Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff888171306800 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 36 bytes to the right of 256-byte region [ffff888171306800, ffff888171306900) The buggy address belongs to the page: page:00000000bcfb624e refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x171306 head:00000000bcfb624e order:1 compound_mapcount:0 flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) raw: 0017ffffc0010200 dead000000000100 dead000000000122 ffff888100042b40 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad acc
88100042b40 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888171306800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888171306880: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc >ffff888171306900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888171306980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888171306a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fix fq_pie traffic path to avoid selecting 'q->flows + q->flows_cnt' as a valid flow: it's an address beyond the allocated memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program
alid flow: it's an address beyond the allocated memory. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e6294c06e7c62ffdd5bf3df696d3a4fcbb753d3c - https://git.kernel.org/stable/c/7a1bdec12e43e29cc34a4394590337069d8812ce - https://git.kernel.org/stable/c/e70f7a11876a1a788ceadf75e9e5f7af2c868680
CVE ID: CVE-2021-47176 State: PUBLISHED Published: 2024-03-25T09:16:26.731Z Last Updated: 2025-05-04T07:05:41.463Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: s390/dasd: add missing discipline function Fix crash with illegal operation exception in dasd_device_tasklet. Commit b72949328869 ("s390/dasd: Prepare for additional path event handling") renamed the verify_path function for ECKD but not for FBA and DIAG. This leads to a panic when the path verification function is called for a FBA or DIAG device. Fix by defining a wrapper function for dasd_generic_verify_path(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE
by defining a wrapper function for dasd_generic_verify_path(). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6a16810068e70959bc1df686424aa35ce05578f1 - https://git.kernel.org/stable/c/aa8579bc084673c651204f7cd0d6308a47dffc16 - https://git.kernel.org/stable/c/a16be88a3d7e5efcb59a15edea87a8bd369630c6 - https://git.kernel.org/stable/c/c0c8a8397fa8a74d04915f4d3d28cb4a5d401427
CVE ID: CVE-2021-47177 State: PUBLISHED Published: 2024-03-25T09:16:27.371Z Last Updated: 2025-05-04T07:05:42.586Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix sysfs leak in alloc_iommu() iommu_device_sysfs_add() is called before, so is has to be cleaned on subsequent errors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/22da9f4978381a99f1abaeaf6c9b83be6ab5ddd8 - https://git.kernel.org/stable/c/2ec5e9bb6b0560c90d315559c28a99723c80b996 - https://git.kernel.org/stable/c/044bbe8b92ab4e542de7f6c93c88ea65cccd8e29 - https://git.kernel.org/st
9c28a99723c80b996 - https://git.kernel.org/stable/c/044bbe8b92ab4e542de7f6c93c88ea65cccd8e29 - https://git.kernel.org/stable/c/f01134321d04f47c718bb41b799bcdeda27873d2 - https://git.kernel.org/stable/c/ca466561eef36d1ec657673e3944eb6340bddb5b - https://git.kernel.org/stable/c/0ee74d5a48635c848c20f152d0d488bf84641304
CVE ID: CVE-2021-47178 State: PUBLISHED Published: 2024-03-25T09:16:28.024Z Last Updated: 2025-05-04T07:05:48.692Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Avoid smp_processor_id() in preemptible code The BUG message "BUG: using smp_processor_id() in preemptible [00000000] code" was observed for TCMU devices with kernel config DEBUG_PREEMPT. The message was observed when blktests block/005 was run on TCMU devices with fileio backend or user:zbc backend [1]. The commit 1130b499b4a7 ("scsi: target: tcm_loop: Use LIO wq cmd submission helper") triggered the symptom. The commit modified work queue to handl
csi: target: tcm_loop: Use LIO wq cmd submission helper") triggered the symptom. The commit modified work queue to handle commands and changed 'current->nr_cpu_allowed' at smp_processor_id() call. The message was also observed at system shutdown when TCMU devices were not cleaned up [2]. The function smp_processor_id() was called in SCSI host work queue for abort handling, and triggered the BUG message. This symptom was observed regardless of the commit 1130b499b4a7 ("scsi: target: tcm_loop: Use LIO wq cmd submission helper"). To avoid the preemptible code check at smp_processor_id(), get CPU ID with raw_smp_processor_id() instead. The CPU ID is used for performance improvement then thread m
essor_id(), get CPU ID with raw_smp_processor_id() instead. The CPU ID is used for performance improvement then thread move to other CPU will not affect the code. [1] [ 56.468103] run blktests block/005 at 2021-05-12 14:16:38 [ 57.369473] check_preemption_disabled: 85 callbacks suppressed [ 57.369480] BUG: using smp_processor_id() in preemptible [00000000] code: fio/1511 [ 57.369506] BUG: using smp_processor_id() in preemptible [00000000] code: fio/1510 [ 57.369512] BUG: using smp_processor_id() in preemptible [00000000] code: fio/1506 [ 57.369552] caller is __target_init_cmd+0x157/0x170 [target_core_mod] [ 57.369606] CPU: 4 PID: 1506 Comm: fio Not tainted 5.13.0-rc1+ #34 [ 57.369613] Hardwa
md+0x157/0x170 [target_core_mod] [ 57.369606] CPU: 4 PID: 1506 Comm: fio Not tainted 5.13.0-rc1+ #34 [ 57.369613] Hardware name: System manufacturer System Product Name/PRIME Z270-A, BIOS 1302 03/15/2018 [ 57.369617] Call Trace: [ 57.369621] BUG: using smp_processor_id() in preemptible [00000000] code: fio/1507 [ 57.369628] dump_stack+0x6d/0x89 [ 57.369642] check_preemption_disabled+0xc8/0xd0 [ 57.369628] caller is __target_init_cmd+0x157/0x170 [target_core_mod] [ 57.369655] __target_init_cmd+0x157/0x170 [target_core_mod] [ 57.369695] target_init_cmd+0x76/0x90 [target_core_mod] [ 57.369732] tcm_loop_queuecommand+0x109/0x210 [tcm_loop] [ 57.369744] scsi_queue_rq+0x38e/0xc40 [ 57.369761] __blk
mod] [ 57.369732] tcm_loop_queuecommand+0x109/0x210 [tcm_loop] [ 57.369744] scsi_queue_rq+0x38e/0xc40 [ 57.369761] __blk_mq_try_issue_directly+0x109/0x1c0 [ 57.369779] blk_mq_try_issue_directly+0x43/0x90 [ 57.369790] blk_mq_submit_bio+0x4e5/0x5d0 [ 57.369812] submit_bio_noacct+0x46e/0x4e0 [ 57.369830] __blkdev_direct_IO_simple+0x1a3/0x2d0 [ 57.369859] ? set_init_blocksize.isra.0+0x60/0x60 [ 57.369880] generic_file_read_iter+0x89/0x160 [ 57.369898] blkdev_read_iter+0x44/0x60 [ 57.369906] new_sync_read+0x102/0x170 [ 57.369929] vfs_read+0xd4/0x160 [ 57.369941] __x64_sys_pread64+0x6e/0xa0 [ 57.369946] ? lockdep_hardirqs_on+0x79/0x100 [ 57.369958] do_syscall_64+0x3a/0x70 [ 57.369965] entry_SYSCAL
4+0x6e/0xa0 [ 57.369946] ? lockdep_hardirqs_on+0x79/0x100 [ 57.369958] do_syscall_64+0x3a/0x70 [ 57.369965] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 57.369973] RIP: 0033:0x7f7ed4c1399f [ 57.369979] Code: 08 89 3c 24 48 89 4c 24 18 e8 7d f3 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 48 8b 74 24 08 8b 3c 24 b8 11 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 04 24 e8 cd f3 ff ff 48 8b [ 57.369983] RSP: 002b:00007ffd7918c580 EFLAGS: 00000293 ORIG_RAX: 0000000000000011 [ 57.369990] RAX: ffffffffffffffda RBX: 00000000015b4540 RCX: 00007f7ed4c1399f [ 57.369993] RDX: 0000000000001000 RSI: 00000000015de000 RDI: 0000000000000009 [ 57.369996] RBP: 00000000015b4540 R08: 0000000000000000 R
0000000000001000 RSI: 00000000015de000 RDI: 0000000000000009 [ 57.369996] RBP: 00000000015b4540 R08: 0000000000000000 R09: 0000000000000001 [ 57.369999] R10: 0000000000e5c000 R11: 0000000000000293 R12: 00007f7eb5269a70 [ 57.370002] R13: 0000000000000000 R14: 0000000000001000 R15: 00000000015b4568 [ 57.370031] CPU: 7 PID: 1507 Comm: fio Not tainted 5.13.0-rc1+ #34 [ 57.370036] Hardware name: System manufacturer System Product Name/PRIME Z270-A, BIOS 1302 03/15/2018 [ 57.370039] Call Trace: [ 57.370045] dump_stack+0x6d/0x89 [ 57.370056] ch ---truncated--- Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a222d2794c53f8165
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/a222d2794c53f8165de20aa91b39e35e4b72bce9 - https://git.kernel.org/stable/c/a20b6eaf4f35046a429cde57bee7eb5f13d6857f - https://git.kernel.org/stable/c/70ca3c57ff914113f681e657634f7fbfa68e1ad1
CVE ID: CVE-2021-47179 State: PUBLISHED Published: 2024-03-25T09:16:28.787Z Last Updated: 2025-05-04T12:41:11.823Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() Commit de144ff4234f changes _pnfs_return_layout() to call pnfs_mark_matching_lsegs_return() passing NULL as the struct pnfs_layout_range argument. Unfortunately, pnfs_mark_matching_lsegs_return() doesn't check if we have a value here before dereferencing it, causing an oops. I'm able to hit this crash consistently when running connectathon basic tests on NFS v4.1/v4.2 against Ontap. Additional A
m able to hit this crash consistently when running connectathon basic tests on NFS v4.1/v4.2 against Ontap. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4e1ba532dbc1a0e19fc2458d74ab8d98680c4e42 - https://git.kernel.org/stable/c/42637ca25c7d7b5a92804a679af5192e8c1a9f48 - https://git.kernel.org/stable/c/39785761feadf261bc5101372b0b0bbaf6a94494 - https://git.kernel.org/stable/c/aba3c7795f51717ae316f3566442dee7cc3eeccb - https://git.kernel.org/stable/c/f9890652185b72b8de9ebeb4406037640b6e1b53 - https://git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a - https://git.kernel.org/stable/c/a421d218603ffa822a0b
/git.kernel.org/stable/c/b090d110e66636bca473fd8b98d5c97b555a965a - https://git.kernel.org/stable/c/a421d218603ffa822a0b8045055c03eae394a7eb
CVE ID: CVE-2021-47180 State: PUBLISHED Published: 2024-03-25T09:16:29.580Z Last Updated: 2025-05-04T07:05:50.928Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFC: nci: fix memory leak in nci_allocate_device nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev. Fix this by freeing hci_dev in nci_free_device. BUG: memory leak unreferenced object 0xffff888111ea6800 (size 1024): comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff .........`...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000
fd 0c 81 88 ff ff .........`...... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline] [<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline] [<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784 [<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline] [<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132 [<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153 [<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345 [<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/drive
be+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345 [<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 [<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740 [<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846 [<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431 [<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914 [<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491 [<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109 [<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/cor
] device_add+0x5be/0xc30 drivers/base/core.c:3109 [<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164 [<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/448a1cb12977f52142e6feb12022c59662d88dc1 - https://git.kernel.org/stable/c/4a621621c7af3cec21c47c349b30cd9c3cea11c8 - https://git.kernel.org/stable/c/2c2fb2df46ea866b49fea5ec7112ec3cd4896c74 - https://git.ke
3cec21c47c349b30cd9c3cea11c8 - https://git.kernel.org/stable/c/2c2fb2df46ea866b49fea5ec7112ec3cd4896c74 - https://git.kernel.org/stable/c/0365701bc44e078682ee1224866a71897495c7ef - https://git.kernel.org/stable/c/af2a4426baf71163c0c354580ae98c7888a9aba7 - https://git.kernel.org/stable/c/b34cb7ac32cc8e5471dc773180ea9ae676b1a745 - https://git.kernel.org/stable/c/65234f50a90b64b335cbb9164b8a98c2a0d031dd - https://git.kernel.org/stable/c/e0652f8bb44d6294eeeac06d703185357f25d50b
CVE ID: CVE-2021-47181 State: PUBLISHED Published: 2024-04-10T18:56:23.081Z Last Updated: 2025-05-21T08:31:39.125Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: musb: tusb6010: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1ba7605856e05fa991d4654ac69e5ace66c767b9 - https://git.kernel.org/stable/c/b3f43659eb0b9af2e6ef18a8d829374610b19e7a - https://git.kernel.org/stable/c/28be095eb612a489705d3
git.kernel.org/stable/c/b3f43659eb0b9af2e6ef18a8d829374610b19e7a - https://git.kernel.org/stable/c/28be095eb612a489705d38c210afaf1103c5f4f8 - https://git.kernel.org/stable/c/f87a79c04a33ab4e5be598c7b0867e6ef193d702 - https://git.kernel.org/stable/c/3ee15f1af17407be381bcf06a78fa60b471242dd - https://git.kernel.org/stable/c/679eee466d0f9ffa60a2b0c6ec19be5128927f04 - https://git.kernel.org/stable/c/06cfb4cb2241e704d72e3045cf4d7dfb567fbce0 - https://git.kernel.org/stable/c/14651496a3de6807a17c310f63c894ea0c5d858e
CVE ID: CVE-2021-47182 State: PUBLISHED Published: 2024-04-10T18:56:23.739Z Last Updated: 2025-05-04T07:05:53.433Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix scsi_mode_sense() buffer length handling Several problems exist with scsi_mode_sense() buffer length handling: 1) The allocation length field of the MODE SENSE(10) command is 16-bits, occupying bytes 7 and 8 of the CDB. With this command, access to mode pages larger than 255 bytes is thus possible. However, the CDB allocation length field is set by assigning len to byte 8 only, thus truncating buffer length larger than 255. 2) If scsi_mode_sense() is ca
eld is set by assigning len to byte 8 only, thus truncating buffer length larger than 255. 2) If scsi_mode_sense() is called with len smaller than 8 with sdev->use_10_for_ms set, or smaller than 4 otherwise, the buffer length is increased to 8 and 4 respectively, and the buffer is zero filled with these increased values, thus corrupting the memory following the buffer. Fix these 2 problems by using put_unaligned_be16() to set the allocation length field of MODE SENSE(10) CDB and by returning an error when len is too small. Furthermore, if len is larger than 255B, always try MODE SENSE(10) first, even if the device driver did not set sdev->use_10_for_ms. In case of invalid opcode error for MO
MODE SENSE(10) first, even if the device driver did not set sdev->use_10_for_ms. In case of invalid opcode error for MODE SENSE(10), access to mode pages larger than 255 bytes are not retried using MODE SENSE(6). To avoid buffer length overflows for the MODE_SENSE(10) case, check that len is smaller than 65535 bytes. While at it, also fix the folowing: * Use get_unaligned_be16() to retrieve the mode data length and block descriptor length fields of the mode sense reply header instead of using an open coded calculation. * Fix the kdoc dbd argument explanation: the DBD bit stands for Disable Block Descriptor, which is the opposite of what the dbd argument description was. Additional Analyst N
tands for Disable Block Descriptor, which is the opposite of what the dbd argument description was. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e15de347faf4a9f494cbd4e9a623d343dc1b5851 - https://git.kernel.org/stable/c/17b49bcbf8351d3dbe57204468ac34f033ed60bc
CVE ID: CVE-2021-47183 State: PUBLISHED Published: 2024-04-10T18:56:24.383Z Last Updated: 2025-11-03T17:30:53.906Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix link down processing to address NULL pointer dereference If an FC link down transition while PLOGIs are outstanding to fabric well known addresses, outstanding ABTS requests may result in a NULL pointer dereference. Driver unload requests may hang with repeated "2878" log messages. The Link down processing results in ABTS requests for outstanding ELS requests. The Abort WQEs are sent for the ELSs before the driver had set the link state to down. Thus th
outstanding ELS requests. The Abort WQEs are sent for the ELSs before the driver had set the link state to down. Thus the driver is sending the Abort with the expectation that an ABTS will be sent on the wire. The Abort request is stalled waiting for the link to come up. In some conditions the driver may auto-complete the ELSs thus if the link does come up, the Abort completions may reference an invalid structure. Fix by ensuring that Abort set the flag to avoid link traffic if issued due to conditions where the link failed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/04c1af683270e4709a594bb1691b8800b945035a - http
: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/04c1af683270e4709a594bb1691b8800b945035a - https://git.kernel.org/stable/c/28de48a7cea495ab48082d9ff4ef63f7cb4e563a - https://git.kernel.org/stable/c/1854f53ccd88ad4e7568ddfafafffe71f1ceb0a6
CVE ID: CVE-2021-47184 State: PUBLISHED Published: 2024-04-10T18:56:25.037Z Last Updated: 2025-05-04T07:05:55.638Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL ptr dereference on VSI filter sync Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to sync this thread with sync filters subtask. Without this patch it is possible to start update the VSI filter list after VSI is removed, that's causing a kernel oops. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gi
sing a kernel oops. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/78f2a9e831f9610e3655a0be5e675e1aa2472089 - https://git.kernel.org/stable/c/87c421ab4a43433cb009fea44bbbc77f46913e1d - https://git.kernel.org/stable/c/c30162da91327e4cdf7cd03079f096bb3654738c - https://git.kernel.org/stable/c/f866513ead4370402428ef724b03c3312295c178 - https://git.kernel.org/stable/c/e91e8427a1e1633a0261e3bb0201c836ac5b3890 - https://git.kernel.org/stable/c/37d9e304acd903a445df8208b8a13d707902dea6
CVE ID: CVE-2021-47185 State: PUBLISHED Published: 2024-04-10T18:56:25.671Z Last Updated: 2025-05-04T07:05:56.677Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup, which look like this one: Workqueue: events_unbound flush_to_ldisc Call trace: dump_backtrace+0x0/0x1ec show_stack+0x24/0x30 dump_stack+0xd0/0x128 panic+0x15c/0x374 watchdog_timer_fn+0x2b8/0x304 __run_hrtimer+0x88/0x2c0 __hrtimer_run_queues+0xa4/0x120 hrtimer_interrupt+0xfc/0x270 arch_timer_handler_phys+0x40/0x50 ha
run_hrtimer+0x88/0x2c0 __hrtimer_run_queues+0xa4/0x120 hrtimer_interrupt+0xfc/0x270 arch_timer_handler_phys+0x40/0x50 handle_percpu_devid_irq+0x94/0x220 __handle_domain_irq+0x88/0xf0 gic_handle_irq+0x84/0xfc el1_irq+0xc8/0x180 slip_unesc+0x80/0x214 [slip] tty_ldisc_receive_buf+0x64/0x80 tty_port_default_receive_buf+0x50/0x90 flush_to_ldisc+0xbc/0x110 process_one_work+0x1d4/0x4b0 worker_thread+0x180/0x430 kthread+0x11c/0x120 In the testcase pty04, The first process call the write syscall to send data to the pty master. At the same time, the workqueue will do the flush_to_ldisc to pop data in a loop until there is no more data left. When the sender and workqueue running in different core, the
sc to pop data in a loop until there is no more data left. When the sender and workqueue running in different core, the sender sends data fastly in full time which will result in workqueue doing work in loop for a long time and occuring softlockup in flush_to_ldisc with kernel configured without preempt. So I add need_resched check and cond_resched in the flush_to_ldisc loop to avoid it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0380f643f3a7a61b0845cdc738959c2ad5735d61 - https://git.kernel.org/stable/c/b1ffc16ec05ae40d82b6e373322d62e9d6b54fbc - https://git.kernel.org/stable/c/4c1623651a0936ee197859824cdae6ebbd04d
table/c/b1ffc16ec05ae40d82b6e373322d62e9d6b54fbc - https://git.kernel.org/stable/c/4c1623651a0936ee197859824cdae6ebbd04d3ed - https://git.kernel.org/stable/c/4f300f47dbcf9c3d4b2ea76c8554c8f360400725 - https://git.kernel.org/stable/c/d491c84df5c469dd9621863b6a770b3428137063 - https://git.kernel.org/stable/c/77e9fed33056f2a88eba9dd4d2d5412f0c7d1f41 - https://git.kernel.org/stable/c/5c34486f04700f1ba04907231dce0cc2705c2d7d - https://git.kernel.org/stable/c/3968ddcf05fb4b9409cd1859feb06a5b0550a1c1
CVE ID: CVE-2021-47186 State: PUBLISHED Published: 2024-04-10T18:56:26.297Z Last Updated: 2025-05-20T14:27:26.664Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tipc: check for null after calling kmemdup kmemdup can return a null pointer so need to check for it, otherwise the null key will be dereferenced later in tipc_crypto_key_xmit as can be seen in the trace [1]. [1] https://syzkaller.appspot.com/bug?id=bca180abb29567b189efdbdb34cbf7ba851c2a58 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/a7d91625863d4ffed63b993b5e6dc1298b6430c9 - https://git.kerne
am Container: References: - https://git.kernel.org/stable/c/a7d91625863d4ffed63b993b5e6dc1298b6430c9 - https://git.kernel.org/stable/c/9404c4145542c23019a80ab1bb2ecf73cd057b10 - https://git.kernel.org/stable/c/3e6db079751afd527bf3db32314ae938dc571916