Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-35844 State: PUBLISHED Published: 2024-05-17T14:40:11.419Z Last Updated: 2025-05-04T09:06:41.254Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix reserve_cblocks counting error when out of space When a file only needs one direct_node, performing the following operations will cause the file to be unrepairable: unisoc # ./f2fs_io compress test.apk unisoc #df -h | grep dm-48 /dev/block/dm-48 112G 112G 1.2M 100% /data unisoc # ./f2fs_io release_cblocks test.apk 924 unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 4.8M 100% /data unisoc # dd if=/dev/random of=file4 bs=1M count=3 3145728 byte
h | grep dm-48 /dev/block/dm-48 112G 112G 4.8M 100% /data unisoc # dd if=/dev/random of=file4 bs=1M count=3 3145728 bytes (3.0 M) copied, 0.025 s, 120 M/s unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 1.8M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device adb reboot unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 11M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk 0 This is because the file has only one direct_node. After returning to -ENOSPC, reserved_blocks += ret will not be executed. As a result, the reserved_blocks at this time is still 0, which is not the real number of reserved blocks. Therefo
uted. As a result, the reserved_blocks at this time is still 0, which is not the real number of reserved blocks. Therefore, fsck cannot be set to repair the file. After this patch, the fsck flag will be set to fix this problem. unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 1.8M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device adb reboot then fsck will be executed unisoc # df -h | grep dm-48 /dev/block/dm-48 112G 112G 11M 100% /data unisoc # ./f2fs_io reserve_cblocks test.apk 924 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fa3ac8b1a227d9
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fa3ac8b1a227d9b470b87972494293348b5839ee - https://git.kernel.org/stable/c/889846dfc8ee2cf31148a44bfd2faeb2faadc685 - https://git.kernel.org/stable/c/f0bf89e84c3afb79d7a3a9e4bc853ad6a3245c0a - https://git.kernel.org/stable/c/569c198c9e2093fd29cc071856a4e548fda506bc - https://git.kernel.org/stable/c/fc0aed88afbf6f606205129a7466eebdf528e3f3 - https://git.kernel.org/stable/c/2f6d721e14b69d6e1251f69fa238b48e8374e25f
CVE ID: CVE-2024-35845 State: PUBLISHED Published: 2024-05-17T14:40:12.134Z Last Updated: 2025-05-04T09:06:42.675Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/fabe2db7de32a881e437ee69db32e0de785a6209 - https://git.kernel.org/stable/c/96aa40761673da045a7774f874487cdb50c6a2f7 - https://git.kernel.org/stable/c/c855a1a5b7e3de57e6b1b29563113d5e3
rg/stable/c/96aa40761673da045a7774f874487cdb50c6a2f7 - https://git.kernel.org/stable/c/c855a1a5b7e3de57e6b1b29563113d5e3bfdb89a - https://git.kernel.org/stable/c/783d413f332a3ebec916664b366c28f58147f82c - https://git.kernel.org/stable/c/fec14d1cdd92f340b9ba2bd220abf96f9609f2a9 - https://git.kernel.org/stable/c/71d4186d470e9cda7cd1a0921b4afda737c6f641 - https://git.kernel.org/stable/c/ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea
CVE ID: CVE-2024-35846 State: PUBLISHED Published: 2024-05-17T14:47:25.503Z Last Updated: 2025-05-04T09:06:43.875Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix shrinker NULL crash with cgroup_disable=memory Christian reports a NULL deref in zswap that he bisected down to the zswap shrinker. The issue also cropped up in the bug trackers of libguestfs [1] and the Red Hat bugzilla [2]. The problem is that when memcg is disabled with the boot time flag, the zswap shrinker might get called with sc->memcg == NULL. This is okay in many places, like the lruvec operations. But it crashes in memcg_page_state() - which is
>memcg == NULL. This is okay in many places, like the lruvec operations. But it crashes in memcg_page_state() - which is only used due to the non-node accounting of cgroup's the zswap memory to begin with. Nhat spotted that the memcg can be NULL in the memcg-disabled case, and I was then able to reproduce the crash locally as well. [1] https://github.com/libguestfs/libguestfs/issues/139 [2] https://bugzilla.redhat.com/show_bug.cgi?id=2275252 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b0fdabc908a7f81d12382c87ca9e46a9c2e14042 - https://git.kernel.org/stable/c/682886ec69d22363819a83ddddd5d66cb5c791e1
CVE ID: CVE-2024-35847 State: PUBLISHED Published: 2024-05-17T14:47:26.175Z Last Updated: 2025-05-04T09:06:44.998Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free()
equently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/f5417ff561b8ac9a7e53c747b8627a7ab58378ae - https://git.kernel.org/stable/c/b72d2b1448b682844f995e660b77f2a1fabc1662 - https://git.kernel.org/stable/c/aa44d21574751a7d6bca892eb8e0e9ac68372e52 - https://git.kernel.org/stable/c/5dbdbe1133911ca7d8466bb86885adec32ad9438 - https://git.kernel.org/stable/c/dd681710ab77c8b
tps://git.kernel.org/stable/c/5dbdbe1133911ca7d8466bb86885adec32ad9438 - https://git.kernel.org/stable/c/dd681710ab77c8beafe2e263064cb1bd0e2d6ca9 - https://git.kernel.org/stable/c/03170e657f62c26834172742492a8cb8077ef792 - https://git.kernel.org/stable/c/5b012f77abde89bf0be8a0547636184fea618137 - https://git.kernel.org/stable/c/c26591afd33adce296c022e3480dea4282b7ef91
CVE ID: CVE-2024-35848 State: PUBLISHED Published: 2024-05-17T14:47:26.828Z Last Updated: 2025-05-04T09:06:46.323Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: eeprom: at24: fix memory corruption race condition If the eeprom is not accessible, an nvmem device will be registered, the read will fail, and the device will be torn down. If another driver accesses the nvmem device after the teardown, it will reference invalid memory. Move the failure point before registering the nvmem device. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c850f71fca09ea41800
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c850f71fca09ea41800ed55905980063d17e01da - https://git.kernel.org/stable/c/26d32bec4c6d255a03762f33c637bfa3718be15a - https://git.kernel.org/stable/c/c43e5028f5a35331eb25017f5ff6cc21735005c6 - https://git.kernel.org/stable/c/2af84c46b9b8f2d6c0f88d09ee5c849ae1734676 - https://git.kernel.org/stable/c/6d8b56ec0c8f30d5657382f47344a32569f7a9bc - https://git.kernel.org/stable/c/f42c97027fb75776e2e9358d16bf4a99aeb04cf2
CVE ID: CVE-2024-35849 State: PUBLISHED Published: 2024-05-17T14:47:27.486Z Last Updated: 2025-05-04T09:06:47.671Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _copy_to_user+0xbc/0x110 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline]
instrumented.h:114 [inline] _copy_to_user+0xbc/0x110 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline] btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: __kmalloc_large_node+0x231/0x370 mm/slub.c:3921 __do_kmalloc_node mm/slub.c:3954 [inline] __kmal
Uninit was created at: __kmalloc_large_node+0x231/0x370 mm/slub.c:3921 __do_kmalloc_node mm/slub.c:3954 [inline] __kmalloc_node+0xb07/0x1060 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] kvmalloc_node+0xc0/0x2d0 mm/util.c:634 kvmalloc include/linux/slab.h:766 [inline] init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779 btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [
0 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 40-65535 of 65536 are uninitialized Memory access of size 65536 starts at ffff888045a40000 This happens, because we're copying a 'struct btrfs_data_container' back to user-space. This btrfs_data_container is allocated in 'init_data_container()' via kvmalloc(), which does not zero-fill the memory. Fix this by using kvzalloc() which zeroes out the memory on allocation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.k
y on allocation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/689efe22e9b5b7d9d523119a9a5c3c17107a0772 - https://git.kernel.org/stable/c/73db209dcd4ae026021234d40cfcb2fb5b564b86 - https://git.kernel.org/stable/c/30189e54ba80e3209d34cfeea87b848f6ae025e6 - https://git.kernel.org/stable/c/e58047553a4e859dafc8d1d901e1de77c9dd922d - https://git.kernel.org/stable/c/8bdbcfaf3eac42f98e5486b3d7e130fa287811f6 - https://git.kernel.org/stable/c/3a63cee1a5e14a3e52c19142c61dd5fcb524f6dc - https://git.kernel.org/stable/c/fddc19631c51d9c17d43e9f822a7bc403af88d54 - https://git.kernel.org/stable/c/2f7ef5bb4a2f3e481ef05fab946edb97c84f
stable/c/fddc19631c51d9c17d43e9f822a7bc403af88d54 - https://git.kernel.org/stable/c/2f7ef5bb4a2f3e481ef05fab946edb97c84f67cf
CVE ID: CVE-2024-35850 State: PUBLISHED Published: 2024-05-17T14:47:28.139Z Last Updated: 2025-05-04T09:06:48.863Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev setup Qualcomm ROME controllers can be registered from the Bluetooth line discipline and in this case the HCI UART serdev pointer is NULL. Add the missing sanity check to prevent a NULL-pointer dereference when setup() is called for a non-serdev controller. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/67459f1a707aae6d590454de07956c2752e21ea4 - https
- CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/67459f1a707aae6d590454de07956c2752e21ea4 - https://git.kernel.org/stable/c/bec4d4c6fa5c6526409f582e4f31144e20c86c21 - https://git.kernel.org/stable/c/7ddb9de6af0f1c71147785b12fd7c8ec3f06cc86
CVE ID: CVE-2024-35851 State: PUBLISHED Published: 2024-05-17T14:47:28.787Z Last Updated: 2025-05-04T09:06:50.045Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev suspend Qualcomm ROME controllers can be registered from the Bluetooth line discipline and in this case the HCI UART serdev pointer is NULL. Add the missing sanity check to prevent a NULL-pointer dereference when wakeup() is called for a non-serdev controller during suspend. Just return true for now to restore the original behaviour and address the crash with pre-6.2 kernels, which do not have commit e9b3e5b8c657 ("Bluetooth
ore the original behaviour and address the crash with pre-6.2 kernels, which do not have commit e9b3e5b8c657 ("Bluetooth: hci_qca: only assign wakeup with serial port support") that causes the crash to happen already at setup() time. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/52f9041deaca3fc5c40ef3b9cb943993ec7d2489 - https://git.kernel.org/stable/c/e60502b907be350c518819297b565007a94c706d - https://git.kernel.org/stable/c/6b47cdeb786c38e4174319218db3fa6d7b4bba88 - https://git.kernel.org/stable/c/b64092d2f108f0cd1d7fd7e176f5fb2a67a2f189 - https://git.kernel.org/stable/c/73e87c0a49fda31d7b589edccf4c72e924411371
CVE ID: CVE-2024-35852 State: PUBLISHED Published: 2024-05-17T14:47:29.441Z Last Updated: 2025-05-04T09:06:51.339Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as supposedly it means that the migration ended. Otherwise, it is rescheduled immediately. After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash" the above is no longer accurate as a non-negative number of credits is no longer indicative of the migration being done. It c
bove is no longer accurate as a non-negative number of credits is no longer indicative of the migration being done. It can also happen if the work encountered an error in which case the migration will resume the next time the work is scheduled. The significance of the above is that it is possible for the work to be pending and associated with hints that were allocated when the migration started. This leads to the hints being leaked [1] when the work is canceled while pending as part of ACL region dismantle. Fix by freeing the hints if hints are associated with a work that was canceled while pending. Blame the original commit since the reliance on not having a pending work associated with hin
as canceled while pending. Blame the original commit since the reliance on not having a pending work associated with hints is fragile. [1] unreferenced object 0xffff88810e7c3000 (size 256): comm "kworker/0:16", pid 176, jiffies 4295460353 hex dump (first 32 bytes): 00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a....... 00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@........... backtrace (crc 2544ddb9): [<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0 [<000000004d9a1ad9>] objagg_hints_get+0x42/0x390 [<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400 [<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160 [<00000000e81fd734>] process_one_work+0x59c/
400 [<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160 [<00000000e81fd734>] process_one_work+0x59c/0xf20 [<00000000ceee9e81>] worker_thread+0x799/0x12c0 [<00000000bda6fe39>] kthread+0x246/0x300 [<0000000070056d23>] ret_from_fork+0x34/0x70 [<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/51cefc9da400b953fee749c9e5d26cd4a2b5d758 - https://git.kernel.org/stable/c/857ed800133ffcfcee28582090b63b0cbb8ba59d - https://git.kernel.org/stable/c/63d814d93c5cce4c18284adc810028f28dca493f - https://git.kernel.org/stable/c/5bfe7bf9656ed2633718388f12b7c38b86414a04 - h
/63d814d93c5cce4c18284adc810028f28dca493f - https://git.kernel.org/stable/c/5bfe7bf9656ed2633718388f12b7c38b86414a04 - https://git.kernel.org/stable/c/de1aaefa75be9d0ec19c9a3e0e2f9696de20c6ab - https://git.kernel.org/stable/c/d72dd6fcd7886d0523afbab8b4a4b22d17addd7d - https://git.kernel.org/stable/c/fb4e2b70a7194b209fc7320bbf33b375f7114bd5
CVE ID: CVE-2024-35853 State: PUBLISHED Published: 2024-05-17T14:47:30.109Z Last Updated: 2025-05-04T09:06:52.551Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash The rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters. If the migration fails, the code tries to migrate the filters back to the old region. However, the rollback itself can also fail in which case another migration will be erroneously performed. Besides t
ion. However, the rollback itself can also fail in which case another migration will be erroneously performed. Besides the fact that this ping pong is not a very good idea, it also creates a problem. Each virtual chunk references two chunks: The currently used one ('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the first holds the chunk we want to migrate filters to and the second holds the chunk we are migrating filters from. The code currently assumes - but does not verify - that the backup chunk does not exist (NULL) if the currently used chunk does not reference the target region. This assumption breaks when we are trying to rollback a rollback, resulting in the backu
ot reference the target region. This assumption breaks when we are trying to rollback a rollback, resulting in the backup chunk being overwritten and leaked [1]. Fix by not rolling back a failed rollback and add a warning to avoid future cases. [1] WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20 Modules linked in: CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:parman_destroy+0x17/0x20 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_region_fini+0x19/0x60 mlxsw_sp_acl_tcam_region_dest
parman_destroy+0x17/0x20 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_region_fini+0x19/0x60 mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK> Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c6f3fa7f5a748bf6e5c4eb742686d6952f854e76 - https://git.kernel.org/stable/c/617e98ba4c50f4547c9eb0946b1cfc26937d70d1 - https://git.kernel.org/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e - https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc88
/stable/c/413a01886c3958d4b8aac23a3bff3d430b92093e - https://git.kernel.org/stable/c/b822644fd90992ee362c5e0c8d2556efc8856c76 - https://git.kernel.org/stable/c/0ae8ff7b6d42e33943af462910bdcfa2ec0cb8cf - https://git.kernel.org/stable/c/b3fd51f684a0711504f82de510da109ae639722d - https://git.kernel.org/stable/c/8ca3f7a7b61393804c46f170743c3b839df13977
CVE ID: CVE-2024-35854 State: PUBLISHED Published: 2024-05-17T14:47:30.775Z Last Updated: 2025-05-04T09:06:54.144Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash The rehash delayed work migrates filters from one region to another according to the number of available credits. The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption is that this is indicative of migration being complete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration. The
ete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration. The destruction of a region that still has filters referencing it can result in a use-after-free [1]. Fix by not destroying the region if migration failed. [1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858 CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x1
S 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0
3/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a
ocess_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/e118e7ea24d1392878ef85926627c6bc640c4388 - https://git.kernel.org/stable/c/a429a912d6c779807f4d72a6cc0a1efaaa3613e1 - https://git.kernel.org/stable/c/4c89642ca47fb620914780c7c51d8d1248201121 - https://git.kernel.org/stable/c/813e2ab753a8f8c243a39ede20c2e0adc15f3887 - https://git.kernel.org/stable/c/311eeaa7b9e26aba5b3d57b09859f07d8e9fc049 - https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1 - https://git.kernel.org/stable/c/54
8e9fc049 - https://git.kernel.org/stable/c/a02687044e124f8ccb427cd3632124a4e1a7d7c1 - https://git.kernel.org/stable/c/54225988889931467a9b55fdbef534079b665519