Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-47322 State: PUBLISHED Published: 2024-05-21T14:35:36.530Z Last Updated: 2025-05-04T07:08:39.193Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix an Oops in pnfs_mark_request_commit() when doing O_DIRECT Fix an Oopsable condition in pnfs_mark_request_commit() when we're putting a set of writes on the commit list to reschedule them after a failed pNFS attempt. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5c7ef8a3705542136a1e19b070e951f0730b2153 - https://git.kernel.org/stable/c/7c96a2ee45be41d5a167e6332d202086752c36bb - https:
f8a3705542136a1e19b070e951f0730b2153 - https://git.kernel.org/stable/c/7c96a2ee45be41d5a167e6332d202086752c36bb - https://git.kernel.org/stable/c/7aec9f862411906f8c27071ba65a1e110ad7d2fd - https://git.kernel.org/stable/c/3731d44bba8e0116b052b1b374476c5f6dd9a456
CVE ID: CVE-2021-47323 State: PUBLISHED Published: 2024-05-21T14:35:37.181Z Last Updated: 2025-05-04T07:08:40.265Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. Additional Analyst Notes: - CIS
nc(), which makes sure the timer handler has finished, and unable to re-schedule itself. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0015581a79bbf8e521f85dddb7d3e4a66b9f51d4 - https://git.kernel.org/stable/c/b4565a8a2d6bffb05bfbec11399d261ec16fe373 - https://git.kernel.org/stable/c/2aef07017fae21c3d8acea9656b10e3b9c0f1e04 - https://git.kernel.org/stable/c/522e75ed63f67e815d4ec0deace67df22d9ce78e - https://git.kernel.org/stable/c/7c56c5508dc20a6b133bc669fc34327a6711c24c - https://git.kernel.org/stable/c/a173e3b62cf6dd3c4a0a10c8a82eedfcae81a566 - https://git.kernel.org/stable/c/b3c41ea5bc34d8c7b19e230d80e0e555c6f5057
ble/c/a173e3b62cf6dd3c4a0a10c8a82eedfcae81a566 - https://git.kernel.org/stable/c/b3c41ea5bc34d8c7b19e230d80e0e555c6f5057d - https://git.kernel.org/stable/c/f0feab82f6a0323f54d85e8b512a2be64f83648a - https://git.kernel.org/stable/c/90b7c141132244e8e49a34a4c1e445cce33e07f4
CVE ID: CVE-2021-47324 State: PUBLISHED Published: 2024-05-21T14:35:37.844Z Last Updated: 2025-05-04T07:08:41.321Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix possible use-after-free in wdt_startup() This module's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. Additional Analyst Notes: - CISA ADP Vulnr
makes sure the timer handler has finished, and unable to re-schedule itself. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/63a3dc24bd053792f84cb4eef0168b1266202a02 - https://git.kernel.org/stable/c/862f2b5a7c38762ac9e369daefbf361a91aca685 - https://git.kernel.org/stable/c/0ac50a76cf3cd63db000648b3b19f3f98b8aaa76 - https://git.kernel.org/stable/c/dc9403097be52d57a5c9c35efa9be79d166a78af - https://git.kernel.org/stable/c/146cc288fb80c662c9c35e7bc58325d1ac0a7875 - https://git.kernel.org/stable/c/a397cb4576fc2fc802562418b3a50b8f67d60d31 - https://git.kernel.org/stable/c/b4ebf4a4692e84163a69444c70ad515de06e2259 - https:/
b4576fc2fc802562418b3a50b8f67d60d31 - https://git.kernel.org/stable/c/b4ebf4a4692e84163a69444c70ad515de06e2259 - https://git.kernel.org/stable/c/8adbbe6c86bb13e14f8a19e036ae5f4f5661fd90 - https://git.kernel.org/stable/c/c08a6b31e4917034f0ed0cb457c3bb209576f542
CVE ID: CVE-2021-47325 State: PUBLISHED Published: 2024-05-21T14:35:38.498Z Last Updated: 2025-05-04T07:08:42.508Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Fix arm_smmu_device refcount leak in address translation The reference counting issue happens in several exception handling paths of arm_smmu_iova_to_phys_hard(). When those error scenarios occur, the function forgets to decrease the refcount of "smmu" increased by arm_smmu_rpm_get(), causing a refcount leak. Fix this issue by jumping to "out" label when those error scenarios occur. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
to "out" label when those error scenarios occur. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/b11220803ad14a2a880cc06d8e01fe2548cc85b0 - https://git.kernel.org/stable/c/43d1aaa1965f9b58035196dac49b1e1e6c9c25eb - https://git.kernel.org/stable/c/0f0c5ea09139777d90729d408b807021f2ea6492 - https://git.kernel.org/stable/c/5f9741a9a91f25c89e04b408cd61e3ab050ce24b - https://git.kernel.org/stable/c/7c8f176d6a3fa18aa0f8875da6f7c672ed2a8554
CVE ID: CVE-2021-47326 State: REJECTED Published: 2024-05-21T14:35:39.153Z Last Updated: 2024-05-23T13:31:14.886Z Description: No description available.
CVE ID: CVE-2021-47327 State: PUBLISHED Published: 2024-05-21T14:35:39.816Z Last Updated: 2025-05-04T07:08:43.578Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Fix arm_smmu_device refcount leak when arm_smmu_rpm_get fails arm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the refcount of the "smmu" even though the return value is less than 0. The reference counting issue happens in some error handling paths of arm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get() fails, the caller functions forget to decrease the refcount of "smmu" increased by arm_smmu_rpm_get(), causing a refcoun
fails, the caller functions forget to decrease the refcount of "smmu" increased by arm_smmu_rpm_get(), causing a refcount leak. Fix this issue by calling pm_runtime_resume_and_get() instead of pm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount balanced in case of failure. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3761ae0d0e549f2acdaf11f49df4ed06d256b20f - https://git.kernel.org/stable/c/c4007596fbdabc29f858dc2e1990858a146b60b2 - https://git.kernel.org/stable/c/fbf4daa6f4105e01fbd3868006f65c163365c1e3 - https://git.kernel.org/stable/c/fe92c058199067ae90cf2a901ddf3c271893557a - https://git.ker
e01fbd3868006f65c163365c1e3 - https://git.kernel.org/stable/c/fe92c058199067ae90cf2a901ddf3c271893557a - https://git.kernel.org/stable/c/1adf30f198c26539a62d761e45af72cde570413d
CVE ID: CVE-2021-47328 State: PUBLISHED Published: 2024-05-21T14:35:40.479Z Last Updated: 2025-05-04T07:08:44.712Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix conn use after free during resets If we haven't done a unbind target call we can race where iscsi_conn_teardown wakes up the EH thread and then frees the conn while those threads are still accessing the conn ehwait. We can only do one TMF per session so this just moves the TMF fields from the conn to the session. We can then rely on the iscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call to remove the target and it's devices, and
he iscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call to remove the target and it's devices, and know after that point there is no device or scsi-ml callout trying to access the session. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/bf20d85a88384574fabb3d53ad62a8af57e7ab11 - https://git.kernel.org/stable/c/d04958a348e560938410e04a12fb99da9c7e6a00 - https://git.kernel.org/stable/c/89812e7957ab0746eab66ed6fc49d52bb4dca250 - https://git.kernel.org/stable/c/f0a031f7c55ffd944fead1ddaf2aa94df9a158c1 - https://git.kernel.org/stable/c/fa9542b35ceb4202e8f8d65f440529a63524dca9 - https://git.kernel.org/st
daf2aa94df9a158c1 - https://git.kernel.org/stable/c/fa9542b35ceb4202e8f8d65f440529a63524dca9 - https://git.kernel.org/stable/c/ec29d0ac29be366450a7faffbcf8cba3a6a3b506
CVE ID: CVE-2021-47329 State: PUBLISHED Published: 2024-05-21T14:35:41.138Z Last Updated: 2025-05-04T07:08:45.809Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Fix resource leak in case of probe failure The driver doesn't clean up all the allocated resources properly when scsi_add_host(), megasas_start_aen() function fails during the PCI device probe. Clean up all those resources. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/0c6226601c3e191a44a57d8f9f814b7e5c308959 - https://git.kernel.org/stable/c/0680db6f41920b2c91c7df3cc9cd5968
org/stable/c/0c6226601c3e191a44a57d8f9f814b7e5c308959 - https://git.kernel.org/stable/c/0680db6f41920b2c91c7df3cc9cd5968701a6f74 - https://git.kernel.org/stable/c/04b6b9ea80906e3b41ff120b45db31768947cf72 - https://git.kernel.org/stable/c/e623f79691c5104317669ab36ec316a90c05062f - https://git.kernel.org/stable/c/b5438f48fdd8e1c3f130d32637511efd32038152
CVE ID: CVE-2021-47330 State: PUBLISHED Published: 2024-05-21T14:35:41.789Z Last Updated: 2025-05-04T07:08:46.835Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tty: serial: 8250: serial_cs: Fix a memory leak in error handling path In the probe function, if the final 'serial_config()' fails, 'info' is leaking. Add a resource handling path to free this memory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/b5a2799cd62ed30c81b22c23028d9ee374e2138c - https://git.kernel.org/stable/c/331f5923fce4f45b8170ccf06c529e8eb28f37bc - https://git.kernel.org/stable/c/
e374e2138c - https://git.kernel.org/stable/c/331f5923fce4f45b8170ccf06c529e8eb28f37bc - https://git.kernel.org/stable/c/34f4590f5ec9859ea9136249f528173d150bd584 - https://git.kernel.org/stable/c/cddee5c287e26f6b2ba5c0ffdfc3a846f2f10461 - https://git.kernel.org/stable/c/ee16bed959862a6de2913f71a04cb563d7237b67 - https://git.kernel.org/stable/c/7a80f71601af015856a0aeb1e3c294037ac3dd32 - https://git.kernel.org/stable/c/c39cf4df19acf0133fa284a8cd83fad42cd13cc2 - https://git.kernel.org/stable/c/b2ef1f5de40342de44fc5355321595f91774dab5 - https://git.kernel.org/stable/c/fad92b11047a748c996ebd6cfb164a63814eeb2e
CVE ID: CVE-2021-47331 State: PUBLISHED Published: 2024-05-21T14:35:42.435Z Last Updated: 2025-05-04T07:08:47.882Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: common: usb-conn-gpio: fix NULL pointer dereference of charger When power on system with OTG cable, IDDIG's interrupt arises before the charger registration, it will cause a NULL pointer dereference, fix the issue by registering the power supply before requesting IDDIG/VBUS irq. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/8e8d910e9a3a7fba86140aff4924c30955ab228b - https://git.kernel.org/
tainer: References: - https://git.kernel.org/stable/c/8e8d910e9a3a7fba86140aff4924c30955ab228b - https://git.kernel.org/stable/c/436906fd248e018403bcda61a9311d9af02912f1 - https://git.kernel.org/stable/c/1a133a0996d6b4c83509d570ed4edcba34c44f25 - https://git.kernel.org/stable/c/880287910b1892ed2cb38977893b947382a09d21
CVE ID: CVE-2021-47332 State: PUBLISHED Published: 2024-05-21T14:35:43.078Z Last Updated: 2025-05-04T07:08:48.973Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: Don't call free_pages_exact() with NULL address Unlike some other functions, we can't pass NULL pointer to free_pages_exact(). Add a proper NULL check for avoiding possible Oops. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/88262229b778f4f7a896da828d966f94dcb35d19 - https://git.kernel.org/stable/c/7d7f30cf182e55023fa8fde4c084b2d37c6be69d - https://git.kernel.org/stable/c/bee295f5e
9 - https://git.kernel.org/stable/c/7d7f30cf182e55023fa8fde4c084b2d37c6be69d - https://git.kernel.org/stable/c/bee295f5e03510252d18b25cc1d26230256eb87a - https://git.kernel.org/stable/c/82e5ee742fdd8874fe996181b87fafe1eb5f1196 - https://git.kernel.org/stable/c/cae0cf651adccee2c3f376e78f30fbd788d0829f
CVE ID: CVE-2021-47333 State: PUBLISHED Published: 2024-05-21T14:35:43.760Z Last Updated: 2025-05-04T07:08:50.065Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge There is an issue with the ASPM(optional) capability checking function. A device might be attached to root complex directly, in this case, bus->self(bridge) will be NULL, thus priv->parent_pdev is NULL. Since alcor_pci_init_check_aspm(priv->parent_pdev) checks the PCI link's ASPM capability and populate parent_cap_off, which will be used later by alcor_pci_aspm_ctrl() to dynamically turn on/off device, wha
ty and populate parent_cap_off, which will be used later by alcor_pci_aspm_ctrl() to dynamically turn on/off device, what we can do here is to avoid checking the capability if we are on the root complex. This will make pdev_cap_off 0 and alcor_pci_aspm_ctrl() will simply return when bring called, effectively disable ASPM for the device. [ 1.246492] BUG: kernel NULL pointer dereference, address: 00000000000000c0 [ 1.248731] RIP: 0010:pci_read_config_byte+0x5/0x40 [ 1.253998] Call Trace: [ 1.254131] ? alcor_pci_find_cap_offset.isra.0+0x3a/0x100 [alcor_pci] [ 1.254476] alcor_pci_probe+0x169/0x2d5 [alcor_pci] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References:
ci_probe+0x169/0x2d5 [alcor_pci] Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d2639ffdcad463b358b6bef8645ff81715daffcb - https://git.kernel.org/stable/c/58f69684ba03e5b0e0a3ae844a845280c0f06309 - https://git.kernel.org/stable/c/717cf5ae52322ddbdf3ac2c584b34c5970b0d174 - https://git.kernel.org/stable/c/09d154990ca82d14aed2b72796f6c8845e2e605d - https://git.kernel.org/stable/c/3ce3e45cc333da707d4d6eb433574b990bcc26f5
CVE ID: CVE-2021-47334 State: PUBLISHED Published: 2024-05-21T14:35:44.404Z Last Updated: 2025-05-04T07:08:51.098Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: misc/libmasm/module: Fix two use after free in ibmasm_init_one In ibmasm_init_one, it calls ibmasm_init_remote_input_dev(). Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are allocated by input_allocate_device(), and assigned to sp->remote.mouse_dev and sp->remote.keybd_dev respectively. In the err_free_devices error branch of ibmasm_init_one, mouse_dev and keybd_dev are freed by input_free_device(), and return error. Then the execution runs into error_se
t_one, mouse_dev and keybd_dev are freed by input_free_device(), and return error. Then the execution runs into error_send_message error branch of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev. My patch add a "error_init_remote" label to handle the error of ibmasm_init_remote_input_dev(), to avoid the uaf bugs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1512e7dc5eb08b7d92a12e2bfcd9cb8c4a1ec069 - https://git.kernel.org/stable/c/29ba8e2ba89ee2862a26d91204dd5fe77ceee25a - https://git.kernel.org/stable/c/5b06ca113bf197aab2ab61288
kernel.org/stable/c/29ba8e2ba89ee2862a26d91204dd5fe77ceee25a - https://git.kernel.org/stable/c/5b06ca113bf197aab2ab61288f42506e0049fbab - https://git.kernel.org/stable/c/481a76d4749ee3a27f902ba213fdcbb4bb39720e - https://git.kernel.org/stable/c/38660031e80eaa6cc9370b031c180612f414b00d - https://git.kernel.org/stable/c/b9c87ce3bc6331f82811a8cf8e930423c22523a3 - https://git.kernel.org/stable/c/ef1067d2baa847d53c9988510d99fb494de4d12c - https://git.kernel.org/stable/c/a7268e8a227d5a4f0bd1584f556246b0224ab274 - https://git.kernel.org/stable/c/7272b591c4cb9327c43443f67b8fbae7657dd9ae
CVE ID: CVE-2021-47335 State: PUBLISHED Published: 2024-05-21T14:35:45.093Z Last Updated: 2025-07-11T17:19:01.075Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances As syzbot reported, there is an use-after-free issue during f2fs recovery: Use-after-free write at 0xffff88823bc16040 (in kfence-#10): kmem_cache_destroy+0x1f/0x120 mm/slab_common.c:486 f2fs_recover_fsync_data+0x75b0/0x8380 fs/f2fs/recovery.c:869 f2fs_fill_super+0x9393/0xa420 fs/f2fs/super.c:3945 mount_bdev+0x26c/0x3a0 fs/super.c:1367 legacy_get_tree+0xea/0x180 fs/fs_context.c:592 vfs_get_tree+
fs/f2fs/super.c:3945 mount_bdev+0x26c/0x3a0 fs/super.c:1367 legacy_get_tree+0xea/0x180 fs/fs_context.c:592 vfs_get_tree+0x86/0x270 fs/super.c:1497 do_new_mount fs/namespace.c:2905 [inline] path_mount+0x196f/0x2be0 fs/namespace.c:3235 do_mount fs/namespace.c:3248 [inline] __do_sys_mount fs/namespace.c:3456 [inline] __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3433 do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is multi f2fs filesystem instances can race on accessing global fsync_entry_slab pointer, result in use-after-free issue of slab cache, fixes to init/destroy this slab cache only once during module init/destroy procedure to avoid
free issue of slab cache, fixes to init/destroy this slab cache only once during module init/destroy procedure to avoid this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/86786603014e0a22d0d6af8e80ae4b8687927048 - https://git.kernel.org/stable/c/79fa5d944c875711253a23b8155b36883c696409 - https://git.kernel.org/stable/c/e472b276a0d2180808009be38105e12754432e2a - https://git.kernel.org/stable/c/cad83c968c2ebe97905f900326988ed37146c347
CVE ID: CVE-2021-47336 State: PUBLISHED Published: 2024-05-21T14:35:45.744Z Last Updated: 2025-05-04T07:08:53.229Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smackfs: restrict bytes count in smk_set_cipso() Oops, I failed to update subject line. From 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001 Date: Mon, 12 Apr 2021 22:25:06 +0900 Subject: [PATCH] smackfs: restrict bytes count in smk_set_cipso() Commit 7ef4c19d245f3dc2 ("smackfs: restrict bytes count in smackfs write functions") missed that count > SMK_CIPSOMAX check applies to only format == SMK_FIXED24_FMT case. Additional Analyst Notes: - CISA ADP V
d that count > SMK_CIPSOMAX check applies to only format == SMK_FIXED24_FMT case. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/5f9880403e6b71d56924748ba331daf836243fca - https://git.kernel.org/stable/c/5c2dca9a7a7ff6a2df34158903515e2e4fd3d2b2 - https://git.kernel.org/stable/c/cbd87ba6a13891acf6180783f8234a8b7a3e3d4d - https://git.kernel.org/stable/c/135122f174c357b7a3e58f40fa5792156c5e93e6 - https://git.kernel.org/stable/c/3780348c1a0e14ffefcaf1fc521f815bcaac94b0 - https://git.kernel.org/stable/c/8f5c773a2871cf446e3f36b2834fb25bbb28512b - https://git.kernel.org/stable/c/258fd821f69378453c071b9dd767b298810fc766 - htt
f5c773a2871cf446e3f36b2834fb25bbb28512b - https://git.kernel.org/stable/c/258fd821f69378453c071b9dd767b298810fc766 - https://git.kernel.org/stable/c/49ec114a6e62d8d320037ce71c1aaf9650b3cafd
CVE ID: CVE-2021-47337 State: PUBLISHED Published: 2024-05-21T14:35:46.379Z Last Updated: 2025-05-04T07:08:54.422Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix bad pointer dereference when ehandler kthread is invalid Commit 66a834d09293 ("scsi: core: Fix error handling of scsi_host_alloc()") changed the allocation logic to call put_device() to perform host cleanup with the assumption that IDA removal and stopping the kthread would properly be performed in scsi_host_dev_release(). However, in the unlikely case that the error handler thread fails to spawn, shost->ehandler is set to ERR_PTR(-ENOMEM). The error ha
the unlikely case that the error handler thread fails to spawn, shost->ehandler is set to ERR_PTR(-ENOMEM). The error handler cleanup code in scsi_host_dev_release() will call kthread_stop() if shost->ehandler != NULL which will always be the case whether the kthread was successfully spawned or not. In the case that it failed to spawn this has the nasty side effect of trying to dereference an invalid pointer when kthread_stop() is called. The following splat provides an example of this behavior in the wild: scsi host11: error handler thread failed to spawn, error = -4 Kernel attempted to read user page (10c) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x000001
l attempted to read user page (10c) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x0000010c Faulting instruction address: 0xc00000000818e9a8 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: ibmvscsi(+) scsi_transport_srp dm_multipath dm_mirror dm_region hash dm_log dm_mod fuse overlay squashfs loop CPU: 12 PID: 274 Comm: systemd-udevd Not tainted 5.13.0-rc7 #1 NIP: c00000000818e9a8 LR: c0000000089846e8 CTR: 0000000000007ee8 REGS: c000000037d12ea0 TRAP: 0300 Not tainted (5.13.0-rc7) MSR: 800000000280b033 &lt;SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE&gt; CR: 28228228 XER: 20040001 CFAR: c0000000089846e
13.0-rc7) MSR: 800000000280b033 &lt;SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE&gt; CR: 28228228 XER: 20040001 CFAR: c0000000089846e4 DAR: 000000000000010c DSISR: 40000000 IRQMASK: 0 GPR00: c0000000089846e8 c000000037d13140 c000000009cc1100 fffffffffffffffc GPR04: 0000000000000001 0000000000000000 0000000000000000 c000000037dc0000 GPR08: 0000000000000000 c000000037dc0000 0000000000000001 00000000fffff7ff GPR12: 0000000000008000 c00000000a049000 c000000037d13d00 000000011134d5a0 GPR16: 0000000000001740 c0080000190d0000 c0080000190d1740 c000000009129288 GPR20: c000000037d13bc0 0000000000000001 c000000037d13bc0 c0080000190b7898 GPR24: c0080000190b7708 0000000000000000 c000000033bb2c48 0000000000000000 GPR2
000001 c000000037d13bc0 c0080000190b7898 GPR24: c0080000190b7708 0000000000000000 c000000033bb2c48 0000000000000000 GPR28: c000000046b28280 0000000000000000 000000000000010c fffffffffffffffc NIP [c00000000818e9a8] kthread_stop+0x38/0x230 LR [c0000000089846e8] scsi_host_dev_release+0x98/0x160 Call Trace: [c000000033bb2c48] 0xc000000033bb2c48 (unreliable) [c0000000089846e8] scsi_host_dev_release+0x98/0x160 [c00000000891e960] device_release+0x60/0x100 [c0000000087e55c4] kobject_release+0x84/0x210 [c00000000891ec78] put_device+0x28/0x40 [c000000008984ea4] scsi_host_alloc+0x314/0x430 [c0080000190b38bc] ibmvscsi_probe+0x54/0xad0 [ibmvscsi] [c000000008110104] vio_bus_probe+0xa4/0x4b0 [c00000000892a