Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-26768 State: PUBLISHED Published: 2024-04-03T17:00:50.135Z Last Updated: 2025-05-04T08:56:04.330Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: LoongArch: Change acpi_core_pic[NR_CPUS] to acpi_core_pic[MAX_CORE_PIC] With default config, the value of NR_CPUS is 64. When HW platform has more then 64 cpus, system will crash on these platforms. MAX_CORE_PIC is the maximum cpu number in MADT table (max physical number) which can exceed the supported maximum cpu number (NR_CPUS, max logical number), but kernel should not crash. Kernel should boot cpus with NR_CPUS, let the remainder cpus stay in BIOS. The potential
, but kernel should not crash. Kernel should boot cpus with NR_CPUS, let the remainder cpus stay in BIOS. The potential crash reason is that the array acpi_core_pic[NR_CPUS] can be overflowed when parsing MADT table, and it is obvious that CORE_PIC should be corresponding to physical core rather than logical core, so it is better to define the array as acpi_core_pic[MAX_CORE_PIC]. With the patch, system can boot up 64 vcpus with qemu parameter -smp 128, otherwise system will crash with the following message. [ 0.000000] CPU 0 Unable to handle kernel paging request at virtual address 0000420000004259, era == 90000000037a5f0c, ra == 90000000037a46ec [ 0.000000] Oops[#1]: [ 0.000000] CPU: 0 PID
l address 0000420000004259, era == 90000000037a5f0c, ra == 90000000037a46ec [ 0.000000] Oops[#1]: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 6.8.0-rc2+ #192 [ 0.000000] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022 [ 0.000000] pc 90000000037a5f0c ra 90000000037a46ec tp 9000000003c90000 sp 9000000003c93d60 [ 0.000000] a0 0000000000000019 a1 9000000003d93bc0 a2 0000000000000000 a3 9000000003c93bd8 [ 0.000000] a4 9000000003c93a74 a5 9000000083c93a67 a6 9000000003c938f0 a7 0000000000000005 [ 0.000000] t0 0000420000004201 t1 0000000000000000 t2 0000000000000001 t3 0000000000000001 [ 0.000000] t4 0000000000000003 t5 0000000000000000 t6 0000000000000030 t7 000000000000006
000000001 t3 0000000000000001 [ 0.000000] t4 0000000000000003 t5 0000000000000000 t6 0000000000000030 t7 0000000000000063 [ 0.000000] t8 0000000000000014 u0 ffffffffffffffff s9 0000000000000000 s0 9000000003caee98 [ 0.000000] s1 90000000041b0480 s2 9000000003c93da0 s3 9000000003c93d98 s4 9000000003c93d90 [ 0.000000] s5 9000000003caa000 s6 000000000a7fd000 s7 000000000f556b60 s8 000000000e0a4330 [ 0.000000] ra: 90000000037a46ec platform_init+0x214/0x250 [ 0.000000] ERA: 90000000037a5f0c efi_runtime_init+0x30/0x94 [ 0.000000] CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) [ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE) [ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 0.000000] ECFG: 000
WE) [ 0.000000] PRMD: 00000000 (PPLV0 -PIE -PWE) [ 0.000000] EUEN: 00000000 (-FPE -SXE -ASXE -BTE) [ 0.000000] ECFG: 00070800 (LIE=11 VS=7) [ 0.000000] ESTAT: 00010000 [PIL] (IS= ECode=1 EsubCode=0) [ 0.000000] BADV: 0000420000004259 [ 0.000000] PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) [ 0.000000] Modules linked in: [ 0.000000] Process swapper (pid: 0, threadinfo=(____ptrval____), task=(____ptrval____)) [ 0.000000] Stack : 9000000003c93a14 9000000003800898 90000000041844f8 90000000037a46ec [ 0.000000] 000000000a7fd000 0000000008290000 0000000000000000 0000000000000000 [ 0.000000] 0000000000000000 0000000000000000 00000000019d8000 000000000f556b60 [ 0.000000] 000000000a7fd000 00000000
00 [ 0.000000] 0000000000000000 0000000000000000 00000000019d8000 000000000f556b60 [ 0.000000] 000000000a7fd000 000000000f556b08 9000000003ca7700 9000000003800000 [ 0.000000] 9000000003c93e50 9000000003800898 9000000003800108 90000000037a484c [ 0.000000] 000000000e0a4330 000000000f556b60 000000000a7fd000 000000000f556b08 [ 0.000000] 9000000003ca7700 9000000004184000 0000000000200000 000000000e02b018 [ 0.000000] 000000000a7fd000 90000000037a0790 9000000003800108 0000000000000000 [ 0.000000] 0000000000000000 000000000e0a4330 000000000f556b60 000000000a7fd000 [ 0.000000] 000000000f556b08 000000000eaae298 000000000eaa5040 0000000000200000 [ 0.000000] ... [ 0.000000] Call Trace: [ 0.000000] [<900
0000f556b08 000000000eaae298 000000000eaa5040 0000000000200000 [ 0.000000] ... [ 0.000000] Call Trace: [ 0.000000] [<90000000037a5f0c>] efi_runtime_init+0x30/0x94 [ 0.000000] [<90000000037a46ec>] platform_init+0x214/0x250 [ 0.000000] [<90000000037a484c>] setup_arch+0x124/0x45c [ 0.000000] [<90000000037a0790>] start_kernel+0x90/0x670 [ 0.000000] [<900000000378b0d8>] kernel_entry+0xd8/0xdc Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/88e189bd16e5889e44a41b3309558ebab78b9280 - https://git.kernel.org/stable/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd - https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04df
table/c/0f6810e39898af2d2cabd9313e4dbc945fb5dfdd - https://git.kernel.org/stable/c/4551b30525cf3d2f026b92401ffe241eb04dfebe
CVE ID: CVE-2024-26769 State: PUBLISHED Published: 2024-04-03T17:00:56.019Z Last Updated: 2025-05-04T08:56:05.670Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid deadlock on delete association path When deleting an association the shutdown path is deadlocking because we try to flush the nvmet_wq nested. Avoid this by deadlock by deferring the put work into its own work item. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5e0bc09a52b6169ce90f7ac6e195791adb16cec4 - https://git.kernel.org/stable/c/9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8 - h
/5e0bc09a52b6169ce90f7ac6e195791adb16cec4 - https://git.kernel.org/stable/c/9e6987f8937a7bd7516aa52f25cb7e12c0c92ee8 - https://git.kernel.org/stable/c/eaf0971fdabf2a93c1429dc6bedf3bbe85dffa30 - https://git.kernel.org/stable/c/1d86f79287206deec36d63b89c741cf542b6cadd - https://git.kernel.org/stable/c/710c69dbaccdac312e32931abcb8499c1525d397
CVE ID: CVE-2024-26770 State: PUBLISHED Published: 2024-04-03T17:00:56.894Z Last Updated: 2025-05-04T08:56:06.907Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Add missing null pointer checks to LED initialization devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. [jkosina@suse.com: tweak changelog a bit] Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/83527a13740f57b45f162e3af4c7db4b88521100 - https://git.kernel.org
ichment: References: - https://git.kernel.org/stable/c/83527a13740f57b45f162e3af4c7db4b88521100 - https://git.kernel.org/stable/c/e71cc4a1e584293deafff1a7dea614b0210d0443 - https://git.kernel.org/stable/c/b6eda11c44dc89a681e1c105f0f4660e69b1e183
CVE ID: CVE-2024-26771 State: PUBLISHED Published: 2024-04-03T17:00:57.918Z Last Updated: 2025-05-04T08:56:08.252Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Add some null pointer checks to the edma_probe devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c432094aa7c9970f2fa10d2305d550d3810657ce - https://git.kernel.org/stable/c/4fe4e5adc7d29d214c59b59f61db73dec505ca
able/c/c432094aa7c9970f2fa10d2305d550d3810657ce - https://git.kernel.org/stable/c/4fe4e5adc7d29d214c59b59f61db73dec505ca3d - https://git.kernel.org/stable/c/9d508c897153ae8dd79303f7f035f078139f6b49 - https://git.kernel.org/stable/c/7b24760f3a3c7ae1a176d343136b6c25174b7b27 - https://git.kernel.org/stable/c/f2a5e30d1e9a629de6179fa23923a318d5feb29e - https://git.kernel.org/stable/c/6e2276203ac9ff10fc76917ec9813c660f627369
CVE ID: CVE-2024-26772 State: PUBLISHED Published: 2024-04-03T17:00:58.733Z Last Updated: 2025-05-04T08:56:09.839Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5a6dcc4ad0f7f7fa8e8d127b5526e7c5f2d38a43 - https://git.kernel.org/stable/c/6b92b1bc16d691c95b
://git.kernel.org/stable/c/5a6dcc4ad0f7f7fa8e8d127b5526e7c5f2d38a43 - https://git.kernel.org/stable/c/6b92b1bc16d691c95b152c6dbf027ad64315668d - https://git.kernel.org/stable/c/ffeb72a80a82aba59a6774b0611f792e0ed3b0b7 - https://git.kernel.org/stable/c/8de8305a25bfda607fc13475ebe84b978c96d7ff - https://git.kernel.org/stable/c/d639102f4cbd4cb65d1225dba3b9265596aab586 - https://git.kernel.org/stable/c/d3bbe77a76bc52e9d4d0a120f1509be36e25c916 - https://git.kernel.org/stable/c/21dbe20589c7f48e9c5d336ce6402bcebfa6d76a - https://git.kernel.org/stable/c/832698373a25950942c04a512daa652c18a9b513
CVE ID: CVE-2024-26773 State: PUBLISHED Published: 2024-04-03T17:00:59.757Z Last Updated: 2025-05-04T08:56:11.135Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid allocating blocks from a group with a corrupted block bitmap in the following concurrency and making the situation worse. ext4_mb_regular_allocator ext4_lock_group(sb, group) ext4_mb_good_group // check if the group bbitmap is corrupted ext4_mb_complex_scan_group // Scan group gets ac_b
group) ext4_mb_good_group // check if the group bbitmap is corrupted ext4_mb_complex_scan_group // Scan group gets ac_b_ex but doesn't use it ext4_unlock_group(sb, group) ext4_mark_group_bitmap_corrupted(group) // The block bitmap was corrupted during // the group unlock gap. ext4_mb_try_best_found ext4_lock_group(ac->ac_sb, group) ext4_mb_use_best_found mb_mark_used // Allocating blocks in block bitmap corrupted group Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea - https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d - https://git.kernel.org/stable/c/9277
1328ea - https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d - https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03 - https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5 - https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36 - https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1 - https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe - https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53
CVE ID: CVE-2024-26774 State: PUBLISHED Published: 2024-04-03T17:01:00.618Z Last Updated: 2025-06-19T12:39:15.315Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt Determine if bb_fragments is 0 instead of determining bb_free to eliminate the risk of dividing by zero when the block bitmap is corrupted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8b40eb2e716b503f7a4e1090815a17b1341b2150 - https://git.kernel.org/stable/c/f32d2a745b02123258026e105a008f474f896d6a - https://
2e716b503f7a4e1090815a17b1341b2150 - https://git.kernel.org/stable/c/f32d2a745b02123258026e105a008f474f896d6a - https://git.kernel.org/stable/c/8cf9cc602cfb40085967c0d140e32691c8b71cf3 - https://git.kernel.org/stable/c/993bf0f4c393b3667830918f9247438a8f6fdb5b
CVE ID: CVE-2024-26775 State: PUBLISHED Published: 2024-04-03T17:01:01.299Z Last Updated: 2025-07-17T16:55:28.954Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: aoe: avoid potential deadlock at set_capacity Move set_capacity() outside of the section procected by (&d->lock). To avoid possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- [1] lock(&bdev->bd_size_lock); local_irq_disable(); [2] lock(&d->lock); [3] lock(&bdev->bd_size_lock); <Interrupt> [4] lock(&d->lock); *** DEADLOCK *** Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity(). [2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc() is
v->bd_size_lock) hold by zram_add()->set_capacity(). [2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc() is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call. In this situation an attempt to acquire [4]lock(&d->lock) from aoecmd_cfg_rsp() will lead to deadlock. So the simplest solution is breaking lock dependency [2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity() outside. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2499fa286fb010ceb289950050199f33c26667b9 - https://git.kernel.org/stable/c/2d623c94fbba3554f4446ba6f3c764994e8b0d26 - https://git.kernel.org/stable/c/67362901
b9 - https://git.kernel.org/stable/c/2d623c94fbba3554f4446ba6f3c764994e8b0d26 - https://git.kernel.org/stable/c/673629018ba04906899dcb631beec34d871f709c - https://git.kernel.org/stable/c/19a77b27163820f793b4d022979ffdca8f659b77 - https://git.kernel.org/stable/c/e169bd4fb2b36c4b2bee63c35c740c85daeb2e86
CVE ID: CVE-2024-26776 State: PUBLISHED Published: 2024-04-03T17:01:02.116Z Last Updated: 2025-05-21T09:12:31.225Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected Return IRQ_NONE from the interrupt handler when no interrupt was detected. Because an empty interrupt will cause a null pointer error: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: complete+0x54/0x100 hisi_sfc_v3xx_isr+0x2c/0x40 [spi_hisi_sfc_v3xx] __handle_irq_event_percpu+0x64/0x1e0 handle_irq_event+0x7c/0x1cc Additional Analyst Notes: - CVE Program C
isi_sfc_v3xx] __handle_irq_event_percpu+0x64/0x1e0 handle_irq_event+0x7c/0x1cc Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e94da8aca2e78ef9ecca02eb211869eacd5504e5 - https://git.kernel.org/stable/c/0399d7eba41d9b28f5bdd7757ec21a5b7046858d - https://git.kernel.org/stable/c/f19361d570c67e7e014896fa2dacd7d721bf0aa8 - https://git.kernel.org/stable/c/d637b5118274701e8448f35953877daf04df18b4 - https://git.kernel.org/stable/c/e4168ac25b4bd378bd7dda322d589482a136c1fd - https://git.kernel.org/stable/c/de8b6e1c231a95abf95ad097b993d34b31458ec9
CVE ID: CVE-2024-26777 State: PUBLISHED Published: 2024-04-03T17:01:02.935Z Last Updated: 2025-05-04T08:56:16.696Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: sis: Error out if pixclock equals zero The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. In sisfb_check_var(), var->pixclock is used as a divisor to caculate drate before it is checked against zero. Fix this by checking it at the beginning. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Additional Analyst Notes:
the beginning. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/84246c35ca34207114055a87552a1c4289c8fd7e - https://git.kernel.org/stable/c/6db07619d173765bd8622d63809cbfe361f04207 - https://git.kernel.org/stable/c/cd36da760bd1f78c63c7078407baf01dd724f313 - https://git.kernel.org/stable/c/df6e2088c6f4cad539cf67cba2d6764461e798d1 - https://git.kernel.org/stable/c/f329523f6a65c3bbce913ad35473d83a319d5d99 - https://git.kernel.org/stable/c/99f1abc34a6dde248d2219d64aa493c76bbdd9eb - https://git.kernel.org/stable/c/1d11dd3ea5d039c7da089f309f39c4cd36
g/stable/c/99f1abc34a6dde248d2219d64aa493c76bbdd9eb - https://git.kernel.org/stable/c/1d11dd3ea5d039c7da089f309f39c4cd363b924b - https://git.kernel.org/stable/c/e421946be7d9bf545147bea8419ef8239cb7ca52
CVE ID: CVE-2024-26778 State: PUBLISHED Published: 2024-04-03T17:01:08.782Z Last Updated: 2025-05-04T08:56:17.963Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Error out if pixclock equals zero The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may cause divide-by-zero error. Although pixclock is checked in savagefb_decode_var(), but it is not checked properly in savagefb_probe(). Fix this by checking whether pixclock is zero in the function savagefb_check_var() before info->var.pixclock is used as the divisor. This is simil
er pixclock is zero in the function savagefb_check_var() before info->var.pixclock is used as the divisor. This is similar to CVE-2022-3061 in i740fb which was fixed by commit 15cf0b8. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/224453de8505aede1890f007be973925a3edf6a1 - https://git.kernel.org/stable/c/84dce0f6a4cc5b7bfd7242ef9290db8ac1dd77ff - https://git.kernel.org/stable/c/512ee6d6041e007ef5bf200c6e388e172a2c5b24 - https://git.kernel.org/stable/c/8c54acf33e5adaad6374bf3ec1e3aff0591cc8e1 - https://git.kernel.org/stable/c/070398d32c5f3ab0e890374904ad94551c76aec4 - https://git.kernel.org/stable/c/bc3c2e58d73b28b9a8
://git.kernel.org/stable/c/070398d32c5f3ab0e890374904ad94551c76aec4 - https://git.kernel.org/stable/c/bc3c2e58d73b28b9a8789fca84778ee165a72d13 - https://git.kernel.org/stable/c/a9ca4e80d23474f90841251f4ac0d941fa337a01 - https://git.kernel.org/stable/c/04e5eac8f3ab2ff52fa191c187a46d4fdbc1e288
CVE ID: CVE-2024-26779 State: PUBLISHED Published: 2024-04-03T17:01:09.807Z Last Updated: 2025-05-04T08:56:19.344Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix race condition on enabling fast-xmit fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls to the driver, leading to potential crashes because of uninitialized drv_priv data. Add a missing sta->uploaded check and re-check fast xmit after inserting a sta. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://
fter inserting a sta. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/76fad1174a0cae6fc857b9f88b261a2e4f07d587 - https://git.kernel.org/stable/c/85720b69aef177318f4a18efbcc4302228a340e5 - https://git.kernel.org/stable/c/5ffab99e070b9f8ae0cf60c3c3602b84eee818dd - https://git.kernel.org/stable/c/88c18fd06608b3adee547102505d715f21075c9d - https://git.kernel.org/stable/c/eb39bb548bf974acad7bd6780fe11f9e6652d696 - https://git.kernel.org/stable/c/54b79d8786964e2f840e8a2ec4a9f9a50f3d4954 - https://git.kernel.org/stable/c/281280276b70c822f55ce15b661f6d1d3228aaa9 - https://git.kernel.org/stable/c/bcbc84af1183c8cf3d1ca9b78540c21
.org/stable/c/281280276b70c822f55ce15b661f6d1d3228aaa9 - https://git.kernel.org/stable/c/bcbc84af1183c8cf3d1ca9b78540c2185cd85e7f
CVE ID: CVE-2024-26780 State: PUBLISHED Published: 2024-04-04T08:20:15.120Z Last Updated: 2025-05-04T08:56:20.708Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix task hung while purging oob_skb in GC. syzbot reported a task hung; at the same time, GC was looping infinitely in list_for_each_entry_safe() for OOB skb. [0] syzbot demonstrated that the list_for_each_entry_safe() was not actually safe in this case. A single skb could have references for multiple sockets. If we free such a skb in the list_for_each_entry_safe(), the current and next sockets could be unlinked in a single iteration. unix_notinflight() uses l
t_for_each_entry_safe(), the current and next sockets could be unlinked in a single iteration. unix_notinflight() uses list_del_init() to unlink the socket, so the prefetched next socket forms a loop itself and list_for_each_entry_safe() never stops. Here, we must use while() and make sure we always fetch the first socket. [0]: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 5065 Comm: syz-executor236 Not tainted 6.8.0-rc3-syzkaller-00136-g1f719a2f3fa6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline] RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline] RIP: 001
0:preempt_count arch/x86/include/asm/preempt.h:26 [inline] RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x60 kernel/kcov.c:207 Code: cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 48 8b 14 25 40 c2 03 00 <65> 8b 05 b4 7c 78 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74 RSP: 0018:ffffc900033efa58 EFLAGS: 00000283 RAX: ffff88807b077800 RBX: ffff88807b077800 RCX: 1ffffffff27b1189 RDX: ffff88802a5a3b80 RSI: ffffffff8968488d RDI: ffff88807b077f70 RBP: ffffc900033efbb0 R08: 0000000000000001 R09: fffffbfff27a900c R10: ffffffff93d48067 R11: ffffffff8ae000eb R12: ffff88807b077800 R13: dffffc0000000
0000000000001 R09: fffffbfff27a900c R10: ffffffff93d48067 R11: ffffffff8ae000eb R12: ffff88807b077800 R13: dffffc0000000000 R14: ffff88807b077e40 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564f4fc1e3a8 CR3: 000000000d57a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <NMI> </NMI> <TASK> unix_gc+0x563/0x13b0 net/unix/garbage.c:319 unix_release_sock+0xa93/0xf80 net/unix/af_unix.c:683 unix_release+0x91/0xf0 net/unix/af_unix.c:1064 __sock_release+0xb0/0x270 net/soc
sock+0xa93/0xf80 net/unix/af_unix.c:683 unix_release+0x91/0xf0 net/unix/af_unix.c:1064 __sock_release+0xb0/0x270 net/socket.c:659 sock_close+0x1c/0x30 net/socket.c:1421 __fput+0x270/0xb80 fs/file_table.c:376 task_work_run+0x14f/0x250 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa8a/0x2ad0 kernel/exit.c:871 do_group_exit+0xd4/0x2a0 kernel/exit.c:1020 __do_sys_exit_group kernel/exit.c:1031 [inline] __se_sys_exit_group kernel/exit.c:1029 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1029 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f9d6
[inline] do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f9d6cbdac09 Code: Unable to access opcode bytes at 0x7f9d6cbdabdf. RSP: 002b:00007fff5952feb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9d6cbdac09 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007f9d6cc552b0 R08: ffffffffffffffb8 R09: 0000000000000006 R10: 0000000000000006 R11: 0000000000000246 R12: 00007f9d6cc552b0 R13: 0000000000000000 R14: 00007f9d6cc55d00 R15: 00007f9d6cbabe70 </TASK> Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel