Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
is forcing full GT resets. (takes a while to trigger). The dmesg call trace: [ 5590.803000] BUG: unable to handle page fault for address: ffffffffa0b0e000 [ 5590.803009] #PF: supervisor read access in kernel mode [ 5590.803013] #PF: error_code(0x0000) - not-present page [ 5590.803016] PGD 5814067 P4D 5814067 PUD 5815063 PMD 109de4067 PTE 0 [ 5590.803022] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 5590.803026] CPU: 5 PID: 13656 Comm: i915_hangman Tainted: G U 5.17.0-rc5-ups69-guc-err-capt-rev6+ #136 [ 5590.803033] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-M LP4x RVP, BIOS ADLPFWI1.R00. 3031.A02.2201171222 01/17/2022 [ 5590.803039] RIP: 0010:memcpy_erms+0x6/0x10 [ 5590.80
ke-M LP4x RVP, BIOS ADLPFWI1.R00. 3031.A02.2201171222 01/17/2022 [ 5590.803039] RIP: 0010:memcpy_erms+0x6/0x10 [ 5590.803045] Code: fe ff ff cc eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 fe [ 5590.803054] RSP: 0018:ffffc90003a8fdf0 EFLAGS: 00010282 [ 5590.803057] RAX: ffff888107ee9000 RBX: ffff888108cb1a00 RCX: 0000000000000f8f [ 5590.803061] RDX: 0000000000001000 RSI: ffffffffa0b0e000 RDI: ffff888107ee9071 [ 5590.803065] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 [ 5590.803069] R10: 0000000000000001 R11: 0000000000000002 R12: 00000000
000 R08: 0000000000000001 R09: 0000000000000001 [ 5590.803069] R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000019 [ 5590.803073] R13: 0000000000174fff R14: 0000000000001000 R15: ffff888107ee9000 [ 5590.803077] FS: 00007f62a99bee80(0000) GS:ffff88849f880000(0000) knlGS:0000000000000000 [ 5590.803082] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5590.803085] CR2: ffffffffa0b0e000 CR3: 000000010a1a8004 CR4: 0000000000770ee0 [ 5590.803089] PKRU: 55555554 [ 5590.803091] Call Trace: [ 5590.803093] <TASK> [ 5590.803096] error_state_read+0xa1/0xd0 [i915] [ 5590.803175] kernfs_fop_read_iter+0xb2/0x1b0 [ 5590.803180] new_sync_read+0x116/0x1a0 [ 5590.803185] vfs_read+0x114/0x1b0 [
.803175] kernfs_fop_read_iter+0xb2/0x1b0 [ 5590.803180] new_sync_read+0x116/0x1a0 [ 5590.803185] vfs_read+0x114/0x1b0 [ 5590.803189] ksys_read+0x63/0xe0 [ 5590.803193] do_syscall_64+0x38/0xc0 [ 5590.803197] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 5590.803201] RIP: 0033:0x7f62aaea5912 [ 5590.803204] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 5a b9 0c 00 e8 05 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 5590.803213] RSP: 002b:00007fff5b659ae8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 5590.803218] RAX: ffffffffffffffda RBX: 0000000000100000 RCX: 00007f62aaea5912 [ 5590.803221] RDX: 0000000000
00000000 [ 5590.803218] RAX: ffffffffffffffda RBX: 0000000000100000 RCX: 00007f62aaea5912 [ 5590.803221] RDX: 000000000008b000 RSI: 00007f62a8c4000f RDI: 0000000000000006 [ 5590.803225] RBP: 00007f62a8bcb00f R08: 0000000000200010 R09: 0000000000101000 [ 5590.803229] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000006 [ 5590.803233] R13: 0000000000075000 R14: 00007f62a8acb010 R15: 0000000000200000 [ 5590.803238] </TASK> [ 5590.803240] Modules linked in: i915 ttm drm_buddy drm_dp_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops prime_numbers nfnetlink br_netfilter overlay mei_pxp mei_hdcp x86_pkg_temp_thermal coretemp kvm_intel snd_hda_codec_hdmi snd_hda_intel
fnetlink br_netfilter overlay mei_pxp mei_hdcp x86_pkg_temp_thermal coretemp kvm_intel snd_hda_codec_hdmi snd_hda_intel ---truncated--- References: - https://git.kernel.org/stable/c/63b26fe0252f923e6aca373e3ad4b31202dcd331 - https://git.kernel.org/stable/c/f4c5eba87675a07a6c28cdaca7366aeb4258ec78 - https://git.kernel.org/stable/c/606e5d565605e26bf61a0933a6d56940f339c080 - https://git.kernel.org/stable/c/c9b576d0c7bf55aeae1a736da7974fa202c4394d
CVE ID: CVE-2022-49724 State: PUBLISHED Published: 2025-02-26T02:24:36.699Z Last Updated: 2025-05-04T08:44:07.784Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tty: goldfish: Fix free_irq() on remove Pass the correct dev_id to free_irq() to fix this splat when the driver is unbound: WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 free_irq Trying to free already-free IRQ 65 Call Trace: warn_slowpath_fmt free_irq goldfish_tty_remove platform_remove device_remove device_release_driver_internal device_driver_detach unbind_store drv_attr_store ... References: - https://git.kernel.org/stable/c/c4b0b8edccb0cfb15a8cecf4161e0571d3
_detach unbind_store drv_attr_store ... References: - https://git.kernel.org/stable/c/c4b0b8edccb0cfb15a8cecf4161e0571d3daac64 - https://git.kernel.org/stable/c/c83a1d40dc624070a203eb383ef9fb60eb634136 - https://git.kernel.org/stable/c/f7183c76d500324b8b5bd0af5e663cfa57b7b836 - https://git.kernel.org/stable/c/65ca4db68b6819244df9024aea4be55edf8af1ef - https://git.kernel.org/stable/c/fb15e79cacddfbc62264e6e807bde50ad688e988 - https://git.kernel.org/stable/c/a6fcd7ffd76a9c1d998a2d02d518c78a55c5bed8 - https://git.kernel.org/stable/c/499e13aac6c762e1e828172b0f0f5275651d6512
CVE ID: CVE-2022-49725 State: PUBLISHED Published: 2025-02-26T02:24:37.349Z Last Updated: 2025-05-04T08:44:08.894Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: i40e: Fix call trace in setup_tx_descriptors After PF reset and ethtool -t there was call trace in dmesg sometimes leading to panic. When there was some time, around 5 seconds, between reset and test there were no errors. Problem was that pf reset calls i40e_vsi_close in prep_for_reset and ethtool -t calls i40e_vsi_close in diag_test. If there was not enough time between those commands the second i40e_vsi_close starts before previous i40e_vsi_close was done which leads
enough time between those commands the second i40e_vsi_close starts before previous i40e_vsi_close was done which leads to crash. Add check to diag_test if pf is in reset and don't start offline tests if it is true. Add netif_info("testing failed") into unhappy path of i40e_diag_test() References: - https://git.kernel.org/stable/c/5ba9956ca57e361fb13ea369bb753eb33177acc7 - https://git.kernel.org/stable/c/15950157e2c24865b696db1c9ccc72743ae0e967 - https://git.kernel.org/stable/c/ff6e03fe84bc917bb0c907d02de668c2fe101712 - https://git.kernel.org/stable/c/814092927a215f5ca6c08249ec72a205e0b473cd - https://git.kernel.org/stable/c/0a4e5a3dc5e41212870e6043895ae02455c93f63 - https://git.kernel.org/
249ec72a205e0b473cd - https://git.kernel.org/stable/c/0a4e5a3dc5e41212870e6043895ae02455c93f63 - https://git.kernel.org/stable/c/322271351b0e41565171e4cce70ea41854fac115 - https://git.kernel.org/stable/c/fd5855e6b1358e816710afee68a1d2bc685176ca
CVE ID: CVE-2022-49726 State: PUBLISHED Published: 2025-02-26T02:24:38.003Z Last Updated: 2025-05-04T08:44:10.038Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot use symbols annotated __init. The access to a freed symbol may end up with kernel panic. modpost used to detect it, but it has been broken for a decade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two
ecade. Recently, I fixed modpost so it started to warn it again, then this showed up in linux-next builds. There are two ways to fix it: - Remove __init - Remove EXPORT_SYMBOL I chose the latter for this case because the only in-tree call-site, arch/x86/kernel/cpu/mshyperv.c is never compiled as modular. (CONFIG_HYPERVISOR_GUEST is boolean) References: - https://git.kernel.org/stable/c/cff3a7ce6e81418b6e8bac941779bbf5d342d626 - https://git.kernel.org/stable/c/db965e2757d95f695e606856418cd84003dd036d - https://git.kernel.org/stable/c/0414eab7c78f3518143d383e448d44fc573ac6d2 - https://git.kernel.org/stable/c/937fcbb55a1e48a6422e87e8f49422c92265f102 - https://git.kernel.org/stable/c/245b993d8f6
- https://git.kernel.org/stable/c/937fcbb55a1e48a6422e87e8f49422c92265f102 - https://git.kernel.org/stable/c/245b993d8f6c4e25f19191edfbd8080b645e12b1
CVE ID: CVE-2022-49727 State: PUBLISHED Published: 2025-02-26T02:24:38.672Z Last Updated: 2025-10-01T19:36:43.909Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg When len >= INT_MAX - transhdrlen, ulen = len + transhdrlen will be overflow. To fix, we can follow what udpv6 does and subtract the transhdrlen from the max. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/2cf73c7cb6125083408d77f43d0e84d86aed0000 - https://git.kernel.org/stable/c/0e818d433fc2718fe4da044ffca7431812a7e04e - https://git.kernel.org/stable/c/6c4e3486d2117
https://git.kernel.org/stable/c/0e818d433fc2718fe4da044ffca7431812a7e04e - https://git.kernel.org/stable/c/6c4e3486d21173d60925ef52e512cae727b43d30 - https://git.kernel.org/stable/c/2f42389d270f2304c8855b0b63498a5a4d0c053d - https://git.kernel.org/stable/c/b8879ca1fd7348b4d5db7db86dcb97f60c73d751 - https://git.kernel.org/stable/c/27a37755ceb401111ded76810359d3adc4b268a1 - https://git.kernel.org/stable/c/034246122f5c5e2e2a0b9fe04e24517920e9beb1 - https://git.kernel.org/stable/c/f638a84afef3dfe10554c51820c16e39a278c915
CVE ID: CVE-2022-49728 State: PUBLISHED Published: 2025-02-26T02:24:39.347Z Last Updated: 2025-11-03T19:27:54.237Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in __ip6_append_data Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t. UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack
: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88 ____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8 __arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170 Changes since v1: -Change the variable [length] type to unsigned, as
64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170 Changes since v1: -Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2: -Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3: -Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/f26422eabeb517629568edf8c2dd9c6cb9147584 - https://git.kernel.org/stable/c/70549c80fe80ac4e2a22068c76ebebced24f7e74 - https://git.kernel.org/stable/c/84dc940890e91e42898e4443a093281702440abf - https://git.kernel.org/stable/c/f93431c86b631bbca5614c66f966bf3ddb
g/stable/c/84dc940890e91e42898e4443a093281702440abf - https://git.kernel.org/stable/c/f93431c86b631bbca5614c66f966bf3ddb3c2803
CVE ID: CVE-2022-49729 State: PUBLISHED Published: 2025-02-26T02:24:40.021Z Last Updated: 2025-10-01T19:36:43.790Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred Similar to the handling of play_deferred in commit 19cfe912c37b ("Bluetooth: btusb: Fix memory leak in play_deferred"), we thought a patch might be needed here as well. Currently usb_submit_urb is called directly to submit deferred tx urbs after unanchor them. So the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb and cause memory leak. Put those urbs in tx_anchor to avoid the leak, and also fix th
ed to unref it in usb_unanchor_urb and cause memory leak. Put those urbs in tx_anchor to avoid the leak, and also fix the error handling. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/1eb0afecfb9cd0f38424b82bd9aaa542310934ee - https://git.kernel.org/stable/c/f21f908347712b8288ffe83b531b5e977042b29c - https://git.kernel.org/stable/c/3e7c7df6991ac349f2fa8540047757df666e610f - https://git.kernel.org/stable/c/6b4d8b44e7163a77fe942f5b80e1651c1b78c537 - https://git.kernel.org/stable/c/0eeec1a8b0cd38c47edeb042980a6aeacecf35ed - https://git.kernel.org/stable/c/6616872cfe7f0474a22dd1f12699f95bcf81a54d - https://git.kernel.org/stable/c/3eadc560c1919b8
tps://git.kernel.org/stable/c/6616872cfe7f0474a22dd1f12699f95bcf81a54d - https://git.kernel.org/stable/c/3eadc560c1919b8193d17334145dad9a917960e4 - https://git.kernel.org/stable/c/8a4d480702b71184fabcf379b80bf7539716752e
CVE ID: CVE-2022-49730 State: PUBLISHED Published: 2025-02-26T02:24:40.643Z Last Updated: 2025-05-04T08:44:14.341Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Resolve NULL ptr dereference after an ELS LOGO is aborted A use-after-free crash can occur after an ELS LOGO is aborted. Specifically, a nodelist structure is freed and then ndlp->vport->cfg_log_verbose is dereferenced in lpfc_nlp_get() when the discovery state machine is mistakenly called a second time with NLP_EVT_DEVICE_RM argument. Rework lpfc_cmpl_els_logo() to prevent the duplicate calls to release a nodelist structure. Additional Analyst Notes: - CIS
ork lpfc_cmpl_els_logo() to prevent the duplicate calls to release a nodelist structure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5e83869e29448958f8ae2c6911f350318f75e4fc - https://git.kernel.org/stable/c/eea34ce23dc3a595695856dc73bb132a9c5a2902 - https://git.kernel.org/stable/c/b1b3440f437b75fb2a9b0cfe58df461e40eca474
CVE ID: CVE-2022-49731 State: PUBLISHED Published: 2025-02-26T02:24:41.300Z Last Updated: 2025-10-01T19:36:43.656Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() In an unlikely (and probably wrong?) case that the 'ppi' parameter of ata_host_alloc_pinfo() points to an array starting with a NULL pointer, there's going to be a kernel oops as the 'pi' local variable won't get reassigned from the initial value of NULL. Initialize 'pi' instead to '&ata_dummy_port_info' to fix the possible kernel oops for good... Found by Linux Verification Center (linuxtesting.org) wi
ta_dummy_port_info' to fix the possible kernel oops for good... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ca4693e6e06e4fd2b240c0fec47aa2498c94848e - https://git.kernel.org/stable/c/1ac5efee33f29e704226506d429b84575a5d66f8 - https://git.kernel.org/stable/c/a810bd5af06977a847d1f202b22d7defd5c62497 - https://git.kernel.org/stable/c/253334f84c81bc6a43af489f108c0bddad989eef - https://git.kernel.org/stable/c/36cd19e7d4e5571d77a2ed20c5b6ef50cf57734a - https://git.kernel.org/stable/c/ff128fbea720bf763fa345680dda5f050bc24a47 - https://git.kernel.org/stable/
ef50cf57734a - https://git.kernel.org/stable/c/ff128fbea720bf763fa345680dda5f050bc24a47 - https://git.kernel.org/stable/c/07cbdb4807d369fbda73062a91b570c4dc5ec429 - https://git.kernel.org/stable/c/bf476fe22aa1851bab4728e0c49025a6a0bea307
CVE ID: CVE-2022-49732 State: PUBLISHED Published: 2025-02-26T14:57:24.827Z Last Updated: 2025-05-04T08:44:16.828Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sock: redo the psock vs ULP protection check Commit 8a59f9d1e3d4 ("sock: Introduce sk->sk_prot->psock_update_sk_prot()") has moved the inet_csk_has_ulp(sk) check from sk_psock_init() to the new tcp_bpf_update_proto() function. I'm guessing that this was done to allow creating psocks for non-inet sockets. Unfortunately the destruction path for psock includes the ULP unwind, so we need to fail the sk_psock_init() itself. Otherwise if ULP is already present we'll notice t
cludes the ULP unwind, so we need to fail the sk_psock_init() itself. Otherwise if ULP is already present we'll notice that later, and call tcp_update_ulp() with the sk_proto of the ULP itself, which will most likely result in the ULP looping its callbacks. References: - https://git.kernel.org/stable/c/72fa0f65b56605b8a9ae9fba2082f2123f7fe017 - https://git.kernel.org/stable/c/922309e50befb0cfa5cb65e4989b7706d6578846 - https://git.kernel.org/stable/c/e34a07c0ae3906f97eb18df50902e2a01c1015b6
CVE ID: CVE-2022-49733 State: PUBLISHED Published: 2025-03-02T14:30:02.838Z Last Updated: 2025-10-01T19:36:38.398Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, then takes the params_lock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently. The fix is simply to c
result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently. The fix is simply to cover snd_pcm_oss_make_ready() call into the same params_lock mutex with snd_pcm_oss_make_ready_locked() variant. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0 - https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36 - https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86 - https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb - https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d
CVE ID: CVE-2022-49737 State: PUBLISHED Published: 2025-03-16T00:00:00.000Z Last Updated: 2025-03-17T16:07:13.541Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: X.org Products: X server Problem Types: CWE-413 Description: In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, aka a race condition. In particular, AttachDevice in dix/devices.c does not acquire an input lock. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081338 - https://gitlab.fr
es: - CISA ADP Vulnrichment: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081338 - https://gitlab.freedesktop.org/xorg/xserver/-/issues/1260 - https://bugs.debian.org/cgi-bin/bugreport.cgi?att=1;bug=1081338;filename=dix-Hold-input-lock-for-AttachDevice.patch;msg=5 - https://gitlab.freedesktop.org/xorg/xserver/-/commit/dc7cb45482cea6ccec22d117ca0b489500b4d0a0
CVE ID: CVE-2022-49738 State: PUBLISHED Published: 2025-03-27T16:42:50.951Z Last Updated: 2025-10-01T17:36:56.110Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on i_extra_isize in is_alive() syzbot found a f2fs bug: BUG: KASAN: slab-out-of-bounds in data_blkaddr fs/f2fs/f2fs.h:2891 [inline] BUG: KASAN: slab-out-of-bounds in is_alive fs/f2fs/gc.c:1117 [inline] BUG: KASAN: slab-out-of-bounds in gc_data_segment fs/f2fs/gc.c:1520 [inline] BUG: KASAN: slab-out-of-bounds in do_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734 Read of size 4 at addr ffff888076557568 by task kworker/u4:3/52 CPU: 1 PID: 52 C
collect+0x386a/0x3df0 fs/f2fs/gc.c:1734 Read of size 4 at addr ffff888076557568 by task kworker/u4:3/52 CPU: 1 PID: 52 Comm: kworker/u4:3 Not tainted 6.1.0-rc4-syzkaller-00362-gfef7fd48922d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15e/0x45d mm/kasan/report.c:395 kasan_report+0xbb/0x1f0 mm/kasan/report.c:495 data_blkaddr fs/f2fs/f2fs.h:2891 [inline] is_alive fs/f2fs/gc.c:1117 [inline] gc_data_segment fs/f2fs/gc.c:1520 [inl
495 data_blkaddr fs/f2fs/f2fs.h:2891 [inline] is_alive fs/f2fs/gc.c:1117 [inline] gc_data_segment fs/f2fs/gc.c:1520 [inline] do_garbage_collect+0x386a/0x3df0 fs/f2fs/gc.c:1734 f2fs_gc+0x88c/0x20a0 fs/f2fs/gc.c:1831 f2fs_balance_fs+0x544/0x6b0 fs/f2fs/segment.c:410 f2fs_write_inode+0x57e/0xe20 fs/f2fs/inode.c:753 write_inode fs/fs-writeback.c:1440 [inline] __writeback_single_inode+0xcfc/0x1440 fs/fs-writeback.c:1652 writeback_sb_inodes+0x54d/0xf90 fs/fs-writeback.c:1870 wb_writeback+0x2c5/0xd70 fs/fs-writeback.c:2044 wb_do_writeback fs/fs-writeback.c:2187 [inline] wb_workfn+0x2dc/0x12f0 fs/fs-writeback.c:2227 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 ker
0x2dc/0x12f0 fs/fs-writeback.c:2227 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 The root cause is that we forgot to do sanity check on .i_extra_isize in below path, result in accessing invalid address later, fix it. - gc_data_segment - is_alive - data_blkaddr - offset_in_addr Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/e5142a4935c1f15841d06047b8130078fc4d7b8f - https://git.kernel.org/stable/c/914e38f02a490dafd980ff0f39cccedc074deb29 - https://git.kernel.org/stable/c/97ccfffcc061e54ce87e
/git.kernel.org/stable/c/914e38f02a490dafd980ff0f39cccedc074deb29 - https://git.kernel.org/stable/c/97ccfffcc061e54ce87e4a51a40e2e9cb0b7076a - https://git.kernel.org/stable/c/5b25035fb888cb2f78bf0b9c9f95b1dc54480d36 - https://git.kernel.org/stable/c/d3b7b4afd6b2c344eabf9cc26b8bfa903c164c7c
CVE ID: CVE-2022-49739 State: PUBLISHED Published: 2025-03-27T16:42:51.609Z Last Updated: 2025-05-04T08:44:21.114Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: gfs2: Always check inode size of inline inodes Check if the inode size of stuffed (inline) inodes is within the allowed range when reading inodes from disk (gfs2_dinode_in()). This prevents us from on-disk corruption. The two checks in stuffed_readpage() and gfs2_unstuffer_page() that just truncate inline data to the maximum allowed size don't actually make sense, and they can be removed now as well. References: - https://git.kernel.org/stable/c/45df749f827c286adbc951f
y make sense, and they can be removed now as well. References: - https://git.kernel.org/stable/c/45df749f827c286adbc951f2a4865b67f0442ba9 - https://git.kernel.org/stable/c/4d4cb76636134bf9a0c9c3432dae936f99954586 - https://git.kernel.org/stable/c/7c414f6f06e9a3934901b6edc3177ae5a1e07094 - https://git.kernel.org/stable/c/46c9088cabd4d0469fdb61ac2a9c5003057fe94d - https://git.kernel.org/stable/c/d458a0984429c2d47e60254f5bc4119cbafe83a2 - https://git.kernel.org/stable/c/70376c7ff31221f1d21db5611d8209e677781d3a