)]}' { "commit": "fd31f7d8b65031d8f8a98c7aafc59c84a831dfc0", "tree": "0c88d09ed972694581882915c1cb1adaf7c5b983", "parents": [ "71bdb3f52bc9ee4b0f831099e92241fa62c3d6df" ], "author": { "name": "Filipe Manana", "email": "fdmanana@suse.com", "time": "Sat May 16 15:09:18 2026 -0400" }, "committer": { "name": "Dom Huh", "email": "domhuh@google.com", "time": "Mon Jun 15 11:34:55 2026 -0700" }, "message": "btrfs: fix missing last_unlink_trans update when removing a directory\n\n[ Upstream commit 999757231c49376cd1a37308d2c8c4c9932571e1 ]\n\nWhen removing a directory we are not updating its last_unlink_trans field,\nwhich can result in incorrect fsync behaviour in case some one fsyncs the\ndirectory after it was removed because it\u0027s holding a file descriptor on\nit.\n\nExample scenario:\n\n mkdir /mnt/dir1\n mkdir /mnt/dir1/dir2\n mkdir /mnt/dir3\n\n sync -f /mnt\n\n # Do some change to the directory and fsync it.\n chmod 700 /mnt/dir1\n xfs_io -c fsync /mnt/dir1\n\n # Move dir2 out of dir1 so that dir1 becomes empty.\n mv /mnt/dir1/dir2 /mnt/dir3/\n\n open fd on /mnt/dir1\n call rmdir(2) on path \"/mnt/dir1\"\n fsync fd\n\n \u003ctrigger power failure\u003e\n\nWhen attempting to mount the filesystem, the log replay will fail with\nan -EIO error and dmesg/syslog has the following:\n\n [445771.626482] BTRFS info (device dm-0): first mount of filesystem 0368bbea-6c5e-44b5-b409-09abe496e650\n [445771.626486] BTRFS info (device dm-0): using crc32c checksum algorithm\n [445771.627912] BTRFS info (device dm-0): start tree-log replay\n [445771.628335] page: refcount:2 mapcount:0 mapping:0000000061443ddc index:0x1d00 pfn:0x7072a5\n [445771.629453] memcg:ffff89f400351b00\n [445771.629892] aops:btree_aops [btrfs] ino:1\n [445771.630737] flags: 0x17fffc00000402a(uptodate|lru|private|writeback|node\u003d0|zone\u003d2|lastcpupid\u003d0x1ffff)\n [445771.632359] raw: 017fffc00000402a fffff47284d950c8 fffff472907b7c08 ffff89f458e412b8\n [445771.633713] raw: 0000000000001d00 ffff89f6c51d1a90 00000002ffffffff ffff89f400351b00\n [445771.635029] page dumped because: eb page dump\n [445771.635825] BTRFS critical (device dm-0): corrupt leaf: root\u003d5 block\u003d30408704 slot\u003d10 ino\u003d258, invalid nlink: has 2 expect no more than 1 for dir\n [445771.638088] BTRFS info (device dm-0): leaf 30408704 gen 10 total ptrs 17 free space 14878 owner 5\n [445771.638091] BTRFS info (device dm-0): refs 4 lock_owner 0 current 3581087\n [445771.638094] \titem 0 key (256 INODE_ITEM 0) itemoff 16123 itemsize 160\n [445771.638097] \t\tinode generation 3 transid 9 size 16 nbytes 16384\n [445771.638098] \t\tblock group 0 mode 40755 links 1 uid 0 gid 0\n [445771.638100] \t\trdev 0 sequence 2 flags 0x0\n [445771.638102] \t\tatime 1775744884.0\n [445771.660056] \t\tctime 1775744885.645502983\n [445771.660058] \t\tmtime 1775744885.645502983\n [445771.660060] \t\totime 1775744884.0\n [445771.660062] \titem 1 key (256 INODE_REF 256) itemoff 16111 itemsize 12\n [445771.660064] \t\tindex 0 name_len 2\n [445771.660066] \titem 2 key (256 DIR_ITEM 1843588421) itemoff 16077 itemsize 34\n [445771.660068] \t\tlocation key (259 1 0) type 2\n [445771.660070] \t\ttransid 9 data_len 0 name_len 4\n [445771.660075] \titem 3 key (256 DIR_ITEM 2363071922) itemoff 16043 itemsize 34\n [445771.660076] \t\tlocation key (257 1 0) type 2\n [445771.660077] \t\ttransid 9 data_len 0 name_len 4\n [445771.660078] \titem 4 key (256 DIR_INDEX 2) itemoff 16009 itemsize 34\n [445771.660079] \t\tlocation key (257 1 0) type 2\n [445771.660080] \t\ttransid 9 data_len 0 name_len 4\n [445771.660081] \titem 5 key (256 DIR_INDEX 3) itemoff 15975 itemsize 34\n [445771.660082] \t\tlocation key (259 1 0) type 2\n [445771.660083] \t\ttransid 9 data_len 0 name_len 4\n [445771.660084] \titem 6 key (257 INODE_ITEM 0) itemoff 15815 itemsize 160\n [445771.660086] \t\tinode generation 9 transid 9 size 8 nbytes 0\n [445771.660087] \t\tblock group 0 mode 40777 links 1 uid 0 gid 0\n [445771.660088] \t\trdev 0 sequence 2 flags 0x0\n [445771.660089] \t\tatime 1775744885.641174097\n [445771.660090] \t\tctime 1775744885.645502983\n [445771.660091] \t\tmtime 1775744885.645502983\n [445771.660105] \t\totime 1775744885.641174097\n [445771.660106] \titem 7 key (257 INODE_REF 256) itemoff 15801 itemsize 14\n [445771.660107] \t\tindex 2 name_len 4\n [445771.660108] \titem 8 key (257 DIR_ITEM 2676584006) itemoff 15767 itemsize 34\n [445771.660109] \t\tlocation key (258 1 0) type 2\n [445771.660110] \t\ttransid 9 data_len 0 name_len 4\n [445771.660111] \titem 9 key (257 DIR_INDEX 2) itemoff 15733 itemsize 34\n [445771.660112] \t\tlocation key (258 1 0) type 2\n [445771.660113] \t\ttransid 9 data_len 0 name_len 4\n [445771.660114] \titem 10 key (258 INODE_ITEM 0) itemoff 15573 itemsize 160\n [445771.660115] \t\tinode generation 9 transid 10 size 0 nbytes 0\n [445771.660116] \t\tblock group 0 mode 40755 links 2 uid 0 gid 0\n [445771.660117] \t\trdev 0 sequence 0 flags 0x0\n [445771.660118] \t\tatime 1775744885.645502983\n [445771.660119] \t\tctime 1775744885.645502983\n [445771.660120] \t\tmtime 1775744885.645502983\n [445771.660121] \t\totime 1775744885.645502983\n [445771.660122] \titem 11 key (258 INODE_REF 257) itemoff 15559 itemsize 14\n [445771.660123] \t\tindex 2 name_len 4\n [445771.660124] \titem 12 key (258 INODE_REF 259) itemoff 15545 itemsize 14\n [445771.660125] \t\tindex 2 name_len 4\n [445771.660126] \titem 13 key (259 INODE_ITEM 0) itemoff 15385 itemsize 160\n [445771.660127] \t\tinode generation 9 transid 10 size 8 nbytes 0\n [445771.660128] \t\tblock group 0 mode 40755 links 1 uid 0 gid 0\n [445771.660129] \t\trdev 0 sequence 1 flags 0x0\n [445771.660130] \t\tatime 1775744885.645502983\n [445771.660130] \t\tctime 1775744885.645502983\n [445771.660131] \t\tmtime 1775744885.645502983\n [445771.660132] \t\totime 1775744885.645502983\n [445771.660133] \titem 14 key (259 INODE_REF 256) itemoff 15371 itemsize 14\n [445771.660134] \t\tindex 3 name_len 4\n [445771.660135] \titem 15 key (259 DIR_ITEM 2676584006) itemoff 15337 itemsize 34\n [445771.660136] \t\tlocation key (258 1 0) type 2\n [445771.660137] \t\ttransid 10 data_len 0 name_len 4\n [445771.660138] \titem 16 key (259 DIR_INDEX 2) itemoff 15303 itemsize 34\n [445771.660139] \t\tlocation key (258 1 0) type 2\n [445771.660140] \t\ttransid 10 data_len 0 name_len 4\n [445771.660144] BTRFS error (device dm-0): block\u003d30408704 write time tree block corruption detected\n [445771.661650] ------------[ cut here ]------------\n [445771.662358] WARNING: fs/btrfs/disk-io.c:326 at btree_csum_one_bio+0x217/0x230 [btrfs], CPU#8: mount/3581087\n [445771.663588] Modules linked in: btrfs f2fs xfs (...)\n [445771.671229] CPU: 8 UID: 0 PID: 3581087 Comm: mount Tainted: G W 7.0.0-rc6-btrfs-next-230+ #2 PREEMPT(full)\n [445771.672575] Tainted: [W]\u003dWARN\n [445771.672987] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n [445771.674460] RIP: 0010:btree_csum_one_bio+0x217/0x230 [btrfs]\n [445771.675222] Code: 89 44 24 (...)\n [445771.677364] RSP: 0018:ffffd23882247660 EFLAGS: 00010246\n [445771.678029] RAX: 0000000000000000 RBX: ffff89f6c51d1a90 RCX: 0000000000000000\n [445771.678975] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff89f406020000\n [445771.679983] RBP: ffff89f821204000 R08: 0000000000000000 R09: 00000000ffefffff\n [445771.680905] R10: ffffd23882247448 R11: 0000000000000003 R12: ffffd23882247668\n [445771.681978] R13: ffff89f458e40fc0 R14: ffff89f737f4f500 R15: ffff89f737f4f500\n [445771.682912] FS: 00007f0447a98840(0000) GS:ffff89fb9771d000(0000) knlGS:0000000000000000\n [445771.684393] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [445771.685230] CR2: 00007f0447bf1330 CR3: 000000017cb02002 CR4: 0000000000370ef0\n [445771.686273] Call Trace:\n [445771.686646] \u003cTASK\u003e\n [445771.686969] btrfs_submit_bbio+0x83f/0x860 [btrfs]\n [445771.687750] ? write_one_eb+0x28f/0x340 [btrfs]\n [445771.688428] btree_writepages+0x2e3/0x550 [btrfs]\n [445771.689180] ? kmem_cache_alloc_noprof+0x12a/0x490\n [445771.689963] ? alloc_extent_state+0x19/0x120 [btrfs]\n [445771.690801] ? kmem_cache_free+0x135/0x380\n [445771.691328] ? preempt_count_add+0x69/0xa0\n [445771.691831] ? set_extent_bit+0x252/0x8e0 [btrfs]\n [445771.692468] ? xas_load+0x9/0xc0\n [445771.692873] ? xas_find+0x14d/0x1a0\n [445771.693304] do_writepages+0xc6/0x160\n [445771.693756] filemap_writeback+0xb8/0xe0\n [445771.694274] btrfs_write_marked_extents+0x61/0x170 [btrfs]\n [445771.694999] btrfs_write_and_wait_transaction+0x4e/0xc0 [btrfs]\n [445771.695818] btrfs_commit_transaction+0x5c8/0xd10 [btrfs]\n [445771.696530] ? kmem_cache_free+0x135/0x380\n [445771.697120] ? release_extent_buffer+0x34/0x160 [btrfs]\n [445771.697786] btrfs_recover_log_trees+0x7be/0x7e0 [btrfs]\n [445771.698525] ? __pfx_replay_one_buffer+0x10/0x10 [btrfs]\n [445771.699206] open_ctree+0x11e5/0x1810 [btrfs]\n [445771.699776] btrfs_get_tree.cold+0xb/0x162 [btrfs]\n [445771.700463] ? fscontext_read+0x165/0x180\n [445771.701146] ? rw_verify_area+0x50/0x180\n [445771.701866] vfs_get_tree+0x25/0xd0\n [445771.702491] vfs_cmd_create+0x59/0xe0\n [445771.703125] __do_sys_fsconfig+0x303/0x610\n [445771.703603] do_syscall_64+0xe9/0xf20\n [445771.703974] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n [445771.704700] RIP: 0033:0x7f0447cbd4aa\n [445771.705108] Code: 73 01 c3 (...)\n [445771.707263] RSP: 002b:00007ffc4e528318 EFLAGS: 00000246 ORIG_RAX: 00000000000001af\n [445771.708107] RAX: ffffffffffffffda RBX: 00005561585d8c20 RCX: 00007f0447cbd4aa\n [445771.708931] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003\n [445771.709744] RBP: 00005561585d9120 R08: 0000000000000000 R09: 0000000000000000\n [445771.710674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n [445771.711477] R13: 00007f0447e4f580 R14: 00007f0447e5126c R15: 00007f0447e36a23\n [445771.712277] \u003c/TASK\u003e\n [445771.712541] ---[ end trace 0000000000000000 ]---\n [445771.713382] BTRFS error (device dm-0): error while writing out transaction: -5\n [445771.714679] BTRFS warning (device dm-0): Skipping commit of aborted transaction.\n [445771.715562] BTRFS error (device dm-0 state A): Transaction aborted (error -5)\n [445771.716459] BTRFS: error (device dm-0 state A) in cleanup_transaction:2068: errno\u003d-5 IO failure\n [445771.717936] BTRFS error (device dm-0 state EA): failed to recover log trees with error: -5\n [445771.719681] BTRFS error (device dm-0 state EA): open_ctree failed: -5\n\nThe problem is that such a fsync should have result in a fallback to a\ntransaction commit, but that did not happen because through the\nbtrfs_rmdir() we never update the directory\u0027s last_unlink_trans field.\nAny inode that had a link removed must have its last_unlink_trans updated\nto the ID of transaction used for the operation, otherwise fsync and log\nreplay will not work correctly.\n\nbtrfs_rmdir() calls btrfs_unlink_inode() and through that call chain we\nnever call btrfs_record_unlink_dir() in order to update last_unlink_trans.\nHowever btrfs_unlink(), which is used for unlinking regular files, calls\nbtrfs_record_unlink_dir() and then calls btrfs_unlink_inode(). So fix\nthis by moving the call to btrfs_record_unlink_dir() from btrfs_unlink()\nto btrfs_unlink_inode().\n\nA test case for fstests will follow soon.\n\nBUG\u003db/517580353\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-46160 in the Linux kernel.\n\ncos-patch: security-moderate\nReported-by: Slava0135 \u003cslava.kovalevskiy.2014@gmail.com\u003e\nLink: https://lore.kernel.org/linux-btrfs/CAAJYhww5ov62Hm+n+tmhcL-e_4cBobg+OWogKjOJxVUXivC\u003dMQ@mail.gmail.com/\nCC: stable@vger.kernel.org\nChange-Id: Ia3bbdbb475dd0e92dba7527329f3641aa5ca2ca6\nSigned-off-by: Filipe Manana \u003cfdmanana@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/157629\nReviewed-by: Kevin Liu \u003czhihuil@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "fd0484df13a8cb030e19b1d296a80706c2d58081", "old_mode": 33188, "old_path": "fs/btrfs/inode.c", "new_id": "a7af607b4c6a0525fafcf3d3b375d31a708b718b", "new_mode": 33188, "new_path": "fs/btrfs/inode.c" } ] }