Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-49272 State: PUBLISHED Published: 2025-02-26T01:56:18.626Z Last Updated: 2025-05-04T08:33:54.705Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recent fix to cover the racy read/write and other ioctls, and in that commit, I overlooked a (hopefully only) corner case that may take the revert lock, namely, the OSS mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside the OSS mmap syscall, where mm
S mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside the OSS mmap syscall, where mm->mmap_mutex is already held. Meanwhile, the copy_from/to_user calls at read/write operations also take the mm->mmap_lock internally, hence it may lead to a AB/BA deadlock. A similar problem was already seen in the past and we fixed it with a refcount (in commit b248371628aa). The former fix covered only the call paths with OSS read/write and OSS ioctls, while we need to cover the concurrent access via both ALSA and OSS APIs now. This patch addresses the problem above by replacing the buffer_mutex lock in the read/write operations with a refcount similar as we've used for O
roblem above by replacing the buffer_mutex lock in the read/write operations with a refcount similar as we've used for OSS. The new field, runtime->buffer_accessing, keeps the number of concurrent read/write operations. Unlike the former buffer_mutex protection, this protects only around the copy_from/to_user() calls; the other codes are basically protected by the PCM stream lock. The refcount can be a negative, meaning blocked by the ioctls. If a negative value is seen, the read/write aborts with -EBUSY. In the ioctl side, OTOH, they check this refcount, too, and set to a negative value for blocking unless it's already being accessed. References: - https://git.kernel.org/stable/c/7e9133607e
negative value for blocking unless it's already being accessed. References: - https://git.kernel.org/stable/c/7e9133607e1501c94881be35e118d8f84d96dcb4 - https://git.kernel.org/stable/c/40f4cffbe13a51faf136faf5f9ef6847782cd595 - https://git.kernel.org/stable/c/9661bf674d6a82b76e4ae424438a8ce1e3ed855d - https://git.kernel.org/stable/c/9017201e8d8c6d1472273361389ed431188584a0 - https://git.kernel.org/stable/c/7777744e92a0b30e3e0cce2758d911837011ebd9 - https://git.kernel.org/stable/c/abedf0d08c79d76da0d6fa0d5dbbc98871dcbc2e - https://git.kernel.org/stable/c/be9813ad2fc8f0885f5ce6925af0d993ce5da4e5 - https://git.kernel.org/stable/c/bc55cfd5718c7c23e5524582e9fa70b4d10f2433
CVE ID: CVE-2022-49273 State: PUBLISHED Published: 2025-02-26T01:56:19.110Z Last Updated: 2025-10-01T19:47:02.065Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtc: pl031: fix rtc features null pointer dereference When there is no interrupt line, rtc alarm feature is disabled. The clearing of the alarm feature bit was being done prior to allocations of ldata->rtc device, resulting in a null pointer dereference. Clear RTC_FEATURE_ALARM after the rtc device is allocated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/cd2722e411e8ab7e5ae41102f6925fa13dffdac5 - https://git.kernel.
lnrichment: References: - https://git.kernel.org/stable/c/cd2722e411e8ab7e5ae41102f6925fa13dffdac5 - https://git.kernel.org/stable/c/d274ce4a3dfd0b9a292667535578359b865765cb - https://git.kernel.org/stable/c/1b915703964f7e636961df04c540261dc55c6c70 - https://git.kernel.org/stable/c/ea6af39f3da50c86367a71eb3cc674ade3ed244c
CVE ID: CVE-2022-49274 State: PUBLISHED Published: 2025-02-26T01:56:19.586Z Last Updated: 2025-05-04T08:33:57.145Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix crash when mount with quota enabled There is a reported crash when mounting ocfs2 with quota enabled. RIP: 0010:ocfs2_qinfo_lock_res_init+0x44/0x50 [ocfs2] Call Trace: ocfs2_local_read_info+0xb9/0x6f0 [ocfs2] dquot_load_quota_sb+0x216/0x470 dquot_load_quota_inode+0x85/0x100 ocfs2_enable_quotas+0xa0/0x1c0 [ocfs2] ocfs2_fill_super.cold+0xc8/0x1bf [ocfs2] mount_bdev+0x185/0x1b0 legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 path_mount+0x465/0xac0 __x64_sys_mo
x1bf [ocfs2] mount_bdev+0x185/0x1b0 legacy_get_tree+0x27/0x40 vfs_get_tree+0x25/0xb0 path_mount+0x465/0xac0 __x64_sys_mount+0x103/0x140 It is caused by when initializing dqi_gqlock, the corresponding dqi_type and dqi_sb are not properly initialized. This issue is introduced by commit 6c85c2c72819, which wants to avoid accessing uninitialized variables in error cases. So make global quota info properly initialized. References: - https://git.kernel.org/stable/c/7c5312fdb1dcfdc1951b018669af88d5d6420b31 - https://git.kernel.org/stable/c/01931e1c4e3de5d777253acae64c0e8fd071a1dd - https://git.kernel.org/stable/c/eda31f77317647b9fbf889779ee1fb6907651865 - https://git.kernel.org/stable/c/de19433423c
- https://git.kernel.org/stable/c/eda31f77317647b9fbf889779ee1fb6907651865 - https://git.kernel.org/stable/c/de19433423c7bedabbd4f9a25f7dbc62c5e78921
CVE ID: CVE-2022-49275 State: PUBLISHED Published: 2025-02-26T01:56:20.066Z Last Updated: 2025-05-04T08:33:58.443Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_tx_handler(): fix use after free of skb can_put_echo_skb() will clone skb then free the skb. Move the can_put_echo_skb() for the m_can version 3.0.x directly before the start of the xmit in hardware, similar to the 3.1.x branch. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d93ed9aff64968f4cdad690712eb4f48ae537bde - https://git.kernel.org/stable/c/d3892a747ab16b1eb6593a19d29f62c3b3f020ac - https://git
64968f4cdad690712eb4f48ae537bde - https://git.kernel.org/stable/c/d3892a747ab16b1eb6593a19d29f62c3b3f020ac - https://git.kernel.org/stable/c/7728d937ec403a1ceff9483023252d2cb8777f81 - https://git.kernel.org/stable/c/08d90846e438ac22dc56fc49ec0b0d195831c5ed - https://git.kernel.org/stable/c/869016a2938ac44f7b2fb7fc22c89edad99eb9b3 - https://git.kernel.org/stable/c/f43e64076ff1b1dcb893fb77ad1204105f710a29 - https://git.kernel.org/stable/c/4db7d6f481990dd179a9ee7126dc7aa31ea4fff3 - https://git.kernel.org/stable/c/31417073493f302d26ab66b3abc098d43227b835 - https://git.kernel.org/stable/c/2e8e79c416aae1de224c0f1860f2e3350fa171f8
CVE ID: CVE-2022-49276 State: PUBLISHED Published: 2025-02-26T01:56:20.559Z Last Updated: 2025-10-01T19:47:01.833Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: jffs2: fix memory leak in jffs2_scan_medium If an error is returned in jffs2_scan_eraseblock() and some memory has been added to the jffs2_summary *s, we can observe the following kmemleak report: -------------------------------------------- unreferenced object 0xffff88812b889c40 (size 64): comm "mount", pid 692, jiffies 4294838325 (age 34.288s) hex dump (first 32 bytes): 40 48 b5 14 81 88 ff ff 01 e0 31 00 00 00 50 00 @H........1...P. 00 00 01 00 00 00 01 00 00 00 02
ump (first 32 bytes): 40 48 b5 14 81 88 ff ff 01 e0 31 00 00 00 50 00 @H........1...P. 00 00 01 00 00 00 01 00 00 00 02 00 00 00 09 08 ................ backtrace: [<ffffffffae93a3a3>] __kmalloc+0x613/0x910 [<ffffffffaf423b9c>] jffs2_sum_add_dirent_mem+0x5c/0xa0 [<ffffffffb0f3afa8>] jffs2_scan_medium.cold+0x36e5/0x4794 [<ffffffffb0f3dbe1>] jffs2_do_mount_fs.cold+0xa7/0x2267 [<ffffffffaf40acf3>] jffs2_do_fill_super+0x383/0xc30 [<ffffffffaf40c00a>] jffs2_fill_super+0x2ea/0x4c0 [<ffffffffb0315d64>] mtd_get_sb+0x254/0x400 [<ffffffffb0315f5f>] mtd_get_sb_by_nr+0x4f/0xd0 [<ffffffffb0316478>] get_tree_mtd+0x498/0x840 [<ffffffffaf40bd15>] jffs2_get_tree+0x25/0x30 [<ffffffffae9f358d>] vfs_get_tree+0x8
fb0316478>] get_tree_mtd+0x498/0x840 [<ffffffffaf40bd15>] jffs2_get_tree+0x25/0x30 [<ffffffffae9f358d>] vfs_get_tree+0x8d/0x2e0 [<ffffffffaea7a98f>] path_mount+0x50f/0x1e50 [<ffffffffaea7c3d7>] do_mount+0x107/0x130 [<ffffffffaea7c5c5>] __se_sys_mount+0x1c5/0x2f0 [<ffffffffaea7c917>] __x64_sys_mount+0xc7/0x160 [<ffffffffb10142f5>] do_syscall_64+0x45/0x70 unreferenced object 0xffff888114b54840 (size 32): comm "mount", pid 692, jiffies 4294838325 (age 34.288s) hex dump (first 32 bytes): c0 75 b5 14 81 88 ff ff 02 e0 02 00 00 00 02 00 .u.............. 00 00 84 00 00 00 44 00 00 00 6b 6b 6b 6b 6b a5 ......D...kkkkk. backtrace: [<ffffffffae93be24>] kmem_cache_alloc_trace+0x584/0x880 [<ffffffffaf42
00 6b 6b 6b 6b 6b a5 ......D...kkkkk. backtrace: [<ffffffffae93be24>] kmem_cache_alloc_trace+0x584/0x880 [<ffffffffaf423b04>] jffs2_sum_add_inode_mem+0x54/0x90 [<ffffffffb0f3bd44>] jffs2_scan_medium.cold+0x4481/0x4794 [...] unreferenced object 0xffff888114b57280 (size 32): comm "mount", pid 692, jiffies 4294838393 (age 34.357s) hex dump (first 32 bytes): 10 d5 6c 11 81 88 ff ff 08 e0 05 00 00 00 01 00 ..l............. 00 00 38 02 00 00 28 00 00 00 6b 6b 6b 6b 6b a5 ..8...(...kkkkk. backtrace: [<ffffffffae93be24>] kmem_cache_alloc_trace+0x584/0x880 [<ffffffffaf423c34>] jffs2_sum_add_xattr_mem+0x54/0x90 [<ffffffffb0f3a24f>] jffs2_scan_medium.cold+0x298c/0x4794 [...] unreferenced object 0xffff
2_sum_add_xattr_mem+0x54/0x90 [<ffffffffb0f3a24f>] jffs2_scan_medium.cold+0x298c/0x4794 [...] unreferenced object 0xffff8881116cd510 (size 16): comm "mount", pid 692, jiffies 4294838395 (age 34.355s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 09 e0 60 02 00 00 6b a5 ..........`...k. backtrace: [<ffffffffae93be24>] kmem_cache_alloc_trace+0x584/0x880 [<ffffffffaf423cc4>] jffs2_sum_add_xref_mem+0x54/0x90 [<ffffffffb0f3b2e3>] jffs2_scan_medium.cold+0x3a20/0x4794 [...] -------------------------------------------- Therefore, we should call jffs2_sum_reset_collected(s) on exit to release the memory added in s. In addition, a new tag "out_buf" is added to prevent the NULL pointer reference c
exit to release the memory added in s. In addition, a new tag "out_buf" is added to prevent the NULL pointer reference caused by s being NULL. (thanks to Zhang Yi for this analysis) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9b0c69182f09b70779817af4dcf89780955d5c4c - https://git.kernel.org/stable/c/b36bccb04e14cc0c1e2d0e92d477fe220314fad6 - https://git.kernel.org/stable/c/e711913463af916d777a4873068f415f1fe2ad33 - https://git.kernel.org/stable/c/455f4a23490bfcbedc8e5c245c463a59b19e5ddd - https://git.kernel.org/stable/c/51dbb5e36d59f62e34d462b801c1068248149cfe - https://git.kernel.org/stable/c/52ba0ab4f0a606f02a6163493378989faa1ec10a - htt
1dbb5e36d59f62e34d462b801c1068248149cfe - https://git.kernel.org/stable/c/52ba0ab4f0a606f02a6163493378989faa1ec10a - https://git.kernel.org/stable/c/b26bbc0c122cad038831f226a4cb4de702225e16 - https://git.kernel.org/stable/c/82462324bf35b6b553400af1c1aa265069cee28f - https://git.kernel.org/stable/c/9cdd3128874f5fe759e2c4e1360ab7fb96a8d1df
CVE ID: CVE-2022-49277 State: PUBLISHED Published: 2025-02-26T01:56:21.037Z Last Updated: 2025-10-01T19:47:01.249Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: jffs2: fix memory leak in jffs2_do_mount_fs If jffs2_build_filesystem() in jffs2_do_mount_fs() returns an error, we can observe the following kmemleak report: -------------------------------------------- unreferenced object 0xffff88811b25a640 (size 64): comm "mount", pid 691, jiffies 4294957728 (age 71.952s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtr
0 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffffa493be24>] kmem_cache_alloc_trace+0x584/0x880 [<ffffffffa5423a06>] jffs2_sum_init+0x86/0x130 [<ffffffffa5400e58>] jffs2_do_mount_fs+0x798/0xac0 [<ffffffffa540acf3>] jffs2_do_fill_super+0x383/0xc30 [<ffffffffa540c00a>] jffs2_fill_super+0x2ea/0x4c0 [...] unreferenced object 0xffff88812c760000 (size 65536): comm "mount", pid 691, jiffies 4294957728 (age 71.952s) hex dump (first 32 bytes): bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ backtrace: [<ffffffffa493a449>] __kmalloc+0x6b
........ bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ backtrace: [<ffffffffa493a449>] __kmalloc+0x6b9/0x910 [<ffffffffa5423a57>] jffs2_sum_init+0xd7/0x130 [<ffffffffa5400e58>] jffs2_do_mount_fs+0x798/0xac0 [<ffffffffa540acf3>] jffs2_do_fill_super+0x383/0xc30 [<ffffffffa540c00a>] jffs2_fill_super+0x2ea/0x4c0 [...] -------------------------------------------- This is because the resources allocated in jffs2_sum_init() are not released. Call jffs2_sum_exit() to release these resources to solve the problem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2a9d8184458562e6bf2f40d0e677fc85e2dd3834 - https://git.kernel.org/stable/c
References: - https://git.kernel.org/stable/c/2a9d8184458562e6bf2f40d0e677fc85e2dd3834 - https://git.kernel.org/stable/c/9a0f6610c7daedd2eace430beeb08a8b7ac80699 - https://git.kernel.org/stable/c/dbe0d0521eaa6a3d235517319266c539bb5c5112 - https://git.kernel.org/stable/c/0978e9af4559a171ac7a74a1b3ef21804b0a0fa9 - https://git.kernel.org/stable/c/607d3aab7349f18e0d9dba4100d09d16fe27caca - https://git.kernel.org/stable/c/4392e8aeebc5a4f8073620bccba7de1b1f6d7c88 - https://git.kernel.org/stable/c/5f34310d1376ca5b2ed798258def2c2ab3cc6699 - https://git.kernel.org/stable/c/c94128470e6fe53d9bd9d16d2d3271813f9d37af - https://git.kernel.org/stable/c/d051cef784de4d54835f6b6836d98a8f6935772c
CVE ID: CVE-2022-49278 State: PUBLISHED Published: 2025-02-26T01:56:21.546Z Last Updated: 2025-05-04T08:34:02.129Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: remoteproc: Fix count check in rproc_coredump_write() Check count for 0, to avoid a potential underflow. Make the check the same as the one in rproc_recovery_write(). References: - https://git.kernel.org/stable/c/b97b305656a7013690e7b6e310f0e827e0bbff90 - https://git.kernel.org/stable/c/34afac3c75fa08d6fabbab4c93f0a90618afaaa6 - https://git.kernel.org/stable/c/a8c3e53517985d69040a1b36a269e85f99cf0cea - https://git.kernel.org/stable/c/11572dad9fbadbd9269a2550f7e236b5b8c
/stable/c/a8c3e53517985d69040a1b36a269e85f99cf0cea - https://git.kernel.org/stable/c/11572dad9fbadbd9269a2550f7e236b5b8c2d80c - https://git.kernel.org/stable/c/f89672cc3681952f2d06314981a6b45f8b0045d1
CVE ID: CVE-2022-49279 State: PUBLISHED Published: 2025-02-26T01:56:22.051Z Last Updated: 2025-10-01T19:47:01.079Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent integer overflow on 32 bit systems On a 32 bit system, the "len * sizeof(*p)" operation can have an integer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/3a2789e8ccb4a3e2a631f6817a2d3bb98b8c4fd8 - https://git.kernel.org/stable/c/ce1aa09cc14ed625104acc2d487bd92b9a88efe2 - https://git.kernel.org/stable/c/7af164fa2f1abc577d357d22d83a2f3490875d7e - https://git.kernel.org/stable/c/303cd6173dce0a28d26
//git.kernel.org/stable/c/7af164fa2f1abc577d357d22d83a2f3490875d7e - https://git.kernel.org/stable/c/303cd6173dce0a28d26526c77814eb90a41bd898 - https://git.kernel.org/stable/c/79b1c54fc6ce09ee0d5fe088bb3de26ae2150e3c - https://git.kernel.org/stable/c/e4195d27306ea468a6dc3a27af6f586709951229 - https://git.kernel.org/stable/c/23a9dbbe0faf124fc4c139615633b9d12a3a89ef
CVE ID: CVE-2022-49280 State: PUBLISHED Published: 2025-02-26T01:56:22.662Z Last Updated: 2025-10-01T19:47:00.943Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSD: prevent underflow in nfssvc_decode_writeargs() Smatch complains: fs/nfsd/nfsxdr.c:341 nfssvc_decode_writeargs() warn: no lower bound on 'args->len' Change the type to unsigned to prevent this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1a33e0de60feda402d05ac8a6cf409c19ea3e0b3 - https://git.kernel.org/stable/c/438068f4912183a59fcb6b7496a06437f7fd4e2b - https://git.kernel.org/stable/c/9f0f048c1bfa7867d565a
git.kernel.org/stable/c/438068f4912183a59fcb6b7496a06437f7fd4e2b - https://git.kernel.org/stable/c/9f0f048c1bfa7867d565a95fd8c28f4484ba1043 - https://git.kernel.org/stable/c/85259340fc9bd54e3d567b41b881ecb4d0055da1 - https://git.kernel.org/stable/c/65e21cc042f4c1518c8c55283f53bc725b78419d - https://git.kernel.org/stable/c/614a61e1592051cc42d3c38f899c9f7bdaad8a1d - https://git.kernel.org/stable/c/2764af8ce0bf03cc43ee4a11897cab96bde6caae - https://git.kernel.org/stable/c/413d8fefafe531a9442bb623e3fe292a38f88d65 - https://git.kernel.org/stable/c/184416d4b98509fb4c3d8fc3d6dc1437896cc159
CVE ID: CVE-2022-49281 State: PUBLISHED Published: 2025-02-26T01:56:23.201Z Last Updated: 2025-05-04T08:34:05.720Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: fix handlecache and multiuser In multiuser each individual user has their own tcon structure for the share and thus their own handle for a cached directory. When we umount such a share we much make sure to release the pinned down dentry for each such tcon and not just the master tcon. Otherwise we will get nasty warnings on umount that dentries are still in use: [ 3459.590047] BUG: Dentry 00000000115c6f41{i=12000000019d95,n=/} still in use\ (2) [unmount of cifs c
are still in use: [ 3459.590047] BUG: Dentry 00000000115c6f41{i=12000000019d95,n=/} still in use\ (2) [unmount of cifs cifs] ... [ 3459.590492] Call Trace: [ 3459.590500] d_walk+0x61/0x2a0 [ 3459.590518] ? shrink_lock_dentry.part.0+0xe0/0xe0 [ 3459.590526] shrink_dcache_for_umount+0x49/0x110 [ 3459.590535] generic_shutdown_super+0x1a/0x110 [ 3459.590542] kill_anon_super+0x14/0x30 [ 3459.590549] cifs_kill_sb+0xf5/0x104 [cifs] [ 3459.590773] deactivate_locked_super+0x36/0xa0 [ 3459.590782] cleanup_mnt+0x131/0x190 [ 3459.590789] task_work_run+0x5c/0x90 [ 3459.590798] exit_to_user_mode_loop+0x151/0x160 [ 3459.590809] exit_to_user_mode_prepare+0x83/0xd0 [ 3459.590818] syscall_exit_to_user_mode+0x
ser_mode_loop+0x151/0x160 [ 3459.590809] exit_to_user_mode_prepare+0x83/0xd0 [ 3459.590818] syscall_exit_to_user_mode+0x12/0x30 [ 3459.590828] do_syscall_64+0x48/0x90 [ 3459.590833] entry_SYSCALL_64_after_hwframe+0x44/0xae References: - https://git.kernel.org/stable/c/2fafbc198613823943c106d1ec9b516da692059f - https://git.kernel.org/stable/c/ffa631c4bff59dde59b598011f570e27dfba3515 - https://git.kernel.org/stable/c/e71f6a3a1d5c826a30384fec587ca7503ef6bde5 - https://git.kernel.org/stable/c/47178c7722ac528ea08aa82c3ef9ffa178962d7a
CVE ID: CVE-2022-49282 State: PUBLISHED Published: 2025-02-26T01:56:23.679Z Last Updated: 2025-10-01T19:47:00.807Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: quota: fix loop condition at f2fs_quota_sync() cnt should be passed to sb_has_quota_active() instead of type to check active quota properly. Moreover, when the type is -1, the compiler with enough inline knowledge can discard sb_has_quota_active() check altogether, causing a NULL pointer dereference at the following inode_lock(dqopt->files[cnt]): [ 2.796010] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [ 2.796024] Mem abort
: [ 2.796010] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [ 2.796024] Mem abort info: [ 2.796025] ESR = 0x96000005 [ 2.796028] EC = 0x25: DABT (current EL), IL = 32 bits [ 2.796029] SET = 0, FnV = 0 [ 2.796031] EA = 0, S1PTW = 0 [ 2.796032] Data abort info: [ 2.796034] ISV = 0, ISS = 0x00000005 [ 2.796035] CM = 0, WnR = 0 [ 2.796046] user pgtable: 4k pages, 39-bit VAs, pgdp=00000003370d1000 [ 2.796048] [00000000000000a0] pgd=0000000000000000, pud=0000000000000000 [ 2.796051] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 2.796056] CPU: 7 PID: 640 Comm: f2fs_ckpt-259:7 Tainted: G S 5.4.179-arter97-r8-64666-g2f16e087f9d8 #1 [ 2.796057] Hardware name:
CPU: 7 PID: 640 Comm: f2fs_ckpt-259:7 Tainted: G S 5.4.179-arter97-r8-64666-g2f16e087f9d8 #1 [ 2.796057] Hardware name: Qualcomm Technologies, Inc. Lahaina MTP lemonadep (DT) [ 2.796059] pstate: 80c00005 (Nzcv daif +PAN +UAO) [ 2.796065] pc : down_write+0x28/0x70 [ 2.796070] lr : f2fs_quota_sync+0x100/0x294 [ 2.796071] sp : ffffffa3f48ffc30 [ 2.796073] x29: ffffffa3f48ffc30 x28: 0000000000000000 [ 2.796075] x27: ffffffa3f6d718b8 x26: ffffffa415fe9d80 [ 2.796077] x25: ffffffa3f7290048 x24: 0000000000000001 [ 2.796078] x23: 0000000000000000 x22: ffffffa3f7290000 [ 2.796080] x21: ffffffa3f72904a0 x20: ffffffa3f7290110 [ 2.796081] x19: ffffffa3f77a9800 x18: ffffffc020aae038 [ 2.796083] x17: fff
x21: ffffffa3f72904a0 x20: ffffffa3f7290110 [ 2.796081] x19: ffffffa3f77a9800 x18: ffffffc020aae038 [ 2.796083] x17: ffffffa40e38e040 x16: ffffffa40e38e6d0 [ 2.796085] x15: ffffffa40e38e6cc x14: ffffffa40e38e6d0 [ 2.796086] x13: 00000000000004f6 x12: 00162c44ff493000 [ 2.796088] x11: 0000000000000400 x10: ffffffa40e38c948 [ 2.796090] x9 : 0000000000000000 x8 : 00000000000000a0 [ 2.796091] x7 : 0000000000000000 x6 : 0000d1060f00002a [ 2.796093] x5 : ffffffa3f48ff718 x4 : 000000000000000d [ 2.796094] x3 : 00000000060c0000 x2 : 0000000000000001 [ 2.796096] x1 : 0000000000000000 x0 : 00000000000000a0 [ 2.796098] Call trace: [ 2.796100] down_write+0x28/0x70 [ 2.796102] f2fs_quota_sync+0x100/0x294
0 x0 : 00000000000000a0 [ 2.796098] Call trace: [ 2.796100] down_write+0x28/0x70 [ 2.796102] f2fs_quota_sync+0x100/0x294 [ 2.796104] block_operations+0x120/0x204 [ 2.796106] f2fs_write_checkpoint+0x11c/0x520 [ 2.796107] __checkpoint_and_complete_reqs+0x7c/0xd34 [ 2.796109] issue_checkpoint_thread+0x6c/0xb8 [ 2.796112] kthread+0x138/0x414 [ 2.796114] ret_from_fork+0x10/0x18 [ 2.796117] Code: aa0803e0 aa1f03e1 52800022 aa0103e9 (c8e97d02) [ 2.796120] ---[ end trace 96e942e8eb6a0b53 ]--- [ 2.800116] Kernel panic - not syncing: Fatal exception [ 2.800120] SMP: stopping secondary CPUs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f1d5946d47c0827b
y CPUs Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f1d5946d47c0827bae39e1537959ce8d6f0224c5 - https://git.kernel.org/stable/c/e58ee6bd939b773675240f5d0f5b88a367c037c4 - https://git.kernel.org/stable/c/f9156db0987f1b426015d56505e2c58dee70c90d - https://git.kernel.org/stable/c/e9ebf1e8fc50b6a9336f9aea1082d7845e568d0e - https://git.kernel.org/stable/c/724469814d805820cd37ea789769dba94123ff1a - https://git.kernel.org/stable/c/680af5b824a52faa819167628665804a14f0e0df
CVE ID: CVE-2022-49283 State: PUBLISHED Published: 2025-02-26T01:56:24.155Z Last Updated: 2025-05-04T08:34:12.930Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firmware: sysfb: fix platform-device leak in error path Make sure to free the platform device also in the unlikely event that registration fails. References: - https://git.kernel.org/stable/c/b3e38f939ab4d0d86f56bff3362c3f88c4b2ad32 - https://git.kernel.org/stable/c/bb7fcbe80a013dc883181dc818c407d38558f76c - https://git.kernel.org/stable/c/fed4df558b8cdb6f3beea38a7c977f118f082b0d - https://git.kernel.org/stable/c/202c08914ba50dd324e42d5ad99535a89f242560