Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
"0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dd if=/dev/urandom of=/dev/mapper/cmeta bs=4k count=1 oflag=direct dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) WARNING: CPU: 0 PID: 84 at kernel/workqueue.c:4178 __flush_work+0x5d4/0x890 Fix by pulling out the cancel_delayed_work_sync() from the constructor's error path. This patch doesn't affect the use-after-free fix for concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cache_dtr is no
fix for concurrent dm_resume and dm_destroy (commit 6a459d8edbdb ("dm cache: Fix UAF in destroy()")) as cache_dtr is not changed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/40fac0271c7aedf60d81ed8214e80851e5b26312 - https://git.kernel.org/stable/c/d154b333a5667b6c1b213a11a41ad7aaccd10c3d - https://git.kernel.org/stable/c/5a754d3c771280f2d06bf8ab716d6a0d36ca256e - https://git.kernel.org/stable/c/8cc12dab635333c4ea28e72d7b947be7d0543c2c - https://git.kernel.org/stable/c/aee3ecda73ce13af7c3e556383342b57e6bd0718 - https://git.kernel.org/stable/c/135496c208ba26fd68cdef10b64ed7a91ac9a7ff
CVE ID: CVE-2024-50281 State: PUBLISHED Published: 2024-11-19T01:30:23.275Z Last Updated: 2025-10-01T20:17:22.242Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation When sealing or unsealing a key blob we currently do not wait for the AEAD cipher operation to finish and simply return after submitting the request. If there is some load on the system we can exit before the cipher operation is done and the buffer we read from/write to is already removed from the stack. This will e.g. result in NULL pointer dereference errors in the DCP driver during blob creation. Fix
ed from the stack. This will e.g. result in NULL pointer dereference errors in the DCP driver during blob creation. Fix this by waiting for the AEAD cipher operation to finish before resuming the seal and unseal calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/c75e0272289eae18c5379518a9c56ef31d65cc7d - https://git.kernel.org/stable/c/04de7589e0a95167d803ecadd115235ba2c14997
CVE ID: CVE-2024-50282 State: PUBLISHED Published: 2024-11-19T01:30:24.581Z Last Updated: 2025-11-03T22:28:01.440Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Avoid a possible buffer overflow if size is larger than 4K. (cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf002434) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/673bdb4200c092692f83b5f7ba3df57021d52d29 - https://git.kernel.org/stable/c/8906728f2fbd6504cb488f4afdd66af28f330a7a - https://git.kernel.org/stable/c/2faa
d52d29 - https://git.kernel.org/stable/c/8906728f2fbd6504cb488f4afdd66af28f330a7a - https://git.kernel.org/stable/c/2faaee36e6e30f9efc7fa6bcb0bdcbe05c23f51f - https://git.kernel.org/stable/c/4d75b9468021c73108b4439794d69e892b1d24e3
CVE ID: CVE-2024-50283 State: PUBLISHED Published: 2024-11-19T01:30:25.968Z Last Updated: 2025-11-03T22:28:04.991Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp ksmbd_user_session_put should be called under smb3_preauth_hash_rsp(). It will avoid freeing session before calling smb3_preauth_hash_rsp(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/cb645064e0811053c94e86677f2e58ed29359d62 - https://git.kernel.org/stable/c/f7557bbca40d4ca8bb1c6c940ac6c95078bd0827 - https://git.kernel.org/stable/c/c6cd
359d62 - https://git.kernel.org/stable/c/f7557bbca40d4ca8bb1c6c940ac6c95078bd0827 - https://git.kernel.org/stable/c/c6cdc08c25a868a08068dfc319fa9fce982b8e7f - https://git.kernel.org/stable/c/1b6ad475d4ed577d34e0157eb507be00c588bf5c - https://git.kernel.org/stable/c/b8fc56fbca7482c1e5c0e3351c6ae78982e25ada
CVE ID: CVE-2024-50284 State: PUBLISHED Published: 2024-11-19T01:30:27.273Z Last Updated: 2025-11-03T22:28:06.521Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix the missing xa_store error check xa_store() can fail, it return xa_err(-EINVAL) if the entry cannot be stored in an XArray, or xa_err(-ENOMEM) if memory allocation failed, so check error for xa_store() to fix it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d8664ce789bd46290c59a00da6897252f92c237d - https://git.kernel.org/stable/c/726c1568b9145fa13ee248df184b186c382a7ff8 - https://g
789bd46290c59a00da6897252f92c237d - https://git.kernel.org/stable/c/726c1568b9145fa13ee248df184b186c382a7ff8 - https://git.kernel.org/stable/c/c2a232c4f790f4bcd4d218904c56ac7a39a448f5 - https://git.kernel.org/stable/c/3abab905b14f4ba756d413f37f1fb02b708eee93
CVE ID: CVE-2024-50285 State: PUBLISHED Published: 2024-11-19T01:30:28.603Z Last Updated: 2025-10-01T20:17:21.944Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: check outstanding simultaneous SMB operations If Client send simultaneous SMB operations to ksmbd, It exhausts too much memory through the "ksmbd_work_cache”. It will cause OOM issue. ksmbd has a credit mechanism but it can't handle this problem. This patch add the check if it exceeds max credits to prevent this problem by assuming that one smb request consumes at least one credit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kern
request consumes at least one credit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1f993777275cbd8f74765c4f9d9285cb907c9be5 - https://git.kernel.org/stable/c/e257ac6fe138623cf59fca8898abdf659dbc8356 - https://git.kernel.org/stable/c/0a77d947f599b1f39065015bec99390d0c0022ee
CVE ID: CVE-2024-50286 State: PUBLISHED Published: 2024-11-19T01:30:29.948Z Last Updated: 2025-11-03T22:28:07.988Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create There is a race condition between ksmbd_smb2_session_create and ksmbd_expire_session. This patch add missing sessions_table_lock while adding/deleting session from global session table. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f56446ba5378d19e31040b548a14ee9a8f1500ea - https://git.kernel.org/stable/c/e923503a56b3385b64ae492e3225e4
l.org/stable/c/f56446ba5378d19e31040b548a14ee9a8f1500ea - https://git.kernel.org/stable/c/e923503a56b3385b64ae492e3225e4623f560c5b - https://git.kernel.org/stable/c/e7a2ad2044377853cf8c59528dac808a08a99c72 - https://git.kernel.org/stable/c/0a77715db22611df50b178374c51e2ba0d58866e
CVE ID: CVE-2024-50287 State: PUBLISHED Published: 2024-11-19T01:30:31.338Z Last Updated: 2025-11-03T22:28:09.432Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity, the logic at tpg_precalculate_line() blindly rescales the buffer even when scaled_witdh is equal to zero. If this ever happens, this will cause a division by zero. Instead, add a WARN_ON_ONCE() to trigger such cases and return without doing any precalculation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e3c36d0bd
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e3c36d0bde309f690ed1f9cd5f7e63b3a513f94a - https://git.kernel.org/stable/c/0bfc6e38ee2250f0503d96f1a1de441c31d88715 - https://git.kernel.org/stable/c/054931ca3cfcb8e8fa036e887d6f379942b02565 - https://git.kernel.org/stable/c/a749c15dccc58d9cbad9cd23bd8ab4b5fa96cf47 - https://git.kernel.org/stable/c/c63c30c9d9f2c8de34b16cd2b8400240533b914e - https://git.kernel.org/stable/c/2d0f01aa602fd15a805771bdf3f4d9a9b4df7f47 - https://git.kernel.org/stable/c/0cdb42ba0b28f548c1a4e86bb8489dba0d78fc21 - https://git.kernel.org/stable/c/e6a3ea83fbe15d4818d01804e904cbb0e64e543b
CVE ID: CVE-2024-50288 State: PUBLISHED Published: 2024-11-19T01:30:32.682Z Last Updated: 2025-10-01T20:17:21.514Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix buffer overwrite when using > 32 buffers The maximum number of buffers that can be requested was increased to 64 for the video capture queue. But video capture used a must_blank array that was still sized for 32 (VIDEO_MAX_FRAME). This caused an out-of-bounds write when using buffer indices >= 32. Create a new define MAX_VID_CAP_BUFFERS that is used to access the must_blank array and set max_num_buffers for the video capture queue. This solves a crash
ERS that is used to access the must_blank array and set max_num_buffers for the video capture queue. This solves a crash reported by: https://bugzilla.kernel.org/show_bug.cgi?id=219258 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e6bacd8f2178b22859fe6d9f755f19dfcd9d3862 - https://git.kernel.org/stable/c/96d8569563916fe2f8fe17317e20e43f54f9ba4b
CVE ID: CVE-2024-50289 State: PUBLISHED Published: 2024-11-19T01:30:34.029Z Last Updated: 2025-05-04T09:50:56.203Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: av7110: fix a spectre vulnerability As warned by smatch: drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap) There is a spectre-related vulnerability at the code. Fix it. References: - https://git.kernel.org/stable/c/f3927206c478bd249c225414f7a751752a30e7b9 - https://git.kernel.org/stable/c/458ea1c0be991573ec436aa0afa23baacfae101a
CVE ID: CVE-2024-50290 State: PUBLISHED Published: 2024-11-19T01:30:35.352Z Last Updated: 2025-11-03T22:28:10.894Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: cx24116: prevent overflows on SNR calculus as reported by Coverity, if reading SNR registers fail, a negative number will be returned, causing an underflow when reading SNR registers. Prevent that. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/127b9076baeadd734b18ddc8f2cd93b47d5a3ea3 - https://git.kernel.org/stable/c/cad97ca8cfd43a78a19b59949f33e3563d369247 - https://git.kernel.org/stabl
cd93b47d5a3ea3 - https://git.kernel.org/stable/c/cad97ca8cfd43a78a19b59949f33e3563d369247 - https://git.kernel.org/stable/c/828047c70f4716fde4b1316f7b610e97a4e83824 - https://git.kernel.org/stable/c/f2b4f277c41db8d548f38f1dd091bbdf6a5acb07 - https://git.kernel.org/stable/c/fbefe31e4598cdb0889eee2e74c995b2212efb08 - https://git.kernel.org/stable/c/83c152b55d88cbf6fc4685941fcb31333986774d - https://git.kernel.org/stable/c/3a1ed994d9454132354b860321414955da289929 - https://git.kernel.org/stable/c/576a307a7650bd544fbb24df801b9b7863b85e2f
CVE ID: CVE-2024-50291 State: PUBLISHED Published: 2024-11-19T01:30:36.685Z Last Updated: 2025-10-01T20:17:21.088Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: add missing buffer index check dvb_vb2_expbuf() didn't check if the given buffer index was for a valid buffer. Add this check. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/721c37af0355cc0b540909c57fd7930dc99c72d8 - https://git.kernel.org/stable/c/fa88dc7db176c79b50adb132a56120a1d4d9d18b
CVE ID: CVE-2024-50292 State: PUBLISHED Published: 2024-11-19T01:30:38.036Z Last Updated: 2025-11-03T22:28:12.355Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not null. So the release of the dma channel leads to the following issue: [ 4.879000] st,stm32-spdifrx 500d0000.audio-controller: dma_request_slave_channel error -19 [ 4.888975] Unable to handle kernel NULL pointer dereference at virtual address 000000000000003d [...] [ 5.096577] Call trace: [ 5.099099] dma_release_channel+0x24/0x10
dereference at virtual address 000000000000003d [...] [ 5.096577] Call trace: [ 5.099099] dma_release_channel+0x24/0x100 [ 5.103235] stm32_spdifrx_remove+0x24/0x60 [snd_soc_stm32_spdifrx] [ 5.109494] stm32_spdifrx_probe+0x320/0x4c4 [snd_soc_stm32_spdifrx] To avoid this issue, release channel only if the pointer is valid. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3a977b554f668382dfba31fd62e4cce4fe5643db - https://git.kernel.org/stable/c/0d75f887aabd80cf37ea48d28f159afa7850ea28 - https://git.kernel.org/stable/c/4f1d74f74752eab8af6b8b28797dc6490d57374c - https://git.kernel.org/stable/c/23bdbd1ef3e063e03d3c50c15a591
el.org/stable/c/4f1d74f74752eab8af6b8b28797dc6490d57374c - https://git.kernel.org/stable/c/23bdbd1ef3e063e03d3c50c15a591b005ebbae39 - https://git.kernel.org/stable/c/22ae9321054cf7f36c537702af133659f51a0b88 - https://git.kernel.org/stable/c/9bb4af400c386374ab1047df44c508512c08c31f
CVE ID: CVE-2024-50293 State: PUBLISHED Published: 2024-11-19T01:30:39.362Z Last Updated: 2025-10-01T20:17:20.758Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/smc: do not leave a dangling sk pointer in __smc_create() Thanks to commit 4bbd360a5084 ("socket: Print pf->create() when it does not clear sock->sk on failure."), syzbot found an issue with AF_SMC: smc_create must clear sock->sk on failure, family: 43, type: 1, protocol: 0 WARNING: CPU: 0 PID: 5827 at net/socket.c:1565 __sock_create+0x96f/0xa30 net/socket.c:1563 Modules linked in: CPU: 0 UID: 0 PID: 5827 Comm: syz-executor259 Not tainted 6.12.0-rc6-next-20241106-s
et/socket.c:1563 Modules linked in: CPU: 0 UID: 0 PID: 5827 Comm: syz-executor259 Not tainted 6.12.0-rc6-next-20241106-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:__sock_create+0x96f/0xa30 net/socket.c:1563 Code: 03 00 74 08 4c 89 e7 e8 4f 3b 85 f8 49 8b 34 24 48 c7 c7 40 89 0c 8d 8b 54 24 04 8b 4c 24 0c 44 8b 44 24 08 e8 32 78 db f7 90 <0f> 0b 90 90 e9 d3 fd ff ff 89 e9 80 e1 07 fe c1 38 c1 0f 8c ee f7 RSP: 0018:ffffc90003e4fda0 EFLAGS: 00010246 RAX: 099c6f938c7f4700 RBX: 1ffffffff1a595fd RCX: ffff888034823c00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00000000ffffffe9 R08: ffffffff81567052 R09:
23c00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00000000ffffffe9 R08: ffffffff81567052 R09: 1ffff920007c9f50 R10: dffffc0000000000 R11: fffff520007c9f51 R12: ffffffff8d2cafe8 R13: 1ffffffff1a595fe R14: ffffffff9a789c40 R15: ffff8880764298c0 FS: 000055557b518380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa62ff43225 CR3: 0000000031628000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sock_create net/socket.c:1616 [inline] __sys_socket_create net/socket.c:1653 [inline] __
000000000400 Call Trace: <TASK> sock_create net/socket.c:1616 [inline] __sys_socket_create net/socket.c:1653 [inline] __sys_socket+0x150/0x3c0 net/socket.c:1700 __do_sys_socket net/socket.c:1714 [inline] __se_sys_socket net/socket.c:1712 [inline] For reference, see commit 2d859aff775d ("Merge branch 'do-not-leave-dangling-sk-pointers-in-pf-create-functions'") Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d2cc492124e1f22daa1700f069bcc58788043381 - https://git.kernel.org/stable/c/d293958a8595ba566fb90b99da4d6263e14fee15
CVE ID: CVE-2024-50294 State: PUBLISHED Published: 2024-11-19T01:30:40.699Z Last Updated: 2025-10-01T20:17:20.629Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing locking causing hanging calls If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abort will be prioritised over the connection and it will be removed from local->new_client_calls by rxrpc_disconnect_client_call() without a lock being held. This may cause other calls on the list to disappear if a race occurs. Fix this by taking the client_call_lock when removing a
ay cause other calls on the list to disappear if a race occurs. Fix this by taking the client_call_lock when removing a call from whatever list its ->wait_link happens to be on. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/996a7208dadbf2cdda8d51444d5ee1fdd1ccbc92 - https://git.kernel.org/stable/c/b1fdb0bb3b6513f5bd26f92369fd6ac1a2422d8b - https://git.kernel.org/stable/c/fc9de52de38f656399d2ce40f7349a6b5f86e787
CVE ID: CVE-2024-50295 State: PUBLISHED Published: 2024-11-19T01:30:41.999Z Last Updated: 2025-11-03T22:28:13.813Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: arc: fix the device for dma_map_single/dma_unmap_single The ndev->dev and pdev->dev aren't the same device, use ndev->dev.parent which has dma_mask, ndev->dev.parent is just pdev->dev. Or it would cause the following issue: [ 39.933526] ------------[ cut here ]------------ [ 39.938414] WARNING: CPU: 1 PID: 501 at kernel/dma/mapping.c:149 dma_map_page_attrs+0x90/0x1f8 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/3
page_attrs+0x90/0x1f8 Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/30606ea3fae57f8e9f2467415389e988e3c53a18 - https://git.kernel.org/stable/c/3898393b5483c8aa2efd7cb13aa70e22078ab022 - https://git.kernel.org/stable/c/fd4e062fbc07156f8e9d73212d347c744572677e - https://git.kernel.org/stable/c/8ed7a4a39c3f7cd9655af867e878fda512ae67ad - https://git.kernel.org/stable/c/cd4706d9ac0d8d3bab8dc9e50cc1187f6cfa43dd - https://git.kernel.org/stable/c/71803c1dfa29e0d13b99e48fda11107cc8caebc7
CVE ID: CVE-2024-50296 State: PUBLISHED Published: 2024-11-19T01:30:43.318Z Last Updated: 2025-11-03T22:28:15.254Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninstalled and the VF is disabled concurrently, a kernel crash occurs. The reason is that the two actions call function pci_disable_sriov(). The num_VFs is checked to determine whether to release the corresponding resources. During the second calling, num_VFs is not 0 and the resource release function is called. However, the corresponding resource has been released during the first invoking. There
ource release function is called. However, the corresponding resource has been released during the first invoking. Therefore, the problem occurs: [15277.839633][T50670] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... [15278.131557][T50670] Call trace: [15278.134686][T50670] klist_put+0x28/0x12c [15278.138682][T50670] klist_del+0x14/0x20 [15278.142592][T50670] device_del+0xbc/0x3c0 [15278.146676][T50670] pci_remove_bus_device+0x84/0x120 [15278.151714][T50670] pci_stop_and_remove_bus_device+0x6c/0x80 [15278.157447][T50670] pci_iov_remove_virtfn+0xb4/0x12c [15278.162485][T50670] sriov_disable+0x50/0x11c [15278.166829][T50670] pci_disable_sriov+0x24/0x30
ve_virtfn+0xb4/0x12c [15278.162485][T50670] sriov_disable+0x50/0x11c [15278.166829][T50670] pci_disable_sriov+0x24/0x30 [15278.171433][T50670] hnae3_unregister_ae_algo_prepare+0x60/0x90 [hnae3] [15278.178039][T50670] hclge_exit+0x28/0xd0 [hclge] [15278.182730][T50670] __se_sys_delete_module.isra.0+0x164/0x230 [15278.188550][T50670] __arm64_sys_delete_module+0x1c/0x30 [15278.193848][T50670] invoke_syscall+0x50/0x11c [15278.198278][T50670] el0_svc_common.constprop.0+0x158/0x164 [15278.203837][T50670] do_el0_svc+0x34/0xcc [15278.207834][T50670] el0_svc+0x20/0x30 For details, see the following figure. rmmod hclge disable VFs ---------------------------------------------------- hclge_exit() sriov
ee the following figure. rmmod hclge disable VFs ---------------------------------------------------- hclge_exit() sriov_numvfs_store() ... device_lock() pci_disable_sriov() hns3_pci_sriov_configure() pci_disable_sriov() sriov_disable() sriov_disable() if !num_VFs : if !num_VFs : return; return; sriov_del_vfs() sriov_del_vfs() ... ... klist_put() klist_put() ... ... num_VFs = 0; num_VFs = 0; device_unlock(); In this patch, when driver is removing, we get the device_lock() to protect num_VFs, just like sriov_numvfs_store(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a0df055775f30850c0da8f7dab40d67c0fd63908 - https:
- CVE Program Container: References: - https://git.kernel.org/stable/c/a0df055775f30850c0da8f7dab40d67c0fd63908 - https://git.kernel.org/stable/c/7ae4e56de7dbd0999578246a536cf52a63f4056d - https://git.kernel.org/stable/c/590a4b2d4e0b73586e88bce9b8135b593355ec09 - https://git.kernel.org/stable/c/e36482b222e00cc7aeeea772fc0cf2943590bc4d - https://git.kernel.org/stable/c/76b155e14d9b182ce83d32ada2d0d7219ea8c8dd - https://git.kernel.org/stable/c/719edd9f3372ce7fb3b157647c6658672946874b - https://git.kernel.org/stable/c/b5c94e4d947d15d521e935ff10c5a22a7883dea5 - https://git.kernel.org/stable/c/df3dff8ab6d79edc942464999d06fbaedf8cdd18
CVE ID: CVE-2024-50297 State: PUBLISHED Published: 2024-11-19T01:30:44.680Z Last Updated: 2025-10-01T20:17:20.345Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Enqueue Tx packets in dql before dmaengine starts Enqueue packets in dql after dma engine starts causes race condition. Tx transfer starts once dma engine is started and may execute dql dequeue in completion before it gets queued. It results in following kernel crash while running iperf stress test: kernel BUG at lib/dynamic_queue_limits.c:99! <snip> Internal error: Oops - BUG: 00000000f2000800 [#1] SMP pc : dql_completed+0x238/0x248 lr : dql_comp
e_limits.c:99! <snip> Internal error: Oops - BUG: 00000000f2000800 [#1] SMP pc : dql_completed+0x238/0x248 lr : dql_completed+0x3c/0x248 Call trace: dql_completed+0x238/0x248 axienet_dma_tx_cb+0xa0/0x170 xilinx_dma_do_tasklet+0xdc/0x290 tasklet_action_common+0xf8/0x11c tasklet_action+0x30/0x3c handle_softirqs+0xf8/0x230 <snip> Start dmaengine after enqueue in dql fixes the crash. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/def3dee25cbd1c9b2ed443c3f6180e952563de77 - https://git.kernel.org/stable/c/5ccdcdf186aec6b9111845fd37e1757e9b413e2f