No description
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Leo Martins c8385851a5 btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node()
[ Upstream commit 83f59076a1 ]

Previously, btrfs_get_or_create_delayed_node() set the delayed_node's
refcount before acquiring the root->delayed_nodes lock.
Commit e8513c012d ("btrfs: implement ref_tracker for delayed_nodes")
moved refcount_set inside the critical section, which means there is
no longer a memory barrier between setting the refcount and setting
btrfs_inode->delayed_node.

Without that barrier, the stores to node->refs and
btrfs_inode->delayed_node may become visible out of order. Another
thread can then read btrfs_inode->delayed_node and attempt to
increment a refcount that hasn't been set yet, leading to a
refcounting bug and a use-after-free warning.

The fix is to move refcount_set back to where it was to take
advantage of the implicit memory barrier provided by lock
acquisition.

Because the allocations now happen outside of the lock's critical
section, they can use GFP_NOFS instead of GFP_ATOMIC.

Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202511262228.6dda231e-lkp@intel.com
Fixes: e8513c012d ("btrfs: implement ref_tracker for delayed_nodes")
Tested-by: kernel test robot <oliver.sang@intel.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Leo Martins <loemra.dev@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-01-17 16:35:18 +01:00
arch alpha: don't reference obsolete termio struct for TC* constants 2026-01-17 16:35:16 +01:00
block block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() 2026-01-08 10:17:21 +01:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto crypto: seqiv - Do not use req->iv after crypto_aead_encrypt 2026-01-08 10:16:43 +01:00
Documentation dt-bindings: PCI: qcom,pcie-sm8550: Add missing required power-domains and resets 2026-01-02 12:57:27 +01:00
drivers scsi: Revert "scsi: libsas: Fix exp-attached device scan after probe failure scanned in again after probe failed" 2026-01-17 16:35:18 +01:00
fs btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() 2026-01-17 16:35:18 +01:00
include btrfs: fix NULL dereference on root when tracing inode eviction 2026-01-17 16:35:18 +01:00
init printk changes for 6.18 2025-10-04 11:13:11 -07:00
io_uring io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic 2026-01-17 16:35:14 +01:00
ipc namespace-6.18-rc1 2025-09-29 11:20:29 -07:00
kernel PM: hibernate: Fix crash when freeing invalid crypto compressor 2026-01-17 16:35:14 +01:00
lib lib/crypto: aes: Fix missing MMU protection for AES S-box 2026-01-17 16:35:12 +01:00
LICENSES LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2 2025-07-24 11:15:39 +02:00
mm mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() 2026-01-08 10:17:21 +01:00
net libceph: make calc_target() set t->paused, not just clear it 2026-01-17 16:35:15 +01:00
rust rust: maple_tree: rcu_read_lock() in destructor to silence lockdep 2026-01-08 10:17:11 +01:00
samples samples/ftrace: Adjust LoongArch register restore order in direct calls 2026-01-08 10:17:11 +01:00
scripts mcb: Add missing modpost build support 2026-01-08 10:16:47 +01:00
security kernel/kexec: change the prototype of kimage_map_segment() 2026-01-08 10:17:10 +01:00
sound ALSA: hda/realtek: Add support for ASUS UM3406GA 2026-01-17 16:35:17 +01:00
tools selftests/mm: fix thread state check in uffd-unit-tests 2026-01-08 10:17:11 +01:00
usr gen_init_cpio: Ignore fsync() returning EINVAL on pipes 2025-10-07 09:53:05 -07:00
virt KVM: Fix last_boosted_vcpu index assignment bug 2026-01-02 12:57:21 +01:00
.clang-format memblock: drop for_each_free_mem_pfn_range_in_zone_from() 2025-09-14 08:49:03 +03:00
.clippy.toml rust: clean Rust 1.88.0's warning about clippy::disallowed_macros configuration 2025-05-07 00:11:47 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore MAINTAINERS: remove Alyssa Rosenzweig 2025-09-18 21:17:31 +02:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore .gitignore: ignore compile_commands.json globally 2025-08-12 15:53:55 -07:00
.mailmap 8 hotfixes. 4 are cc:stable, 7 are against mm/. 2025-11-26 12:38:05 -08:00
.pylintrc tools: docs: parse-headers.py: move it from sphinx dir 2025-08-29 15:54:42 -06:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: mark ISDN subsystem as orphan 2025-10-27 17:49:45 -07:00
Kbuild sched: Make migrate_{en,dis}able() inline 2025-09-25 09:57:16 +02:00
Kconfig io_uring: Rename KConfig to Kconfig 2025-02-19 14:53:27 -07:00
MAINTAINERS soc: fixes for 6.18, part 4 2025-11-28 09:57:31 -08:00
Makefile Linux 6.18.5 2026-01-11 15:26:20 +01:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.