Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-46736 State: PUBLISHED Published: 2024-09-18T07:11:58.499Z Last Updated: 2025-05-04T09:33:03.991Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2_rename_path() If smb2_set_path_attr() is called with a valid @cfile and returned -EINVAL, we need to call cifs_get_writable_path() again as the reference of @cfile was already dropped by previous smb2_compound_op() call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b27ea9c96efd2c252a981fb00d0f001b86c90f3e - https://git.kernel.org/stable/c/1a46c7f6546b73cbf36f5a618a1a6bbb45
g/stable/c/b27ea9c96efd2c252a981fb00d0f001b86c90f3e - https://git.kernel.org/stable/c/1a46c7f6546b73cbf36f5a618a1a6bbb45391eb3 - https://git.kernel.org/stable/c/3523a3df03c6f04f7ea9c2e7050102657e331a4f
CVE ID: CVE-2024-46737 State: PUBLISHED Published: 2024-09-18T07:11:59.300Z Last Updated: 2025-11-03T22:17:20.599Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix kernel crash if commands allocation fails If the commands allocation fails in nvmet_tcp_alloc_cmds() the kernel crashes in nvmet_tcp_release_queue_work() because of a NULL pointer dereference. nvmet: failed to install queue 0 cntlid 1 ret 6 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Fix the bug by setting queue->nr_cmds to zero in case nvmet_tcp_alloc_cmd() fails. Additional Analyst Notes: - CISA ADP Vulnrichment
by setting queue->nr_cmds to zero in case nvmet_tcp_alloc_cmd() fails. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/03e1fd0327fa5e2174567f5fe9290fe21d21b8f4 - https://git.kernel.org/stable/c/50632b877ce55356f5d276b9add289b1e7ddc683 - https://git.kernel.org/stable/c/91dad30c5607e62864f888e735d0965567827bdf - https://git.kernel.org/stable/c/7957c731fc2b23312f8935812dee5a0b14b04e2d - https://git.kernel.org/stable/c/489f2913a63f528cfe3f21722583fb981967ecda - https://git.kernel.org/stable/c/6c04d1e3ab22cc5394ef656429638a5947f87244 - https://git.kernel.org/stable/c/5572a55a6f830ee3f3a994b6b962a5c327d28cb3
CVE ID: CVE-2024-46738 State: PUBLISHED Published: 2024-09-18T07:12:00.131Z Last Updated: 2025-11-03T22:17:23.538Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resource handle by comparing context and resource fields. It is possible though to create two resources with different types but same handle (same context and resource fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the obj
fields). When trying to remove one of the resources, vmci_resource_remove() may not remove the intended one, but the object will still be freed as in the case of the datagram type in vmci_datagram_destroy_handle(). vmci_resource_table will still hold a pointer to this freed resource leading to a use-after-free vulnerability. BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:10
ecutor197/1592 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425 kasan_report+0x38/0x51 mm/kasan/report.c:442 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline] vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444 kref_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x
_put include/linux/kref.h:65 [inline] vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline] vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143 __fput+0x261/0xa34 fs/file_table.c:282 task_work_run+0xf0/0x194 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline] syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_S
syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x6e/0x0 This change ensures the type is also checked when removing the resource from vmci_resource_table in vmci_resource_remove(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f6365931bf7c07b2b397dbb06a4f6573cc9fae73 - https://git.kernel.org/stable/c/b243d52b5f6f59f9d39e69b191fb3d58b94a43b1 - https://git.kernel.org/stable/c/6c563a29857aa8053b67ee141191f69757f27f6e - https://git.kernel.org/stable/c/ef5f4d0c5ee22d4f873116fec844ff6edaf3fa7d - https://git.kernel.org/stable/c/b
757f27f6e - https://git.kernel.org/stable/c/ef5f4d0c5ee22d4f873116fec844ff6edaf3fa7d - https://git.kernel.org/stable/c/b9efdf333174468651be40390cbc79c9f55d9cce - https://git.kernel.org/stable/c/39e7e593418ccdbd151f2925fa6be1a616d16c96 - https://git.kernel.org/stable/c/00fe5292f081f8d773e572df8e03bf6e1855fe49 - https://git.kernel.org/stable/c/48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7
CVE ID: CVE-2024-46739 State: PUBLISHED Published: 2024-09-18T07:12:00.897Z Last Updated: 2025-11-03T22:17:26.500Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind For primary VM Bus channels, primary_channel pointer is always NULL. This pointer is valid only for the secondary channels. Also, rescind callback is meant for primary channels only. Fix NULL pointer dereference by retrieving the device_obj from the parent for the primary channel. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c
dditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3d414b64ecf6fd717d7510ffb893c6f23acbf50e - https://git.kernel.org/stable/c/f38f46da80a2ab7d1b2f8fcb444c916034a2dac4 - https://git.kernel.org/stable/c/1d8e020e51ab07e40f9dd00b52f1da7d96fec04c - https://git.kernel.org/stable/c/3005091cd537ef8cdb7530dcb2ecfba8d2ef475c - https://git.kernel.org/stable/c/2be373469be1774bbe03b0fa7e2854e65005b1cc - https://git.kernel.org/stable/c/de6946be9c8bc7d2279123433495af7c21011b99 - https://git.kernel.org/stable/c/928e399e84f4e80307dce44e89415115c473275b - https://git.kernel.org/stable/c/fb1adbd7e50f3d2de56d0a2bb0700e2e819a329e
CVE ID: CVE-2024-46740 State: PUBLISHED Published: 2024-09-18T07:12:01.653Z Last Updated: 2025-11-03T22:17:29.741Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to i
eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to index these objects are now corrupted. Unwinding with corrupted offsets can result in decrements of arbitrary nodes and lead to their premature release. Other users of such nodes are left with a dangling pointer triggering a use-after-free. This issue is made evident by the following KASAN report (trimmed): ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff47fc91598f04 by task binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Hardware nam
ffff47fc91598f04 by task binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Allocated by task 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Freed by task 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ================================================================== To avoid this issue, let's check that the raw data copy is within the
================================================= To avoid this issue, let's check that the raw data copy is within the boundaries of the data section. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5a32bfd23022ffa7e152f273fa3fa29befb7d929 - https://git.kernel.org/stable/c/3a8154bb4ab4a01390a3abf1e6afac296e037da4 - https://git.kernel.org/stable/c/eef79854a04feac5b861f94d7b19cbbe79874117 - https://git.kernel.org/stable/c/4f79e0b80dc69bd5eaaed70f0df1b558728b4e59 - https://git.kernel.org/stable/c/1f33d9f1d9ac3f0129f8508925000900c2fe5bb0 - https://git.kernel.org/stable/c/109e845c1184c9f786d41516348ba3efd9112792 - https://
f1d9ac3f0129f8508925000900c2fe5bb0 - https://git.kernel.org/stable/c/109e845c1184c9f786d41516348ba3efd9112792 - https://git.kernel.org/stable/c/4df153652cc46545722879415937582028c18af5
CVE ID: CVE-2024-46741 State: PUBLISHED Published: 2024-09-18T07:12:02.496Z Last Updated: 2025-05-04T09:33:10.729Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix double free of 'buf' in error path smatch warning: drivers/misc/fastrpc.c:1926 fastrpc_req_mmap() error: double free of 'buf' In fastrpc_req_mmap() error path, the fastrpc buffer is freed in fastrpc_req_munmap_impl() if unmap is successful. But in the end, there is an unconditional call to fastrpc_buf_free(). So the above case triggers the double free of fastrpc buf. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.
ers the double free of fastrpc buf. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f77dc8a75859e559f3238a6d906206259227985e - https://git.kernel.org/stable/c/bfc1704d909dc9911a558b1a5833d3d61a43a1f2 - https://git.kernel.org/stable/c/e8c276d4dc0e19ee48385f74426aebc855b49aaf
CVE ID: CVE-2024-46742 State: PUBLISHED Published: 2024-09-18T07:12:03.251Z Last Updated: 2025-11-03T19:31:01.223Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb/server: fix potential null-ptr-deref of lease_ctx_info in smb2_open() null-ptr-deref will occur when (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) and parse_lease_state() return NULL. Fix this by check if 'lease_ctx_info' is NULL. Additionally, remove the redundant parentheses in parse_durable_handle_context(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/878f32878351104448b86ef5b85d1f8ed6f599
nrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/878f32878351104448b86ef5b85d1f8ed6f599fb - https://git.kernel.org/stable/c/ec28c35029b7930f31117f9284874b63bea4f31b - https://git.kernel.org/stable/c/07f384c5be1f8633b13f0a22616e227570450bc6 - https://git.kernel.org/stable/c/3b692794b81f2ecad69a4adbba687f3836824ada - https://git.kernel.org/stable/c/4e8771a3666c8f216eefd6bd2fd50121c6c437db
CVE ID: CVE-2024-46743 State: PUBLISHED Published: 2024-09-18T07:12:04.166Z Last Updated: 2025-11-03T22:17:32.674Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw:
0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0
30 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The bu
.. The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address:
00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Con
he device address into a buffer of sufficient size. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d2a79494d8a5262949736fb2c3ac44d20a51b0d8 - https://git.kernel.org/stable/c/defcaa426ba0bc89ffdafb799d2e50b52f74ffc4 - https://git.kernel.org/stable/c/9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5 - https://git.kernel.org/stable/c/baaf26723beab3a04da578d3008be3544f83758f - https://git.kernel.org/stable/c/8ff351ea12e918db1373b915c4c268815929cbe5 - https://git.kernel.org/stable/c/7ead730af11ee7da107f16fc77995613c58d292d - https://git.kernel.org/stable/c/bf68acd840b6a5bfd3777e0d5aaa204db6b461a9 - https://git.kernel.org/stable/c/b
3c58d292d - https://git.kernel.org/stable/c/bf68acd840b6a5bfd3777e0d5aaa204db6b461a9 - https://git.kernel.org/stable/c/b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305
CVE ID: CVE-2024-46744 State: PUBLISHED Published: 2024-09-18T07:12:04.975Z Last Updated: 2025-11-03T22:17:35.583Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. L
node() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. -- V2: fix spelling mistake. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https
2: fix spelling mistake. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f82cb7f24032ed023fc67d26ea9bf322d8431a90 - https://git.kernel.org/stable/c/1b9451ba6f21478a75288ea3e3fca4be35e2a438 - https://git.kernel.org/stable/c/5c8906de98d0d7ad42ff3edf2cb6cd7e0ea658c4 - https://git.kernel.org/stable/c/087f25b2d36adae19951114ffcbb7106ed405ebb - https://git.kernel.org/stable/c/fac5e82ab1334fc8ed6ff7183702df634bd1d93d - https://git.kernel.org/stable/c/c3af7e460a526007e4bed1ce3623274a1a6afe5e - https://git.kernel.org/stable/c/ef4e249971eb77ec33d74c5c3de1e2576faf6c90 - https://git.kernel.org/stable/c/810ee43d9cd245d138a2733d87a2
nel.org/stable/c/ef4e249971eb77ec33d74c5c3de1e2576faf6c90 - https://git.kernel.org/stable/c/810ee43d9cd245d138a2733d87a24858a23f577d
CVE ID: CVE-2024-46745 State: PUBLISHED Published: 2024-09-18T07:12:05.798Z Last Updated: 2025-11-03T22:17:38.493Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory allocation failure in input_mt_init_slots(). While this allocation failure is handled properly and request is rejected, it results in syzkaller reports. Additionally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request. Fix it
ally, such request may put undue burden on the system which will try to free a lot of memory for a bogus request. Fix it by limiting allowed number of slots to 100. This can easily be extended if we see devices that can track more than 100 contacts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9c6d189f0c1c59ba9a32326ec82a0b367a3cd47b - https://git.kernel.org/stable/c/597ff930296c4c8fc6b6a536884d4f1a7187ec70 - https://git.kernel.org/stable/c/51fa08edd80003db700bdaa099385c5900d27f4b - https://git.kernel.org/stable/c/9719687398dea8a6a12a10321a54dd75eec7ab2d - https://git.kernel.org/stable/c/61df76619e270a46fd427fbdeb67
nel.org/stable/c/9719687398dea8a6a12a10321a54dd75eec7ab2d - https://git.kernel.org/stable/c/61df76619e270a46fd427fbdeb670ad491c42de2 - https://git.kernel.org/stable/c/a4858b00a1ec57043697fb935565fe267f161833 - https://git.kernel.org/stable/c/d76fc0f0b18d49b7e721c9e4975ef4bffde2f3e7 - https://git.kernel.org/stable/c/206f533a0a7c683982af473079c4111f4a0f9f5e
CVE ID: CVE-2024-46746 State: PUBLISHED Published: 2024-09-18T07:12:06.910Z Last Updated: 2025-11-03T22:17:39.964Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data after destroying hid device HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only after the hid_destroy_device() function returned as driver_data is used in several callbacks. I observed a crash with kernel 6.10.0 on my T14s Gen 3, after enabling KASAN to debug memory allocation, I got this output: [ 13.050438] =====================================================
KASAN to debug memory allocation, I got this output: [ 13.050438] ================================================================== [ 13.054060] BUG: KASAN: slab-use-after-free in amd_sfh_get_report+0x3ec/0x530 [amd_sfh] [ 13.054809] psmouse serio1: trackpoint: Synaptics TrackPoint firmware: 0x02, buttons: 3/3 [ 13.056432] Read of size 8 at addr ffff88813152f408 by task (udev-worker)/479 [ 13.060970] CPU: 5 PID: 479 Comm: (udev-worker) Not tainted 6.10.0-arch1-2 #1 893bb55d7f0073f25c46adbb49eb3785fefd74b0 [ 13.063978] Hardware name: LENOVO 21CQCTO1WW/21CQCTO1WW, BIOS R22ET70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8
T70W (1.40 ) 03/21/2024 [ 13.067860] Call Trace: [ 13.069383] input: TPPS/2 Synaptics TrackPoint as /devices/platform/i8042/serio1/input/input8 [ 13.071486] <TASK> [ 13.071492] dump_stack_lvl+0x5d/0x80 [ 13.074870] snd_hda_intel 0000:33:00.6: enabling device (0000 -> 0002) [ 13.078296] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.082199] print_report+0x174/0x505 [ 13.085776] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 13.089367] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.093255] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_s
b5205f734cd9da29399130f398a38] [ 13.097464] kasan_report+0xc8/0x150 [ 13.101461] ? amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.105802] amd_sfh_get_report+0x3ec/0x530 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.110303] amdtp_hid_request+0xb8/0x110 [amd_sfh 05f43221435b5205f734cd9da29399130f398a38] [ 13.114879] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.119450] sensor_hub_get_feature+0x1d3/0x540 [hid_sensor_hub 3f13be3016ff415bea03008d45d99da837ee3082] [ 13.124097] hid_sensor_parse_common_attributes+0x4d0/0xad0 [hid_sensor_iio_common c3a5cbe93969c28b122609768bbe23efe52eb8f5] [ 13.127404] ? srso_alias_return_thunk+0x5/0xfbef5 [ 13.131925] ?