Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rite.c:934 [inline] do_pwritev+0x1e5/0x380 fs/read_write.c:1031 [...] ================================================================== Above issue may happen as follows: cpu1 cpu2 __________________________|__________________________ do_pwritev vfs_writev do_iter_write ext4_file_write_iter ext4_buffered_write_iter generic_perform_write ext4_da_write_begin vfs_fallocate ext4_fallocate ext4_convert_inline_data ext4_convert_inline_data_nolock ext4_destroy_inline_data_nolock clear EXT4_STATE_MAY_INLINE_DATA ext4_map_blocks ext4_ext_map_blocks ext4_mb_new_blocks ext4_mb_regular_allocator ext4_mb_good_group_nolock ext4_mb_init_group ext4_mb_init_cache ext4_mb_generate_buddy --> error ext4_test_i
r_allocator ext4_mb_good_group_nolock ext4_mb_init_group ext4_mb_init_cache ext4_mb_generate_buddy --> error ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_restore_inline_data set EXT4_STATE_MAY_INLINE_DATA ext4_block_write_begin ext4_da_write_end ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) ext4_write_inline_data_end handle=NULL ext4_journal_stop(handle) __ext4_journal_stop ext4_put_nojournal(handle) ref_cnt = (unsigned long)handle BUG_ON(ref_cnt == 0) ---> BUG_ON The lock held by ext4_convert_inline_data is xattr_sem, but the lock held by generic_perform_write is i_rwsem. Therefore, the two locks can be concurrent. To solve above issue, we add inode_lock() for ex
c_perform_write is i_rwsem. Therefore, the two locks can be concurrent. To solve above issue, we add inode_lock() for ext4_convert_inline_data(). At the same time, move ext4_convert_inline_data() in front of ext4_punch_hole(), remove similar handling from ext4_punch_hole(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/18881d7e517169193d9ef6c89c7f322e3e164277 - https://git.kernel.org/stable/c/91f90b571f1a23f5b8a9c2b68a9aa5d6981a3c3d - https://git.kernel.org/stable/c/14602353b350950b551eccc6b46411aa3b12ffe2 - https://git.kernel.org/stable/c/725e00cb7039eae291890f1bb19bc867176745f6 - https://git.kernel.org/stable/c/ccc6639f831bee91aa8b41c8a1cd
nel.org/stable/c/725e00cb7039eae291890f1bb19bc867176745f6 - https://git.kernel.org/stable/c/ccc6639f831bee91aa8b41c8a1cdd020ecfb9f32 - https://git.kernel.org/stable/c/f87c7a4b084afc13190cbb263538e444cb2b392a
CVE ID: CVE-2022-49415 State: PUBLISHED Published: 2025-02-26T02:12:35.593Z Last Updated: 2025-05-04T08:37:11.516Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipmi:ipmb: Fix refcount leak in ipmi_ipmb_probe of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/f22068357acc268148bd55ce77f0a3e5c86701b4 - https://git.kernel.org/stable/c/a508e33956b538e034ed5df619a73ec7c15bda72
CVE ID: CVE-2022-49416 State: PUBLISHED Published: 2025-02-26T02:12:37.173Z Last Updated: 2025-05-04T08:37:12.553Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free in chanctx code In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's replace_state is set to IEEE80211_CHANCTX_REPLACE_NONE, we free the old context in ieee80211_vif_use_reserved_reassign(). Therefore, we cannot check the old_ctx anymore, so we should set it to NULL after this point. However, since the new_ctx replace state is clearly not IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do any
int. However, since the new_ctx replace state is clearly not IEEE80211_CHANCTX_REPLACES_OTHER, we're not going to do anything else in this function and can just return to avoid accessing the freed old_ctx. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/88cc8f963febe192d6ded9df7217f92f380b449a - https://git.kernel.org/stable/c/4ba81e794f0fad6234f644c2da1ae14d5b95e1c4 - https://git.kernel.org/stable/c/9f1e5cc85ad77e52f54049a94db0407445ae2a34 - https://git.kernel.org/stable/c/265bec4779a38b65e86a25120370f200822dfa76 - https://git.kernel.org/stable/c/6118bbdf69f4718b02d26bbcf2e497eb66004331 - https://git.kernel.org/stable/c/b79110f2bf6022e60e590d
it.kernel.org/stable/c/6118bbdf69f4718b02d26bbcf2e497eb66004331 - https://git.kernel.org/stable/c/b79110f2bf6022e60e590d2e094728a8eec3e79e - https://git.kernel.org/stable/c/82c8e7bbdd06c7ed58e22450cc5b37f33a25bb2c - https://git.kernel.org/stable/c/4f05a9e15edcdf5b97e0d86ab6ecd5f187289f6c - https://git.kernel.org/stable/c/2965c4cdf7ad9ce0796fac5e57debb9519ea721e
CVE ID: CVE-2022-49417 State: PUBLISHED Published: 2025-02-26T02:12:42.872Z Last Updated: 2025-05-04T08:37:13.761Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iwlwifi: mei: fix potential NULL-ptr deref If SKB allocation fails, continue rather than using the NULL pointer. Coverity CID: 1497650 References: - https://git.kernel.org/stable/c/29b81de94d62b5e2704bb5106b3e701ca8d7c7a4 - https://git.kernel.org/stable/c/5d8d06fd3a02919100b28f927bcb76481ec0a0e3 - https://git.kernel.org/stable/c/78488a64aea94a3336ee97f345c1496e9bc5ebdf
CVE ID: CVE-2022-49418 State: PUBLISHED Published: 2025-02-26T02:12:43.359Z Last Updated: 2025-06-19T12:39:09.366Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4_label on referral lookup. Send along the already-allocated fattr along with nfs4_fs_locations, and drop the memcpy of fattr. We end up growing two more allocations, but this fixes up a crash as: PID: 790 TASK: ffff88811b43c000 CPU: 0 COMMAND: "ls" #0 [ffffc90000857920] panic at ffffffff81b9bfde #1 [ffffc900008579c0] do_trap at ffffffff81023a9b #2 [ffffc90000857a10] do_error_trap at ffffffff81023b78 #3 [ffffc90000857a58] exc_stack_s
0] do_trap at ffffffff81023a9b #2 [ffffc90000857a10] do_error_trap at ffffffff81023b78 #3 [ffffc90000857a58] exc_stack_segment at ffffffff81be1f45 #4 [ffffc90000857a80] asm_exc_stack_segment at ffffffff81c009de #5 [ffffc90000857b08] nfs_lookup at ffffffffa0302322 [nfs] #6 [ffffc90000857b70] __lookup_slow at ffffffff813a4a5f #7 [ffffc90000857c60] walk_component at ffffffff813a86c4 #8 [ffffc90000857cb8] path_lookupat at ffffffff813a9553 #9 [ffffc90000857cf0] filename_lookup at ffffffff813ab86b References: - https://git.kernel.org/stable/c/6015292653d95ba9f72906e2b65e536aa5807d64 - https://git.kernel.org/stable/c/c3ed222745d9ad7b69299b349a64ba533c64a34f
CVE ID: CVE-2022-49419 State: PUBLISHED Published: 2025-02-26T02:12:43.849Z Last Updated: 2025-05-04T08:37:16.184Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup Commit b3c9a924aab6 ("fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove") fixed a use-after-free error due the vesafb driver freeing the fb_info in the .remove handler instead of doing it in .fb_destroy. This can happen if the .fb_destroy callback is executed after the .remove callback, since the former tries to access a pointer freed by the latter. But that change didn't take into acc
e .remove callback, since the former tries to access a pointer freed by the latter. But that change didn't take into account that another possible scenario is that .fb_destroy is called before the .remove callback. For example, if no process has the fbdev chardev opened by the time the driver is removed. If that's the case, fb_info will be freed when unregister_framebuffer() is called, making the fb_info pointer accessed in vesafb_remove() after that to no longer be valid. To prevent that, move the expression containing the info->par to happen before the unregister_framebuffer() function call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0f
fer() function call. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0fac5f8fb1bc2fc4f8714bf5e743c9cc3f547c63 - https://git.kernel.org/stable/c/f605f5558ecc175ec70016a3c15f007cb6386531 - https://git.kernel.org/stable/c/d260cad015945d1f4bb9b028a096f648506106a2 - https://git.kernel.org/stable/c/acde4003efc16480375543638484d8f13f2e99a3
CVE ID: CVE-2022-49420 State: PUBLISHED Published: 2025-02-26T02:12:44.316Z Last Updated: 2025-05-04T08:37:17.463Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: annotate races around sk->sk_bound_dev_if UDP sendmsg() is lockless, and reads sk->sk_bound_dev_if while this field can be changed by another thread. Adds minimal annotations to avoid KCSAN splats for UDP. Following patches will add more annotations to potential lockless readers. BUG: KCSAN: data-race in __ip6_datagram_connect / udpv6_sendmsg write to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0: __ip6_datagram_connect+0x6e2/0x930 net/ipv6/datagram.c:221 ip
te to 0xffff888136d47a94 of 4 bytes by task 7681 on cpu 0: __ip6_datagram_connect+0x6e2/0x930 net/ipv6/datagram.c:221 ip6_datagram_connect+0x2a/0x40 net/ipv6/datagram.c:272 inet_dgram_connect+0x107/0x190 net/ipv4/af_inet.c:576 __sys_connect_file net/socket.c:1900 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1917 __do_sys_connect net/socket.c:1927 [inline] __se_sys_connect net/socket.c:1924 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:1924 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1: udpv6_sendmsg+0xc60/0x16e0 net/ipv6/udp.c:143
ame+0x44/0xae read to 0xffff888136d47a94 of 4 bytes by task 7670 on cpu 1: udpv6_sendmsg+0xc60/0x16e0 net/ipv6/udp.c:1436 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:652 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline] __sys_sendmmsg+0x267/0x4c0 net/socket.c:2553 __do_sys_sendmmsg net/socket.c:2582 [inline] __se_sys_sendmmsg net/socket.c:2579 [inline] __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000000 -> 0xff
scall_64+0x2b/0x50 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000000 -> 0xffffff9b Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 7670 Comm: syz-executor.3 Tainted: G W 5.18.0-rc1-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 I chose to not add Fixes: tag because race has minor consequences and stable teams busy enough. References: - https://git.kernel.org/stable/c/20b2f61797873a2b18b5ff1a304ad2674fa1e0a5 - https://git.kernel.org/stable/c/4c971d2f3548e4f11b1460ac048f5307e4b39fdb
CVE ID: CVE-2022-49421 State: PUBLISHED Published: 2025-02-26T02:12:44.790Z Last Updated: 2025-05-04T08:37:19.074Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/6c92711db7c90f78e0b67ac2a8944d0fe7e12d83 - https://git.kernel.org/stable/c/2e2e2c71b2642289438392edbf5d08cdbc0b138b - https://git.kernel.org/stable/c/51eb1bb6baeb478538dd4ec6459fd68c44a85
table/c/2e2e2c71b2642289438392edbf5d08cdbc0b138b - https://git.kernel.org/stable/c/51eb1bb6baeb478538dd4ec6459fd68c44a855b1 - https://git.kernel.org/stable/c/8db59df7f5826e104db82cfddbf22a33a151193e - https://git.kernel.org/stable/c/c1c4405222b6fc98c16e8c2aa679c14e41d81465 - https://git.kernel.org/stable/c/f2dfb4ab887d67be7d0892ba041d3c8d738d3356 - https://git.kernel.org/stable/c/bbb2a24e863b6a10129546a0a4ceea2f07deec39 - https://git.kernel.org/stable/c/38d245cebf545338a6bc1c7762023de3fbecd7b7 - https://git.kernel.org/stable/c/b23789a59fa6f00e98a319291819f91fbba0deb8
CVE ID: CVE-2022-49422 State: PUBLISHED Published: 2025-02-26T02:12:45.269Z Last Updated: 2025-05-04T08:37:20.205Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix the error handling path in idxd_cdev_register() If a call to alloc_chrdev_region() fails, the already allocated resources are leaking. Add the needed error handling path to fix the leak. References: - https://git.kernel.org/stable/c/6073af78156b8c3fc1198f8bcc190b7ac3ac0143 - https://git.kernel.org/stable/c/b3c7b5d08e9d5b2ff31c03078c00ecf11042419f - https://git.kernel.org/stable/c/5e88561eceb34ae3f88451c2b8e30fe403484189 - https://git.kernel.org/sta
8c00ecf11042419f - https://git.kernel.org/stable/c/5e88561eceb34ae3f88451c2b8e30fe403484189 - https://git.kernel.org/stable/c/c308a2e711a52a47f4b45e7add2b5200169e429a - https://git.kernel.org/stable/c/aab08c1aac01097815fbcf10fce7021d2396a31f
CVE ID: CVE-2022-49423 State: PUBLISHED Published: 2025-02-26T02:12:45.750Z Last Updated: 2025-05-04T08:37:21.525Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rtla: Avoid record NULL pointer dereference Fix the following null/deref_null.cocci errors: ./tools/tracing/rtla/src/osnoise_hist.c:870:31-36: ERROR: record is NULL but dereferenced. ./tools/tracing/rtla/src/osnoise_top.c:650:31-36: ERROR: record is NULL but dereferenced. ./tools/tracing/rtla/src/timerlat_hist.c:905:31-36: ERROR: record is NULL but dereferenced. ./tools/tracing/rtla/src/timerlat_top.c:700:31-36: ERROR: record is NULL but dereferenced. "record" is NULL
referenced. ./tools/tracing/rtla/src/timerlat_top.c:700:31-36: ERROR: record is NULL but dereferenced. "record" is NULL before calling osnoise_init_trace_tool. Add a tag "out_free" to avoid dereferring a NULL pointer. References: - https://git.kernel.org/stable/c/b0f1c686baff74d5df10f2f46670ef4e24a75756 - https://git.kernel.org/stable/c/2a6b52ed72c822b5ee146a6a00ea66614fe02653
CVE ID: CVE-2022-49424 State: PUBLISHED Published: 2025-02-26T02:12:46.209Z Last Updated: 2025-05-04T12:44:40.498Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointer dereference when printing dev_name When larbdev is NULL (in the case I hit, the node is incorrectly set iommus = <&iommu NUM>), it will cause device_link_add() fail and kernel crashes when we try to print dev_name(larbdev). Let's fail the probe if a larbdev is NULL to avoid invalid inputs from dts. It should work for normal correct setting and avoid the crash caused by my incorrect setting. Error log: [ 18.189042][ T301] Unable to handl
ormal correct setting and avoid the crash caused by my incorrect setting. Error log: [ 18.189042][ T301] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 ... [ 18.344519][ T301] pstate: a0400005 (NzCv daif +PAN -UAO) [ 18.345213][ T301] pc : mtk_iommu_probe_device+0xf8/0x118 [mtk_iommu] [ 18.346050][ T301] lr : mtk_iommu_probe_device+0xd0/0x118 [mtk_iommu] [ 18.346884][ T301] sp : ffffffc00a5635e0 [ 18.347392][ T301] x29: ffffffc00a5635e0 x28: ffffffd44a46c1d8 [ 18.348156][ T301] x27: ffffff80c39a8000 x26: ffffffd44a80cc38 [ 18.348917][ T301] x25: 0000000000000000 x24: ffffffd44a80cc38 [ 18.349677][ T301] x23: ffffffd44e4da4c6 x22: ffffffd44a80cc38 [ 18.35
301] x25: 0000000000000000 x24: ffffffd44a80cc38 [ 18.349677][ T301] x23: ffffffd44e4da4c6 x22: ffffffd44a80cc38 [ 18.350438][ T301] x21: ffffff80cecd1880 x20: 0000000000000000 [ 18.351198][ T301] x19: ffffff80c439f010 x18: ffffffc00a50d0c0 [ 18.351959][ T301] x17: ffffffffffffffff x16: 0000000000000004 [ 18.352719][ T301] x15: 0000000000000004 x14: ffffffd44eb5d420 [ 18.353480][ T301] x13: 0000000000000ad2 x12: 0000000000000003 [ 18.354241][ T301] x11: 00000000fffffad2 x10: c0000000fffffad2 [ 18.355003][ T301] x9 : a0d288d8d7142d00 x8 : a0d288d8d7142d00 [ 18.355763][ T301] x7 : ffffffd44c2bc640 x6 : 0000000000000000 [ 18.356524][ T301] x5 : 0000000000000080 x4 : 0000000000000001 [ 18.357284
x7 : ffffffd44c2bc640 x6 : 0000000000000000 [ 18.356524][ T301] x5 : 0000000000000080 x4 : 0000000000000001 [ 18.357284][ T301] x3 : 0000000000000000 x2 : 0000000000000005 [ 18.358045][ T301] x1 : 0000000000000000 x0 : 0000000000000000 [ 18.360208][ T301] Hardware name: MT6873 (DT) [ 18.360771][ T301] Call trace: [ 18.361168][ T301] dump_backtrace+0xf8/0x1f0 [ 18.361737][ T301] dump_stack_lvl+0xa8/0x11c [ 18.362305][ T301] dump_stack+0x1c/0x2c [ 18.362816][ T301] mrdump_common_die+0x184/0x40c [mrdump] [ 18.363575][ T301] ipanic_die+0x24/0x38 [mrdump] [ 18.364230][ T301] atomic_notifier_call_chain+0x128/0x2b8 [ 18.364937][ T301] die+0x16c/0x568 [ 18.365394][ T301] __do_kernel_fault+0x1e8/0x2
omic_notifier_call_chain+0x128/0x2b8 [ 18.364937][ T301] die+0x16c/0x568 [ 18.365394][ T301] __do_kernel_fault+0x1e8/0x214 [ 18.365402][ T301] do_page_fault+0xb8/0x678 [ 18.366934][ T301] do_translation_fault+0x48/0x64 [ 18.368645][ T301] do_mem_abort+0x68/0x148 [ 18.368652][ T301] el1_abort+0x40/0x64 [ 18.368660][ T301] el1h_64_sync_handler+0x54/0x88 [ 18.368668][ T301] el1h_64_sync+0x68/0x6c [ 18.368673][ T301] mtk_iommu_probe_device+0xf8/0x118 [mtk_iommu] ... References: - https://git.kernel.org/stable/c/c3c2734e28d7fac50228c4d2b8896e8695adf304 - https://git.kernel.org/stable/c/e9c63c0f73a1bbfd02624f5eae7e881df8b6830f - https://git.kernel.org/stable/c/8837c2682b9b2eed83e6212bcf79850c593a6
table/c/e9c63c0f73a1bbfd02624f5eae7e881df8b6830f - https://git.kernel.org/stable/c/8837c2682b9b2eed83e6212bcf79850c593a6fee - https://git.kernel.org/stable/c/de78657e16f41417da9332f09c2d67d100096939
CVE ID: CVE-2022-49425 State: PUBLISHED Published: 2025-02-26T02:12:46.702Z Last Updated: 2025-05-04T08:37:23.852Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix dereference of stale list iterator after loop body The list iterator variable will be a bogus pointer if no break was hit. Dereferencing it (cur->page in this case) could load an out-of-bounds/undefined value making it unsafe to use that in the comparision to determine if the specific element was found. Since 'cur->page' *can* be out-ouf-bounds it cannot be guaranteed that by chance (or intention of an attacker) it matches the value of 'page' even though the
nds it cannot be guaranteed that by chance (or intention of an attacker) it matches the value of 'page' even though the correct element was not found. This is fixed by using a separate list iterator variable for the loop and only setting the original variable if a suitable element was found. Then determing if the element was found is simply checking if the variable is set. References: - https://git.kernel.org/stable/c/385edd3ce5b4b1e9d31f474a5e35a39779ec1110 - https://git.kernel.org/stable/c/5e47a7add3dda7f236548c5ec3017776dc2a729f - https://git.kernel.org/stable/c/51d584704d18e60fa473823654f35611c777b291 - https://git.kernel.org/stable/c/45b2b7d7108ae1e25a5036cab04ab9273e792332 - https://gi
4d18e60fa473823654f35611c777b291 - https://git.kernel.org/stable/c/45b2b7d7108ae1e25a5036cab04ab9273e792332 - https://git.kernel.org/stable/c/b26e1c777890e4b938136deb8ec07a29f33862e4 - https://git.kernel.org/stable/c/ed7efc472c00986dcd6903ab6ed165c7fa167674 - https://git.kernel.org/stable/c/2aaf51dd39afb6d01d13f1e6fe20b684733b37d5
CVE ID: CVE-2022-49426 State: PUBLISHED Published: 2025-02-26T02:12:47.206Z Last Updated: 2025-05-04T08:37:24.999Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-sva: Fix mm use-after-free We currently call arm64_mm_context_put() without holding a reference to the mm, which can result in use-after-free. Call mmgrab()/mmdrop() to ensure the mm only gets freed after we unpinned the ASID. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/fc90f13ea0dcd960e5002d204fa55cec4e0db2fa - https://git.kernel.org/stable/c/e3cbbdbff8a4db5d053c53fd71be62ccccdb52b0 - https://git.k
cd960e5002d204fa55cec4e0db2fa - https://git.kernel.org/stable/c/e3cbbdbff8a4db5d053c53fd71be62ccccdb52b0 - https://git.kernel.org/stable/c/9aa215450888cf29af0c479e14a712dc6b0c506c - https://git.kernel.org/stable/c/cbd23144f7662b00bcde32a938c4a4057e476d68
CVE ID: CVE-2022-49427 State: PUBLISHED Published: 2025-02-26T02:12:47.692Z Last Updated: 2025-05-04T12:44:41.612Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Remove clk_disable in mtk_iommu_remove After the commit b34ea31fe013 ("iommu/mediatek: Always enable the clk on resume"), the iommu clock is controlled by the runtime callback. thus remove the clk control in the mtk_iommu_remove. Otherwise, it will warning like: echo 14018000.iommu > /sys/bus/platform/drivers/mtk-iommu/unbind [ 51.413044] ------------[ cut here ]------------ [ 51.413648] vpp0_smi_iommu already disabled [ 51.414233] WARNING: CPU: 2 PID:
44] ------------[ cut here ]------------ [ 51.413648] vpp0_smi_iommu already disabled [ 51.414233] WARNING: CPU: 2 PID: 157 at */v5.15-rc1/kernel/mediatek/ drivers/clk/clk.c:952 clk_core_disable+0xb0/0xb8 [ 51.417174] Hardware name: MT8195V/C(ENG) (DT) [ 51.418635] pc : clk_core_disable+0xb0/0xb8 [ 51.419177] lr : clk_core_disable+0xb0/0xb8 ... [ 51.429375] Call trace: [ 51.429694] clk_core_disable+0xb0/0xb8 [ 51.430193] clk_core_disable_lock+0x24/0x40 [ 51.430745] clk_disable+0x20/0x30 [ 51.431189] mtk_iommu_remove+0x58/0x118 [ 51.431705] platform_remove+0x28/0x60 [ 51.432197] device_release_driver_internal+0x110/0x1f0 [ 51.432873] device_driver_detach+0x18/0x28 [ 51.433418] unbind_store+0x
197] device_release_driver_internal+0x110/0x1f0 [ 51.432873] device_driver_detach+0x18/0x28 [ 51.433418] unbind_store+0xd4/0x108 [ 51.433886] drv_attr_store+0x24/0x38 [ 51.434363] sysfs_kf_write+0x40/0x58 [ 51.434843] kernfs_fop_write_iter+0x164/0x1e0 References: - https://git.kernel.org/stable/c/053465ab20dcd324a43a1811ee98e5721e6a3e65 - https://git.kernel.org/stable/c/9b3bd97acb4f8954b8a43a5d63ed9050d463b4e1 - https://git.kernel.org/stable/c/6eaa046c696c83542c56765cdde564d9818ff1fb - https://git.kernel.org/stable/c/98df772bdd1c4ce717a26289efea15cbbe4b64ed
CVE ID: CVE-2022-49428 State: PUBLISHED Published: 2025-02-26T02:12:48.149Z Last Updated: 2025-05-04T08:37:27.663Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on inline_dots inode As Wenqing reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215765 It will cause a kernel panic with steps: - mkdir mnt - mount tmp40.img mnt - ls mnt folio_mark_dirty+0x33/0x50 f2fs_add_regular_entry+0x541/0xad0 [f2fs] f2fs_add_dentry+0x6c/0xb0 [f2fs] f2fs_do_add_link+0x182/0x230 [f2fs] __recover_dot_dentries+0x2d6/0x470 [f2fs] f2fs_lookup+0x5af/0x6a0 [f2fs] __lookup_slow+0xac/0x200 lookup_slow+0x45/0x
s] __recover_dot_dentries+0x2d6/0x470 [f2fs] f2fs_lookup+0x5af/0x6a0 [f2fs] __lookup_slow+0xac/0x200 lookup_slow+0x45/0x70 walk_component+0x16c/0x250 path_lookupat+0x8b/0x1f0 filename_lookup+0xef/0x250 user_path_at_empty+0x46/0x70 vfs_statx+0x98/0x190 __do_sys_newlstat+0x41/0x90 __x64_sys_newlstat+0x1a/0x30 do_syscall_64+0x37/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is for special file: e.g. character, block, fifo or socket file, f2fs doesn't assign address space operations pointer array for mapping->a_ops field, so, in a fuzzed image, if inline_dots flag was tagged in special file, during lookup(), when f2fs runs into __recover_dot_dentries(), it will cause NULL pointer