3a82c58d3323c1c20b991db6045063b0
CVE ID: CVE-2024-46693 State: PUBLISHED Published: 2024-09-13T05:29:22.260Z Last Updated: 2025-05-04T09:32:02.910Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink: Fix race during initialization As pointed out by Stephen Boyd it is possible that during initialization of the pmic_glink child drivers, the protection-domain notifiers fires, and the associated work is scheduled, before the client registration returns and as a result the local "client" pointer has been initialized. The outcome of this is a NULL pointer dereference as the "client" pointer is blindly dereferenced. Timeline provided by Stephen: CPU
of this is a NULL pointer dereference as the "client" pointer is blindly dereferenced. Timeline provided by Stephen: CPU0 CPU1 ---- ---- ucsi->client = NULL; devm_pmic_glink_register_client() client->pdr_notify(client->priv, pg->client_state) pmic_glink_ucsi_pdr_notify() schedule_work(&ucsi->register_work) <schedule away> pmic_glink_ucsi_register() ucsi_register() pmic_glink_ucsi_read_version() pmic_glink_ucsi_read() pmic_glink_ucsi_read() pmic_glink_send(ucsi->client) <client is NULL BAD> ucsi->client = client // Too late! This code is identical across the altmode, battery manager and usci child drivers. Resolve this by splitting the allocation of the "client" object and the registration th
manager and usci child drivers. Resolve this by splitting the allocation of the "client" object and the registration thereof into two operations. This only happens if the protection domain registry is populated at the time of registration, which by the introduction of commit '1ebcde047c54 ("soc: qcom: add pd-mapper implementation")' became much more likely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1efdbf5323c9360e05066049b97414405e94e087 - https://git.kernel.org/stable/c/943b0e7cc646a624bb20a68080f8f1a4a55df41c - https://git.kernel.org/stable/c/3568affcddd68743e25aa3ec1647d9b82797757b
CVE ID: CVE-2024-46694 State: PUBLISHED Published: 2024-09-13T05:29:22.889Z Last Updated: 2025-11-03T22:16:29.128Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: avoid using null object of framebuffer Instead of using state->fb->obj[0] directly, get object from framebuffer by calling drm_gem_fb_get_obj() and return error code when object is null to avoid using null object of framebuffer. (cherry picked from commit 73dd0ad9e5dad53766ea3e631303430116f834b3) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/093ee72ed35c2338c87c26b6ba6f0b7789c9
ulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/093ee72ed35c2338c87c26b6ba6f0b7789c9e14e - https://git.kernel.org/stable/c/f6f5e39a3fe7cbdba190f42b28b40bdff03c8cf0 - https://git.kernel.org/stable/c/49e1b214f3239b78967c6ddb8f8ec47ae047b051 - https://git.kernel.org/stable/c/3b9a33235c773c7a3768060cf1d2cf8a9153bc37
CVE ID: CVE-2024-46695 State: PUBLISHED Published: 2024-09-13T05:29:23.506Z Last Updated: 2025-11-03T22:16:30.596Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: selinux,smack: don't bypass permissions check in inode_setsecctx hook Marek Gresko reports that the root user on an NFS client is able to change the security labels on files on an NFS filesystem that is exported with root squashing enabled. The end of the kerneldoc comment for __vfs_setxattr_noperm() states: * This function requires the caller to lock the inode's i_mutex before it * is executed. It also assumes that the caller will make the appropriate * permission che
the inode's i_mutex before it * is executed. It also assumes that the caller will make the appropriate * permission checks. nfsd_setattr() does do permissions checking via fh_verify() and nfsd_permission(), but those don't do all the same permissions checks that are done by security_inode_setxattr() and its related LSM hooks do. Since nfsd_setattr() is the only consumer of security_inode_setsecctx(), simplest solution appears to be to replace the call to __vfs_setxattr_noperm() with a call to __vfs_setxattr_locked(). This fixes the above issue and has the added benefit of causing nfsd to recall conflicting delegations on a file when a client tries to change its security label. Additional An
causing nfsd to recall conflicting delegations on a file when a client tries to change its security label. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2dbc4b7bac60b02cc6e70d05bf6a7dfd551f9dda - https://git.kernel.org/stable/c/fe0cd53791119f6287b6532af8ce41576d664930 - https://git.kernel.org/stable/c/eebec98791d0137e455cc006411bb92a54250924 - https://git.kernel.org/stable/c/459584258d47ec3cc6245a82e8a49c9d08eb8b57 - https://git.kernel.org/stable/c/f71ec019257ba4f7ab198bd948c5902a207bad96 - https://git.kernel.org/stable/c/76a0e79bc84f466999fa501fce5bf7a07641b8a7
CVE ID: CVE-2024-46696 State: PUBLISHED Published: 2024-09-13T05:29:24.123Z Last Updated: 2025-05-04T09:32:07.282Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: fix potential UAF in nfsd4_cb_getattr_release Once we drop the delegation reference, the fields embedded in it are no longer safe to access. Do that last. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e0b66698a5ae41078f7490e8b3527013f5fccd6c - https://git.kernel.org/stable/c/1116e0e372eb16dd907ec571ce5d4af325c55c10
CVE ID: CVE-2024-46697 State: PUBLISHED Published: 2024-09-13T05:29:24.787Z Last Updated: 2025-05-04T09:32:08.416Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: ensure that nfsd4_fattr_args.context is zeroed out If nfsd4_encode_fattr4 ends up doing a "goto out" before we get to checking for the security label, then args.context will be set to uninitialized junk on the stack, which we'll then try to free. Initialize it early. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/dd65b324174a64558a16ebbf4c3266e5701185d0 - https://git.kernel.org/stable/c/f58bab6fd4063913bd8321e9987
rnel.org/stable/c/dd65b324174a64558a16ebbf4c3266e5701185d0 - https://git.kernel.org/stable/c/f58bab6fd4063913bd8321e99874b8239e9ba726
CVE ID: CVE-2024-46698 State: PUBLISHED Published: 2024-09-13T05:29:25.387Z Last Updated: 2025-05-04T12:58:38.132Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: video/aperture: optionally match the device in sysfb_disable() In aperture_remove_conflicting_pci_devices(), we currently only call sysfb_disable() on vga class devices. This leads to the following problem when the pimary device is not VGA compatible: 1. A PCI device with a non-VGA class is the boot display 2. That device is probed first and it is not a VGA device so sysfb_disable() is not called, but the device resources are freed by aperture_detach_platform_device()
a VGA device so sysfb_disable() is not called, but the device resources are freed by aperture_detach_platform_device() 3. Non-primary GPU has a VGA class and it ends up calling sysfb_disable() 4. NULL pointer dereference via sysfb_disable() since the resources have already been freed by aperture_detach_platform_device() when it was called by the other device. Fix this by passing a device pointer to sysfb_disable() and checking the device to determine if we should execute it or not. v2: Fix build when CONFIG_SCREEN_INFO is not set v3: Move device check into the mutex Drop primary variable in aperture_remove_conflicting_pci_devices() Drop __init on pci sysfb_pci_dev_is_enabled() Additional An
rimary variable in aperture_remove_conflicting_pci_devices() Drop __init on pci sysfb_pci_dev_is_enabled() Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/17e78f43de0c6da34204cc858b4cc05671ea9acf - https://git.kernel.org/stable/c/b49420d6a1aeb399e5b107fc6eb8584d0860fbd7
CVE ID: CVE-2024-46699 State: PUBLISHED Published: 2024-09-13T05:29:25.995Z Last Updated: 2025-05-04T09:32:11.248Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Disable preemption while updating GPU stats We forgot to disable preemption around the write_seqcount_begin/end() pair while updating GPU stats: [ ] WARNING: CPU: 2 PID: 12 at include/linux/seqlock.h:221 __seqprop_assert.isra.0+0x128/0x150 [v3d] [ ] Workqueue: v3d_bin drm_sched_run_job_work [gpu_sched] <...snip...> [ ] Call trace: [ ] __seqprop_assert.isra.0+0x128/0x150 [v3d] [ ] v3d_job_start_stats.isra.0+0x90/0x218 [v3d] [ ] v3d_bin_job_run+0x23c/0x388 [v3d]
op_assert.isra.0+0x128/0x150 [v3d] [ ] v3d_job_start_stats.isra.0+0x90/0x218 [v3d] [ ] v3d_bin_job_run+0x23c/0x388 [v3d] [ ] drm_sched_run_job_work+0x520/0x6d0 [gpu_sched] [ ] process_one_work+0x62c/0xb48 [ ] worker_thread+0x468/0x5b0 [ ] kthread+0x1c4/0x1e0 [ ] ret_from_fork+0x10/0x20 Fix it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1e93467ef20308da5a94cde548ee17d523e8ba7b - https://git.kernel.org/stable/c/9d824c7fce58f59982228aa85b0376b113cdfa35
CVE ID: CVE-2024-46700 State: REJECTED Published: 2024-09-13T05:29:26.616Z Last Updated: 2025-06-19T12:43:49.033Z Description: No description available.
CVE ID: CVE-2024-46701 State: PUBLISHED Published: 2024-09-13T06:27:29.911Z Last Updated: 2025-05-04T09:32:13.970Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: libfs: fix infinite directory reads for offset dir After we switch tmpfs dir operations from simple_dir_operations to simple_offset_dir_operations, every rename happened will fill new dentry to dest dir's maple tree(&SHMEM_I(inode)->dir_offsets->mt) with a free key starting with octx->newx_offset, and then set newx_offset equals to free key + 1. This will lead to infinite readdir combine with rename happened at the same time, which fail generic/736 in xfstests(detail s
will lead to infinite readdir combine with rename happened at the same time, which fail generic/736 in xfstests(detail show as below). 1. create 5000 files(1 2 3...) under one dir 2. call readdir(man 3 readdir) once, and get one entry 3. rename(entry, "TEMPFILE"), then rename("TEMPFILE", entry) 4. loop 2~3, until readdir return nothing or we loop too many times(tmpfs break test with the second condition) We choose the same logic what commit 9b378f6ad48cf ("btrfs: fix infinite directory reads") to fix it, record the last_index when we open dir, and do not emit the entry which index >= last_index. The file->private_data now used in offset dir can use directly to do this, and we also update the
h index >= last_index. The file->private_data now used in offset dir can use directly to do this, and we also update the last_index when we llseek the dir file. [brauner: only update last_index after seek when offset is zero like Jan suggested] Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/308b4fc2403b335894592ee9dc212a5e58bb309f - https://git.kernel.org/stable/c/64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a
CVE ID: CVE-2024-46702 State: PUBLISHED Published: 2024-09-13T06:27:30.550Z Last Updated: 2025-11-03T22:16:33.529Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock. However
so tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock. However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/747bc154577de6e6af4bc99abfa859b8419bb4d8 - https://git.kernel.org/stable/c/23ce6ba3b95488a2b9e9f6d43b340da0c15395dc - https://git.kernel.org/stable
859b8419bb4d8 - https://git.kernel.org/stable/c/23ce6ba3b95488a2b9e9f6d43b340da0c15395dc - https://git.kernel.org/stable/c/80ac8d194831eca0c2f4fd862f7925532fda320c - https://git.kernel.org/stable/c/18b3ad2a3cc877dd4b16f48d84aa27b78d53bf1d - https://git.kernel.org/stable/c/7ca24cf9163c112bb6b580c6fb57c04a1f8b76e1 - https://git.kernel.org/stable/c/e2006140ad2e01a02ed0aff49cc2ae3ceeb11f8d
CVE ID: CVE-2024-46703 State: PUBLISHED Published: 2024-09-13T06:27:31.178Z Last Updated: 2025-05-04T09:32:16.774Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Revert "serial: 8250_omap: Set the console genpd always on if no console suspend" This reverts commit 68e6939ea9ec3d6579eadeab16060339cdeaf940. Kevin reported that this causes a crash during suspend on platforms that dont use PM domains. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/321aecb079e9ca8b1af90778068a6fb40f2bf22d - https://git.kernel.org/stable/c/0863bffda1131fd2fa9c05b653ad9ee3d8db127e
CVE ID: CVE-2024-46704 State: PUBLISHED Published: 2024-09-13T06:27:31.822Z Last Updated: 2025-05-04T09:32:18.564Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix spruious data race in __flush_work() When flushing a work item for cancellation, __flush_work() knows that it exclusively owns the work item through its PENDING bit. 134874e2eee9 ("workqueue: Allow cancel_work_sync() and disable_work() from atomic contexts on BH work items") added a read of @work->data to determine whether to use busy wait for BH work items that are being canceled. While the read is safe when @from_cancel, @work->data was read before tes