Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
00 [ 487.390748] x23: ffffad184f4ce008 x22: ffffad1850185000 x21: ffffad1838d13cec [ 487.397874] x20: ffff6601c0000000 x19: fffffd9807000000 x18: 0000000000000000 [ 487.405000] x17: ffffb910cdc49000 x16: ffffad184d7d9080 x15: 0000000000004000 [ 487.412126] x14: 0000000000000008 x13: 000000000000ffff x12: 0000000000000000 [ 487.419252] x11: 0000000000000004 x10: 0000000000000001 x9 : ffffad184d7d927c [ 487.426379] x8 : 0000000000000000 x7 : 0000000ffffffd1d x6 : ffff662240a94900 [ 487.433505] x5 : 0000000000000003 x4 : 0000000000000009 x3 : ffffad184f4ce008 [ 487.440632] x2 : ffff662243eec000 x1 : 0000000100000100 x0 : fffffc0000000000 [ 487.447758] Call trace: [ 487.450194] kfree+0xac/0x304
: ffff662243eec000 x1 : 0000000100000100 x0 : fffffc0000000000 [ 487.447758] Call trace: [ 487.450194] kfree+0xac/0x304 [ 487.453151] dpaa2_eth_free_tx_fd.isra.0+0x33c/0x3e0 [fsl_dpaa2_eth] [ 487.459507] dpaa2_eth_tx_conf+0x100/0x2e0 [fsl_dpaa2_eth] [ 487.464989] dpaa2_eth_poll+0xdc/0x380 [fsl_dpaa2_eth] References: - https://git.kernel.org/stable/c/ba5fe3dd4833bbc03609c5c0c2dd2cea5fa5addf - https://git.kernel.org/stable/c/06d129946a71f3159b3b40ee95549183edf2c79d
CVE ID: CVE-2022-49453 State: PUBLISHED Published: 2025-02-26T02:13:02.751Z Last Updated: 2025-10-01T19:46:47.934Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc The allocation funciton devm_kcalloc may fail and return a null pointer, which would cause a null-pointer dereference later. It might be better to check it and directly return -ENOMEM just like the usage of devm_kcalloc in previous code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/05efc4591f80582b6fe53366b70b6a35a42fd255 - https://git.kernel.org/stable
: References: - https://git.kernel.org/stable/c/05efc4591f80582b6fe53366b70b6a35a42fd255 - https://git.kernel.org/stable/c/7cef9274fa1b8506949d74bc45aef072b890824a - https://git.kernel.org/stable/c/c4e188869406b47ac3350920bf165be303cb1c96 - https://git.kernel.org/stable/c/01ba41a359622ab256ce4d4f8b94c67165ae3daf - https://git.kernel.org/stable/c/ba56291e297d28aa6eb82c5c1964fae2d7594746
CVE ID: CVE-2022-49454 State: PUBLISHED Published: 2025-02-26T02:13:03.435Z Last Updated: 2025-10-01T19:46:47.802Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup() The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Add the missing of_node_put() to release the refcount. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ad1c9d13e04509ae24fae8dd2897148657323519 - https://git.kernel.org/stable/c/4cef4237d6c37257cb6ddc397723e9c0dded0efe - https://
13e04509ae24fae8dd2897148657323519 - https://git.kernel.org/stable/c/4cef4237d6c37257cb6ddc397723e9c0dded0efe - https://git.kernel.org/stable/c/09b2d906d78ddf5042b1f3e0091835fc6997e8a4 - https://git.kernel.org/stable/c/214e0d8fe4a813ae6ffd62bc2dfe7544c20914f4
CVE ID: CVE-2022-49455 State: PUBLISHED Published: 2025-02-26T02:13:04.116Z Last Updated: 2025-10-01T19:46:47.666Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: misc: ocxl: fix possible double free in ocxl_file_register_afu info_release() will be called in device_unregister() when info->dev's reference count is 0. So there is no need to call ocxl_afu_put() and kfree() again. Fix this by adding free_minor() and return to err_unregister error path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/de65c32ace9aa70d51facc61ba986607075e3a25 - https://git.kernel.org/stable/c/ee89d8dee55
- https://git.kernel.org/stable/c/de65c32ace9aa70d51facc61ba986607075e3a25 - https://git.kernel.org/stable/c/ee89d8dee55ab4b3b8ad8b70866b2841ba334767 - https://git.kernel.org/stable/c/8fb674216835e1f0c143762696d645facebb4685 - https://git.kernel.org/stable/c/252768d32e92c1214aeebb5fec0844ca479bcf5c - https://git.kernel.org/stable/c/9e9087cf34ee69f4e95d146ac29385d6e367a97b - https://git.kernel.org/stable/c/950cf957fe34d40d63dfa3bf3968210430b6491e
CVE ID: CVE-2022-49456 State: PUBLISHED Published: 2025-02-26T02:13:04.787Z Last Updated: 2025-05-04T08:38:08.212Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bonding: fix missed rcu protection When removing the rcu_read_lock in bond_ethtool_get_ts_info() as discussed [1], I didn't notice it could be called via setsockopt, which doesn't hold rcu lock, as syzbot pointed: stack backtrace: CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inli
e Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline] bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595 __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554 ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568 sock_timestamping_bind_phc net/core/sock.c:869 [inline] sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916 sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221 __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223 __do_sys_setsockopt net/socket.c:2238 [inline] __se_sys_setso
sock.c:1221 __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223 __do_sys_setsockopt net/socket.c:2238 [inline] __se_sys_setsockopt net/socket.c:2235 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f8902c8eb39 Fix it by adding rcu_read_lock and take a ref on the real_dev. Since dev_hold() and dev_put() can take NULL these days, we can skip checking if real_dev exist. [1] https://lore.kernel.org/netdev/27565.1642742439@famine/ References: - https://git.kernel.org/stable/c/1b66a533c47d29b38af8e05fbb53b609a5ba3a4e - https://git.kernel.o
39@famine/ References: - https://git.kernel.org/stable/c/1b66a533c47d29b38af8e05fbb53b609a5ba3a4e - https://git.kernel.org/stable/c/85eed460681da71b359ed906bce4d800081db854 - https://git.kernel.org/stable/c/9b80ccda233fa6c59de411bf889cc4d0e028f2c7
CVE ID: CVE-2022-49457 State: PUBLISHED Published: 2025-02-26T02:13:05.530Z Last Updated: 2025-10-01T19:46:47.524Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ARM: versatile: Add missing of_node_put in dcscb_init The device_node pointer is returned by of_find_compatible_node with refcount incremented. We should use of_node_put() to avoid the refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2d7b23db35254b7d46e852967090c64cdccf24da - https://git.kernel.org/stable/c/bbdfb7d4f036118d36415a2575efa6f5246505ae - https://git.kernel.org/stable/c/a0fc05cd17617e63fc13ad0c01
ernel.org/stable/c/bbdfb7d4f036118d36415a2575efa6f5246505ae - https://git.kernel.org/stable/c/a0fc05cd17617e63fc13ad0c01f3f0afd890d8ec - https://git.kernel.org/stable/c/fcd1999ba97445a12cc394f5f42ffd9116bf0185 - https://git.kernel.org/stable/c/d146e2a9864ade19914494de3fb520390b415d58 - https://git.kernel.org/stable/c/83c329b980bddbc8c6a3d287d91f2103a4d4a860 - https://git.kernel.org/stable/c/3c6006faed9aba5144b33176d061031a9be66954 - https://git.kernel.org/stable/c/d6de7b181c29cd4578ec139aafb5eac062abbe1b - https://git.kernel.org/stable/c/23b44f9c649bbef10b45fa33080cd8b4166800ae
CVE ID: CVE-2022-49458 State: PUBLISHED Published: 2025-02-26T02:13:06.202Z Last Updated: 2025-05-04T08:38:10.641Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm: don't free the IRQ if it was not requested As msm_drm_uninit() is called from the msm_drm_init() error path, additional care should be necessary as not to call the free_irq() for the IRQ that was not requested before (because an error occured earlier than the request_irq() call). This fixed the issue reported with the following backtrace: [ 8.571329] Trying to free already-free IRQ 187 [ 8.571339] WARNING: CPU: 0 PID: 76 at kernel/irq/manage.c:1895 free_irq+0x
.571329] Trying to free already-free IRQ 187 [ 8.571339] WARNING: CPU: 0 PID: 76 at kernel/irq/manage.c:1895 free_irq+0x1e0/0x35c [ 8.588746] Modules linked in: pmic_glink pdr_interface fastrpc qrtr_smd snd_soc_hdmi_codec msm fsa4480 gpu_sched drm_dp_aux_bus qrtr i2c_qcom_geni crct10dif_ce qcom_stats qcom_q6v5_pas drm_display_helper gpi qcom_pil_info drm_kms_helper qcom_q6v5 qcom_sysmon qcom_common qcom_glink_smem qcom_rng mdt_loader qmi_helpers phy_qcom_qmp ufs_qcom typec qnoc_sm8350 socinfo rmtfs_mem fuse drm ipv6 [ 8.624154] CPU: 0 PID: 76 Comm: kworker/u16:2 Not tainted 5.18.0-rc5-next-20220506-00033-g6cee8cab6089-dirty #419 [ 8.624161] Hardware name: Qualcomm Technologies, Inc. SM8350 H
5.18.0-rc5-next-20220506-00033-g6cee8cab6089-dirty #419 [ 8.624161] Hardware name: Qualcomm Technologies, Inc. SM8350 HDK (DT) [ 8.641496] Workqueue: events_unbound deferred_probe_work_func [ 8.647510] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 8.654681] pc : free_irq+0x1e0/0x35c [ 8.658454] lr : free_irq+0x1e0/0x35c [ 8.662228] sp : ffff800008ab3950 [ 8.665642] x29: ffff800008ab3950 x28: 0000000000000000 x27: ffff16350f56a700 [ 8.672994] x26: ffff1635025df080 x25: ffff16350251badc x24: ffff16350251bb90 [ 8.680343] x23: 0000000000000000 x22: 00000000000000bb x21: ffff16350e8f9800 [ 8.687690] x20: ffff16350251ba00 x19: ffff16350cbd5880 x18: ffffffffffffffff [ 8.695039]
000000bb x21: ffff16350e8f9800 [ 8.687690] x20: ffff16350251ba00 x19: ffff16350cbd5880 x18: ffffffffffffffff [ 8.695039] x17: 0000000000000000 x16: ffffa2dd12179434 x15: ffffa2dd1431d02d [ 8.702391] x14: 0000000000000000 x13: ffffa2dd1431d028 x12: 662d79646165726c [ 8.709740] x11: ffffa2dd13fd2438 x10: 000000000000000a x9 : 00000000000000bb [ 8.717111] x8 : ffffa2dd13fd23f0 x7 : ffff800008ab3750 x6 : 00000000fffff202 [ 8.724487] x5 : ffff16377e870a18 x4 : 00000000fffff202 x3 : ffff735a6ae1b000 [ 8.731851] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff1635015f8000 [ 8.739217] Call trace: [ 8.741755] free_irq+0x1e0/0x35c [ 8.745198] msm_drm_uninit.isra.0+0x14c/0x294 [msm] [ 8.750548] ms
.739217] Call trace: [ 8.741755] free_irq+0x1e0/0x35c [ 8.745198] msm_drm_uninit.isra.0+0x14c/0x294 [msm] [ 8.750548] msm_drm_bind+0x28c/0x5d0 [msm] [ 8.755081] try_to_bring_up_aggregate_device+0x164/0x1d0 [ 8.760657] __component_add+0xa0/0x170 [ 8.764626] component_add+0x14/0x20 [ 8.768337] dp_display_probe+0x2a4/0x464 [msm] [ 8.773242] platform_probe+0x68/0xe0 [ 8.777043] really_probe.part.0+0x9c/0x28c [ 8.781368] __driver_probe_device+0x98/0x144 [ 8.785871] driver_probe_device+0x40/0x140 [ 8.790191] __device_attach_driver+0xb4/0x120 [ 8.794788] bus_for_each_drv+0x78/0xd0 [ 8.798751] __device_attach+0xdc/0x184 [ 8.802713] device_initial_probe+0x14/0x20 [ 8.807031] bus_probe_device+0x9c/0xa
[ 8.798751] __device_attach+0xdc/0x184 [ 8.802713] device_initial_probe+0x14/0x20 [ 8.807031] bus_probe_device+0x9c/0xa4 [ 8.810991] deferred_probe_work_func+0x88/0xc0 [ 8.815667] process_one_work+0x1d0/0x320 [ 8.819809] worker_thread+0x14c/0x444 [ 8.823688] kthread+0x10c/0x110 [ 8.827036] ret_from_fork+0x10/0x20 Patchwork: https://patchwork.freedesktop.org/patch/485422/ References: - https://git.kernel.org/stable/c/beb81c13d020ceb7f8693e65464162e5f249218e - https://git.kernel.org/stable/c/b288ec4439c1dad304c1862bf6b0be78d9b1b2b2 - https://git.kernel.org/stable/c/59023c4fb1ab3de0fa001681650f662c253c7fd7 - https://git.kernel.org/stable/c/577e2a9dfc8fba7938aaf75db63fae7e328cc3cb
CVE ID: CVE-2022-49459 State: PUBLISHED Published: 2025-02-26T02:13:06.833Z Last Updated: 2025-10-01T19:46:47.308Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe platform_get_resource() may return NULL, add proper check to avoid potential NULL dereferencing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b3461ccaa5d2588568d865faee285512ad448049 - https://git.kernel.org/stable/c/79098339ac2065f4b4352ef5921628970b6f47e6 - https://git.kernel.org/stable/c/ef1235c6514a58f274246cf4a2d5f4e40af539ce - https://g
9ac2065f4b4352ef5921628970b6f47e6 - https://git.kernel.org/stable/c/ef1235c6514a58f274246cf4a2d5f4e40af539ce - https://git.kernel.org/stable/c/ee9b6b02e8c140323ed46d6602d805ea735c7719 - https://git.kernel.org/stable/c/61621e042c22b47d1eadee617bdd26835294b425 - https://git.kernel.org/stable/c/e20d136ec7d6f309989c447638365840d3424c8e
CVE ID: CVE-2022-49460 State: PUBLISHED Published: 2025-02-26T02:13:07.635Z Last Updated: 2025-05-04T08:38:13.409Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: rk3399_dmc: Disable edev on remove() Otherwise we hit an unablanced enable-count when unbinding the DFI device: [ 1279.659119] ------------[ cut here ]------------ [ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c ... [ 1279.659352] Hardware name: Google Kevin (DT) [ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--) [ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c [ 1
659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--) [ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c [ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28 ... [ 1279.659571] Call trace: [ 1279.659582] devfreq_event_remove_edev+0x84/0x8c [ 1279.659590] devm_devfreq_event_release+0x1c/0x28 [ 1279.659602] release_nodes+0x1cc/0x244 [ 1279.659611] devres_release_all+0x44/0x60 [ 1279.659621] device_release_driver_internal+0x11c/0x1ac [ 1279.659629] device_driver_detach+0x20/0x2c [ 1279.659641] unbind_store+0x7c/0xb0 [ 1279.659650] drv_attr_store+0x2c/0x40 [ 1279.659663] sysfs_kf_write+0x44/0x58 [ 1279.659672] kernfs_fop_write_iter+0xf4/0x190 [ 1279.659684] vfs_write+0x2b0/0x2e4
9.659663] sysfs_kf_write+0x44/0x58 [ 1279.659672] kernfs_fop_write_iter+0xf4/0x190 [ 1279.659684] vfs_write+0x2b0/0x2e4 [ 1279.659693] ksys_write+0x80/0xec [ 1279.659701] __arm64_sys_write+0x24/0x30 [ 1279.659714] el0_svc_common+0xf0/0x1d8 [ 1279.659724] do_el0_svc_compat+0x28/0x3c [ 1279.659738] el0_svc_compat+0x10/0x1c [ 1279.659746] el0_sync_compat_handler+0xa8/0xcc [ 1279.659758] el0_sync_compat+0x188/0x1c0 [ 1279.659768] ---[ end trace cec200e5094155b4 ]--- References: - https://git.kernel.org/stable/c/664736e2cc09e504ce58ec61164d029d1f2651bb - https://git.kernel.org/stable/c/a0180e324a9a63de8f770da300477b48cb4a53f1 - https://git.kernel.org/stable/c/86b091b6894c449d2734de7aa7d79ccb33ffd
table/c/a0180e324a9a63de8f770da300477b48cb4a53f1 - https://git.kernel.org/stable/c/86b091b6894c449d2734de7aa7d79ccb33ffd97d - https://git.kernel.org/stable/c/cb1be1d4be18fe286ba5a67d928598378fd7fbe5 - https://git.kernel.org/stable/c/fb089b6f21de03a685dd31df3789bbb01c59f8e3 - https://git.kernel.org/stable/c/a9c2b23a7ac6ab19214cad8cac8af8608a4d9cef - https://git.kernel.org/stable/c/2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804
CVE ID: CVE-2022-49461 State: PUBLISHED Published: 2025-02-26T02:13:08.342Z Last Updated: 2025-10-01T19:46:47.145Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: amt: fix memory leak for advertisement message When a gateway receives an advertisement message, it extracts relay information and then it should be freed. But the advertisement handler doesn't free it. So, memory leak would occur. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/19bb2d57eac86a368839a92117d8a10ab7183623 - https://git.kernel.org/stable/c/e7322da399fb86a2072f008b56f7160afa1b2051 - https://git.kernel.org/sta
17d8a10ab7183623 - https://git.kernel.org/stable/c/e7322da399fb86a2072f008b56f7160afa1b2051 - https://git.kernel.org/stable/c/fe29794c3585d039fefebaa2b5a4932a627ad4fd
CVE ID: CVE-2022-49462 State: PUBLISHED Published: 2025-02-26T02:13:09.016Z Last Updated: 2025-10-01T19:46:47.027Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. a6xx_gmu_init() passes the node to of_find_device_by_node() and of_dma_configure(), of_find_device_by_node() will takes its reference, of_dma_configure() doesn't need the node after usage. Add missing of_node_put() to avoid refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
ter usage. Add missing of_node_put() to avoid refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6832e36f156ea35a6ed74bca72727806116effdd - https://git.kernel.org/stable/c/48e82ce8cdb19c20a5020fa446b286d6a147450c - https://git.kernel.org/stable/c/edff4c1af831d0c02e654eed9da7d74174de49d5 - https://git.kernel.org/stable/c/65ddbc0d26824e2a5d6154d01d8cf39344900213 - https://git.kernel.org/stable/c/06907a374f1b74f8f2fb30720dc6df81331e4fb5 - https://git.kernel.org/stable/c/c56de483093d7ad0782327f95dda7da97bc4c315
CVE ID: CVE-2022-49463 State: PUBLISHED Published: 2025-02-26T02:13:09.673Z Last Updated: 2025-10-01T19:46:46.874Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8bbf522a2c51ef939d0e8835e236bfcd252193af - https://git.kernel.org/stable/c/3ade442ea5d3512a3c67984489ab4d8a6fb3b29f - https://git.kern
939d0e8835e236bfcd252193af - https://git.kernel.org/stable/c/3ade442ea5d3512a3c67984489ab4d8a6fb3b29f - https://git.kernel.org/stable/c/0ec10303c10833c1bcba7a1bde2f297e494d5464 - https://git.kernel.org/stable/c/ec0925b731697db7cab5944a3e55d2d58bb3d075 - https://git.kernel.org/stable/c/09700c504d8e63faffd2a2235074e8c5d130cb8f
CVE ID: CVE-2022-49464 State: PUBLISHED Published: 2025-02-26T02:13:10.321Z Last Updated: 2025-05-04T08:38:18.164Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: erofs: fix buffer copy overflow of ztailpacking feature I got some KASAN report as below: [ 46.959738] ================================================================== [ 46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188 ... [ 46.960430] Call Trace: [ 46.960430] <TASK> [ 46.960430] dump_stack_lvl+0x41/0x5e [ 46.960430] print_report.cold+0xb2/0x6b7 [ 46.960430] ? z_er
[ 46.960430] <TASK> [ 46.960430] dump_stack_lvl+0x41/0x5e [ 46.960430] print_report.cold+0xb2/0x6b7 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_report+0x8a/0x140 [ 46.960430] ? z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] kasan_check_range+0x14d/0x1d0 [ 46.960430] memcpy+0x20/0x60 [ 46.960430] z_erofs_shifted_transform+0x2bd/0x370 [ 46.960430] z_erofs_decompress_pcluster+0xaae/0x1080 The root cause is that the tail pcluster won't be a complete filesystem block anymore. So if ztailpacking is used, the second part of an uncompressed tail pcluster may not be ``rq->pageofs_out``. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kerne
uster may not be ``rq->pageofs_out``. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4d53a625f29074e7b8236c2c0e0922edb7608df9 - https://git.kernel.org/stable/c/6b59e1907f58cf877c563dcf013159eb9f994b64 - https://git.kernel.org/stable/c/dcbe6803fffd387f72b48c2373b5f5ed12a5804b
CVE ID: CVE-2022-49465 State: PUBLISHED Published: 2025-02-26T02:13:10.975Z Last Updated: 2025-05-21T08:44:07.728Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: blk-throttle: Set BIO_THROTTLED when bio has been throttled 1.In current process, all bio will set the BIO_THROTTLED flag after __blk_throtl_bio(). 2.If bio needs to be throttled, it will start the timer and stop submit bio directly. Bio will submit in blk_throtl_dispatch_work_fn() when the timer expires.But in the current process, if bio is throttled. The BIO_THROTTLED will be set to bio after timer start. If the bio has been completed, it may cause use-after-free blo
. The BIO_THROTTLED will be set to bio after timer start. If the bio has been completed, it may cause use-after-free blow. BUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70 Read of size 2 at addr ffff88801b8902d4 by task fio/26380 dump_stack+0x9b/0xce print_address_description.constprop.6+0x3e/0x60 kasan_report.cold.9+0x22/0x3a blk_throtl_bio+0x12f0/0x2c70 submit_bio_checks+0x701/0x1550 submit_bio_noacct+0x83/0xc80 submit_bio+0xa7/0x330 mpage_readahead+0x380/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x4
ead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 26380: kasan_save_stack+0x19/0x40 __kasan_kmalloc.constprop.2+0xc1/0xd0 kmem_cache_alloc+0x146/0x440 mempool_alloc+0x125/0x2f0 bio_alloc_bioset+0x353/0x590 mpage_alloc+0x3b/0x240 do_mpage_readpage+0xddf/0x1ef0 mpage_readahead+0x264/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x30
cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 0: kasan_save_stack+0x19/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x1b/0x30 __kasan_slab_free+0x111/0x160 kmem_cache_free+0x94/0x460 mempool_free+0xd6/0x320 bio_free+0xe0/0x130 bio_put+0xab/0xe0 bio_endio+0x3a6/0x5d0 blk_update_request+0x590/0x1370 scsi_end_request+0x7d/0x400 scsi_io_completion+0x1aa/0xe5
xab/0xe0 bio_endio+0x3a6/0x5d0 blk_update_request+0x590/0x1370 scsi_end_request+0x7d/0x400 scsi_io_completion+0x1aa/0xe50 scsi_softirq_done+0x11b/0x240 blk_mq_complete_request+0xd4/0x120 scsi_mq_done+0xf0/0x200 virtscsi_vq_done+0xbc/0x150 vring_interrupt+0x179/0x390 __handle_irq_event_percpu+0xf7/0x490 handle_irq_event_percpu+0x7b/0x160 handle_irq_event+0xcc/0x170 handle_edge_irq+0x215/0xb20 common_interrupt+0x60/0x120 asm_common_interrupt+0x1e/0x40 Fix this by move BIO_THROTTLED set into the queue_lock. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0cfc8a0fb07cde61915e4a77c4794c47de3114a4 - https://git.kernel.org/stable/c/935fa666534d7b7185
://git.kernel.org/stable/c/0cfc8a0fb07cde61915e4a77c4794c47de3114a4 - https://git.kernel.org/stable/c/935fa666534d7b7185e8c6b0191cd06281be4290 - https://git.kernel.org/stable/c/5a011f889b4832aa80c2a872a5aade5c48d2756f