Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
c067865c>] (state_show) from [<c05222e8>] (dev_attr_show) [<c05222c0>] (dev_attr_show) from [<c02c66e0>] (sysfs_kf_seq_show) [<c02c6648>] (sysfs_kf_seq_show) from [<c02c496c>] (kernfs_seq_show) [<c02c4938>] (kernfs_seq_show) from [<c025e2a0>] (seq_read) [<c025e11c>] (seq_read) from [<c02c50a0>] (kernfs_fop_read) [<c02c5064>] (kernfs_fop_read) from [<c0231cac>] (__vfs_read) [<c0231c5c>] (__vfs_read) from [<c0231ee0>] (vfs_read) [<c0231e34>] (vfs_read) from [<c0232464>] (ksys_read) [<c02323f0>] (ksys_read) from [<c02324fc>] (sys_read) [<c02324e4>] (sys_read) from [<c00091d0>] (__sys_trace_return) References: - https://git.kernel.org/stable/c/6e721f3ad0535b24f19a62420f4da95212cf069c - https://g
(__sys_trace_return) References: - https://git.kernel.org/stable/c/6e721f3ad0535b24f19a62420f4da95212cf069c - https://git.kernel.org/stable/c/cb81ea998c461868d1168411a867d8ffee12f23f - https://git.kernel.org/stable/c/d472c78cc82999d07bd09193a6718016ce9cd386 - https://git.kernel.org/stable/c/abf3b222614f49f98e606fccdd269161c0d70204 - https://git.kernel.org/stable/c/368e68ad6da4317fc4170e8d92b51c13d1bfe7a7 - https://git.kernel.org/stable/c/35ff1ac55d301efb3f467cf5426faaeb3452994b - https://git.kernel.org/stable/c/033ec4e7e59ae5e1ef1e8c10bc6552926044ed1c - https://git.kernel.org/stable/c/5dcc2afe716d69f5112ce035cb14f007461ff189
CVE ID: CVE-2022-49309 State: PUBLISHED Published: 2025-02-26T02:10:40.167Z Last Updated: 2025-11-03T19:27:51.491Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback() There is a deadlock in rtw_surveydone_event_callback(), which is shown below: (Thread 1) | (Thread 2) | _set_timer() rtw_surveydone_event_callback()| mod_timer() spin_lock_bh() //(1) | (wait a time) ... | rtw_scan_timeout_handler() del_timer_sync() | spin_lock_bh() //(2) (wait timer to stop) | ... We hold pmlmepriv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to sto
t timer to stop) | ... We hold pmlmepriv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need pmlmepriv->lock in position (2) of thread 2. As a result, rtw_surveydone_event_callback() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_bh(), which could let timer handler to obtain the needed lock. What`s more, we change spin_lock_bh() in rtw_scan_timeout_handler() to spin_lock_irq(). Otherwise, spin_lock_bh() will also cause deadlock() in timer handler. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/c84e5c819600ee0628f61b33d145258ae0f3d7a7 - https:/
CVE Program Container: References: - https://git.kernel.org/stable/c/c84e5c819600ee0628f61b33d145258ae0f3d7a7 - https://git.kernel.org/stable/c/f89f6c3ebf69623b8ea48200bd690e9e210335a1 - https://git.kernel.org/stable/c/ce129d3efd181da5fd56f4360cc8827122afa67e - https://git.kernel.org/stable/c/2c41f5c341853f84b7bc2f32605d4e2782e8c279 - https://git.kernel.org/stable/c/cc7ad0d77b51c872d629bcd98aea463a3c4109e7
CVE ID: CVE-2022-49310 State: PUBLISHED Published: 2025-02-26T02:10:40.664Z Last Updated: 2025-10-01T19:46:58.235Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: char: xillybus: fix a refcount leak in cleanup_dev() usb_get_dev is called in xillyusb_probe. So it is better to call usb_put_dev before xdev is released. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/bc8fceda3b89006e8a7dda8a097d36045d044c25 - https://git.kernel.org/stable/c/21f1f167d727f3f857e26d509ef5a6d47fd31bc3 - https://git.kernel.org/stable/c/e277b95acdab84cd5d2f8d537a37aef6d21e988b - https://git.kernel.org/stabl
f5a6d47fd31bc3 - https://git.kernel.org/stable/c/e277b95acdab84cd5d2f8d537a37aef6d21e988b - https://git.kernel.org/stable/c/b67d19662fdee275c479d21853bc1239600a798f
CVE ID: CVE-2022-49311 State: PUBLISHED Published: 2025-02-26T02:10:41.139Z Last Updated: 2025-10-01T19:46:58.057Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle() There is a deadlock in rtw_joinbss_event_prehandle(), which is shown below: (Thread 1) | (Thread 2) | _set_timer() rtw_joinbss_event_prehandle()| mod_timer() spin_lock_bh() //(1) | (wait a time) ... | _rtw_join_timeout_handler() del_timer_sync() | spin_lock_bh() //(2) (wait timer to stop) | ... We hold pmlmepriv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, bu
er to stop) | ... We hold pmlmepriv->lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need pmlmepriv->lock in position (2) of thread 2. As a result, rtw_joinbss_event_prehandle() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_bh(), which could let timer handler to obtain the needed lock. What`s more, we change spin_lock_bh() to spin_lock_irq() in _rtw_join_timeout_handler() in order to prevent deadlock. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ae60744d5fad840b9d056d35b4b652d95e755846 - https://git.kernel.org/stable/c/1f6c99b94ca3caad346876b
t.kernel.org/stable/c/ae60744d5fad840b9d056d35b4b652d95e755846 - https://git.kernel.org/stable/c/1f6c99b94ca3caad346876b3e22e3ca3d25bc8ee - https://git.kernel.org/stable/c/eca9748d9267a38d532464e3305a38629e9c35a9 - https://git.kernel.org/stable/c/041879b12ddb0c6c83ed9c0bdd10dc82a056f2fc
CVE ID: CVE-2022-49312 State: PUBLISHED Published: 2025-02-26T02:10:41.627Z Last Updated: 2025-10-01T19:46:57.896Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: staging: rtl8712: fix a potential memory leak in r871xu_drv_init() In r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not properly released as there is no action will be performed by r8712_usb_dvobj_deinit(). To properly release it, we should call r8712_free_io_queue() in r8712_usb_dvobj_deinit(). Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called by r871x_dev_unload
n r8712_usb_dvobj_deinit(). Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called by r871x_dev_unload() under condition `padapter->bup` and r8712_free_io_queue() is called by r8712_free_drv_sw(). However, r8712_usb_dvobj_deinit() does not rely on `padapter->bup` and calling r8712_free_io_queue() in r8712_free_drv_sw() is negative for better understading the code. So I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove r8712_free_io_queue() from r8712_free_drv_sw(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/5a89a92efc342dd7c44b6056da87debc598f9c73 - https://git.kernel.org/stable/c/8eb42d6d10f8fe509117859
t.kernel.org/stable/c/5a89a92efc342dd7c44b6056da87debc598f9c73 - https://git.kernel.org/stable/c/8eb42d6d10f8fe509117859defddf9e72b4fa4d0 - https://git.kernel.org/stable/c/205e039fead72e87ad2838f5e649a4c4834f648b - https://git.kernel.org/stable/c/a2882b8baad068d21c99fb2ab5a85a2bdbd5b834 - https://git.kernel.org/stable/c/7288ff561de650d4139fab80e9cb0da9b5b32434
CVE ID: CVE-2022-49313 State: PUBLISHED Published: 2025-02-26T02:10:42.109Z Last Updated: 2025-10-01T19:46:57.754Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers: usb: host: Fix deadlock in oxu_bus_suspend() There is a deadlock in oxu_bus_suspend(), which is shown below: (Thread 1) | (Thread 2) | timer_action() oxu_bus_suspend() | mod_timer() spin_lock_irq() //(1) | (wait a time) ... | oxu_watchdog() del_timer_sync() | spin_lock_irq() //(2) (wait timer to stop) | ... We hold oxu->lock in position (1) of thread 1, and use del_timer_sync() to wait timer to stop, but timer handler also need oxu->lock in position (2) of thr
f thread 1, and use del_timer_sync() to wait timer to stop, but timer handler also need oxu->lock in position (2) of thread 2. As a result, oxu_bus_suspend() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irq(), which could let timer handler to obtain the needed lock. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/9b58d255f27b0ed6a2e43208960864d67579db58 - https://git.kernel.org/stable/c/a3d380188bde8900c3f604e82b56572896499124 - https://git.kernel.org/stable/c/f8242044c91cafbba9e320b0fb31abf2429a3221 - https://git.kernel.org/stable/c/2dcec0bc142be2096af71a5703d63237127db204 - https://git.kernel.org/
0b0fb31abf2429a3221 - https://git.kernel.org/stable/c/2dcec0bc142be2096af71a5703d63237127db204 - https://git.kernel.org/stable/c/ffe9440d698274c6462d2e304562c6ddfc8c84df - https://git.kernel.org/stable/c/d888753872190abd18f68a7d77b9c7c367f0a7ab - https://git.kernel.org/stable/c/4187b291a76664a3c03d3f0d9bfadc8322881868 - https://git.kernel.org/stable/c/b97aae8b43b718314012e8170b7e03dbfd2e7677 - https://git.kernel.org/stable/c/4d378f2ae58138d4c55684e1d274e7dd94aa6524
CVE ID: CVE-2022-49314 State: PUBLISHED Published: 2025-02-26T02:10:42.594Z Last Updated: 2025-10-01T19:46:57.604Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tty: Fix a possible resource leak in icom_probe When pci_read_config_dword failed, call pci_release_regions() and pci_disable_device() to recycle the resource previously allocated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f4c836d90da1ece88905d62ce2ce39a962f25d1a - https://git.kernel.org/stable/c/d703d912a985c1c5b50dd38c3181fc3540fa77cb - https://git.kernel.org/stable/c/a2df0b4d080cc770b4da7bff487048c803dfd07e - ht
d703d912a985c1c5b50dd38c3181fc3540fa77cb - https://git.kernel.org/stable/c/a2df0b4d080cc770b4da7bff487048c803dfd07e - https://git.kernel.org/stable/c/8c014373f178a4f13a08e045ef63bdb23f62e892 - https://git.kernel.org/stable/c/cb7147afd328c07edeeee287710d8d96ac0459f5 - https://git.kernel.org/stable/c/5f9b2e4ca88cab1a96b86ecd45544e488ca43faf - https://git.kernel.org/stable/c/23e155b51d403c0ccedc60c0d6c3c452afed07fe - https://git.kernel.org/stable/c/9a8305f357a8d03698fc7bc855ff9c6865d5486b - https://git.kernel.org/stable/c/ee157a79e7c82b01ae4c25de0ac75899801f322c
CVE ID: CVE-2022-49315 State: PUBLISHED Published: 2025-02-26T02:10:43.082Z Last Updated: 2025-10-01T19:46:57.435Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() There is a deadlock in rtllib_beacons_stop(), which is shown below: (Thread 1) | (Thread 2) | rtllib_send_beacon() rtllib_beacons_stop() | mod_timer() spin_lock_irqsave() //(1) | (wait a time) ... | rtllib_send_beacon_cb() del_timer_sync() | spin_lock_irqsave() //(2) (wait timer to stop) | ... We hold ieee->beacon_lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer
) | ... We hold ieee->beacon_lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need ieee->beacon_lock in position (2) of thread 2. As a result, rtllib_beacons_stop() will block forever. This patch extracts del_timer_sync() from the protection of spin_lock_irqsave(), which could let timer handler to obtain the needed lock. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/4681129fda9e8555392eaaadb239ec6a6e2b3e12 - https://git.kernel.org/stable/c/381045dc64d23a2229c47c5524c06bfc33d34446 - https://git.kernel.org/stable/c/08bacf871c019163ccd1389d0bc957a43324967a - https://git.kernel.org/stable/c/
fc33d34446 - https://git.kernel.org/stable/c/08bacf871c019163ccd1389d0bc957a43324967a - https://git.kernel.org/stable/c/64b05fa212c7e4d057676e8b7e7120c6eb2f615b - https://git.kernel.org/stable/c/0f69d7d5e918aa43423d86bd17ddb11b1b5e8ada - https://git.kernel.org/stable/c/fef451f0fbbe85dbd2962b18379d02e2965610db - https://git.kernel.org/stable/c/46c861009bf437a18417df24cea0d181741b7d72 - https://git.kernel.org/stable/c/ffd4c4d5293e4985092ea45ba21cad9326e2e434 - https://git.kernel.org/stable/c/9b6bdbd9337de3917945847bde262a34a87a6303
CVE ID: CVE-2022-49316 State: PUBLISHED Published: 2025-02-26T02:10:43.569Z Last Updated: 2025-10-01T19:46:57.250Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFSv4: Don't hold the layoutget locks across multiple RPC calls When doing layoutget as part of the open() compound, we have to be careful to release the layout locks before we can call any further RPC calls, such as setattr(). The reason is that those calls could trigger a recall, which could deadlock. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/6b3fc1496e7227cd6a39a80bbfb7588ef7c7a010 - https://git.kernel.org/stabl
t: References: - https://git.kernel.org/stable/c/6b3fc1496e7227cd6a39a80bbfb7588ef7c7a010 - https://git.kernel.org/stable/c/a2b3be930e79cc5d9d829f158e31172b2043f0cd - https://git.kernel.org/stable/c/0ee5b9644f06b4d3cdcd9544f43f63312e425a4c - https://git.kernel.org/stable/c/d4c2a041ed3ba114502d5ed6ace5b1a48d637a8e - https://git.kernel.org/stable/c/08d7a26d115cc7892668baa9750f64bd8baca29b - https://git.kernel.org/stable/c/ea759ae0a9ae5acee677d722129710ac89cc59c1 - https://git.kernel.org/stable/c/6949493884fe88500de4af182588e071cf1544ee
CVE ID: CVE-2022-49317 State: PUBLISHED Published: 2025-02-26T02:10:44.055Z Last Updated: 2025-10-01T19:46:57.119Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid infinite loop to flush node pages xfstests/generic/475 can give EIO all the time which give an infinite loop to flush node page like below. Let's avoid it. [16418.518551] Call Trace: [16418.518553] ? dm_submit_bio+0x48/0x400 [16418.518574] ? submit_bio_checks+0x1ac/0x5a0 [16418.525207] __submit_bio+0x1a9/0x230 [16418.525210] ? kmem_cache_alloc+0x29e/0x3c0 [16418.525223] submit_bio_noacct+0xa8/0x2b0 [16418.525226] submit_bio+0x4d/0x130 [16418.525238] __submi
lloc+0x29e/0x3c0 [16418.525223] submit_bio_noacct+0xa8/0x2b0 [16418.525226] submit_bio+0x4d/0x130 [16418.525238] __submit_bio+0x49/0x310 [f2fs] [16418.525339] ? bio_add_page+0x6a/0x90 [16418.525344] f2fs_submit_page_bio+0x134/0x1f0 [f2fs] [16418.525365] read_node_page+0x125/0x1b0 [f2fs] [16418.525388] __get_node_page.part.0+0x58/0x3f0 [f2fs] [16418.525409] __get_node_page+0x2f/0x60 [f2fs] [16418.525431] f2fs_get_dnode_of_data+0x423/0x860 [f2fs] [16418.525452] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [16418.525458] ? __mod_memcg_state.part.0+0x2a/0x30 [16418.525465] ? __mod_memcg_lruvec_state+0x27/0x40 [16418.525467] ? __xa_set_mark+0x57/0x70 [16418.525472] f2fs_do_write_data_page+0x10e/0x
od_memcg_lruvec_state+0x27/0x40 [16418.525467] ? __xa_set_mark+0x57/0x70 [16418.525472] f2fs_do_write_data_page+0x10e/0x7b0 [f2fs] [16418.525493] f2fs_write_single_data_page+0x555/0x830 [f2fs] [16418.525514] ? sysvec_apic_timer_interrupt+0x4e/0x90 [16418.525518] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [16418.525523] f2fs_write_cache_pages+0x303/0x880 [f2fs] [16418.525545] ? blk_flush_plug_list+0x47/0x100 [16418.525548] f2fs_write_data_pages+0xfd/0x320 [f2fs] [16418.525569] do_writepages+0xd5/0x210 [16418.525648] filemap_fdatawrite_wbc+0x7d/0xc0 [16418.525655] filemap_fdatawrite+0x50/0x70 [16418.525658] f2fs_sync_dirty_inodes+0xa4/0x230 [f2fs] [16418.525679] f2fs_write_checkpoint+0x16d/0x
atawrite+0x50/0x70 [16418.525658] f2fs_sync_dirty_inodes+0xa4/0x230 [f2fs] [16418.525679] f2fs_write_checkpoint+0x16d/0x1720 [f2fs] [16418.525699] ? ttwu_do_wakeup+0x1c/0x160 [16418.525709] ? ttwu_do_activate+0x6d/0xd0 [16418.525711] ? __wait_for_common+0x11d/0x150 [16418.525715] kill_f2fs_super+0xca/0x100 [f2fs] [16418.525733] deactivate_locked_super+0x3b/0xb0 [16418.525739] deactivate_super+0x40/0x50 [16418.525741] cleanup_mnt+0x139/0x190 [16418.525747] __cleanup_mnt+0x12/0x20 [16418.525749] task_work_run+0x6d/0xa0 [16418.525765] exit_to_user_mode_prepare+0x1ad/0x1b0 [16418.525771] syscall_exit_to_user_mode+0x27/0x50 [16418.525774] do_syscall_64+0x48/0xc0 [16418.525776] entry_SYSCALL_64_af
18.525771] syscall_exit_to_user_mode+0x27/0x50 [16418.525774] do_syscall_64+0x48/0xc0 [16418.525776] entry_SYSCALL_64_after_hwframe+0x44/0xae Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/bd47ea5d776d8b524fb6f60de3240f95603901dd - https://git.kernel.org/stable/c/a7b8618aa2f0f926ce85f2486ac835a85c753ca7
CVE ID: CVE-2022-49318 State: PUBLISHED Published: 2025-02-26T02:10:44.557Z Last Updated: 2025-10-01T19:46:56.972Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: remove WARN_ON in f2fs_is_valid_blkaddr Syzbot triggers two WARNs in f2fs_is_valid_blkaddr and __is_bitmap_valid. For example, in f2fs_is_valid_blkaddr, if type is DATA_GENERIC_ENHANCE or DATA_GENERIC_ENHANCE_READ, it invokes WARN_ON if blkaddr is not in the right range. The call trace is as follows: f2fs_get_node_info+0x45f/0x1070 read_node_page+0x577/0x1190 __get_node_page.part.0+0x9e/0x10e0 __get_node_page f2fs_get_node_page+0x109/0x180 do_read_inode f2fs_iget
e+0x577/0x1190 __get_node_page.part.0+0x9e/0x10e0 __get_node_page f2fs_get_node_page+0x109/0x180 do_read_inode f2fs_iget+0x2a5/0x58b0 f2fs_fill_super+0x3b39/0x7ca0 Fix these two WARNs by replacing WARN_ON with dump_stack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0a7a1fc7e71eecf2e5053a6c312c9f0dcbb9b8fd - https://git.kernel.org/stable/c/32bea51fe4c6e92c00403739f7547c89219bea88 - https://git.kernel.org/stable/c/99c09b298e47ebbe345a6da9f268b32a6b0f4582 - https://git.kernel.org/stable/c/cd6374af36cc548464d8c47a93fdba7303bb82a4 - https://git.kernel.org/stable/c/8c62c5e26345c34d199b4b8c8e69255ba3d0e751 - https://git.kernel.org/stable/c/dc2f78
82a4 - https://git.kernel.org/stable/c/8c62c5e26345c34d199b4b8c8e69255ba3d0e751 - https://git.kernel.org/stable/c/dc2f78e2d4cc844a1458653d57ce1b54d4a29f21
CVE ID: CVE-2022-49319 State: PUBLISHED Published: 2025-02-26T02:10:45.131Z Last Updated: 2025-10-01T19:46:56.846Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/54c1e0e3bbcab2abe25b2874a43050ae5df87831 - https://git.kernel.org/stable/c/fb0f1c5eb8d60b3e018ba7c87da249b52674ebe6 - https://git.kernel.org/stable/c/db728a891f9177b044aaca89b678f6b5e24d5cc3 - https
f1c5eb8d60b3e018ba7c87da249b52674ebe6 - https://git.kernel.org/stable/c/db728a891f9177b044aaca89b678f6b5e24d5cc3 - https://git.kernel.org/stable/c/54cf47da0c7532d151d76e5d63f5936191698c44 - https://git.kernel.org/stable/c/b131fa8c1d2afd05d0b7598621114674289c2fbb
CVE ID: CVE-2022-49320 State: PUBLISHED Published: 2025-02-26T02:10:45.703Z Last Updated: 2025-05-04T08:35:08.000Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type In zynqmp_dma_alloc/free_chan_resources functions there is a potential overflow in the below expressions. dma_alloc_coherent(chan->dev, (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), &chan->desc_pool_p, GFP_KERNEL); dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), chan->desc_pool_v, chan->desc_pool_p); The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit.
QMP_DMA_NUM_DESCS), chan->desc_pool_v, chan->desc_pool_p); The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though this overflow condition is not observed but it is a potential problem in the case of 32-bit multiplication. Hence fix it by changing the desc_size data type to size_t. In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in dma_alloc_coherent API argument. Addresses-Coverity: Event overflow_before_widen. References: - https://git.kernel.org/stable/c/83960276ffc9bf5570d4106490346b61e61be5f3 - https://git.kernel.org/stable/c/95a0ba85c1b51b36e909841c02d205cd223ab753 - https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675 - https://git
1b51b36e909841c02d205cd223ab753 - https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675 - https://git.kernel.org/stable/c/4838969e4d95d2bd2995d1605b20d3144fcb3e74 - https://git.kernel.org/stable/c/90aefae2e3a770a6909d339f5d8a988c0b0ceaf0 - https://git.kernel.org/stable/c/f9a9f43a62a04ec3183fb0da9226c7706eed0115
CVE ID: CVE-2022-49321 State: PUBLISHED Published: 2025-02-26T02:10:46.186Z Last Updated: 2025-10-01T19:46:56.703Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: xprtrdma: treat all calls not a bcall when bc_serv is NULL When a rdma server returns a fault format reply, nfs v3 client may treats it as a bcall when bc service is not exist. The debug message at rpcrdma_bc_receive_call are, [56579.837169] RPC: rpcrdma_bc_receive_call: callback XID 00000001, length=20 [56579.837174] RPC: rpcrdma_bc_receive_call: 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 After that, rpcrdma_bc_receive_call will meets NULL pointer as,
00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 After that, rpcrdma_bc_receive_call will meets NULL pointer as, [ 226.057890] BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8 ... [ 226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20 ... [ 226.059732] Call Trace: [ 226.059878] rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma] [ 226.060011] __ib_process_cq+0x89/0x170 [ib_core] [ 226.060092] ib_cq_poll_work+0x26/0x80 [ib_core] [ 226.060257] process_one_work+0x1a7/0x360 [ 226.060367] ? create_worker+0x1a0/0x1a0 [ 226.060440] worker_thread+0x30/0x390 [ 226.060500] ? create_worker+0x1a0/0x1a0 [ 226.060574] kthread+0x116/0x130 [ 226.060661] ? kthread_flush_work_fn+0x10/0x10
6.060500] ? create_worker+0x1a0/0x1a0 [ 226.060574] kthread+0x116/0x130 [ 226.060661] ? kthread_flush_work_fn+0x10/0x10 [ 226.060724] ret_from_fork+0x35/0x40 ... Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8e3943c50764dc7c5f25911970c3ff062ec1f18c - https://git.kernel.org/stable/c/998d35a2aff4b81a1c784f3aa45cd3afff6814c1 - https://git.kernel.org/stable/c/da99331fa62131a38a0947a8204c5208de7b0454 - https://git.kernel.org/stable/c/8dbae5affbdbf524b48000f9d357925bb001e5f4 - https://git.kernel.org/stable/c/a3fc8051ee061e31db13e2fe011e8e0b71a7f815 - https://git.kernel.org/stable/c/90c4f73104016748533a5707ecd15930fbeff402 - https://git.kernel.org/
2fe011e8e0b71a7f815 - https://git.kernel.org/stable/c/90c4f73104016748533a5707ecd15930fbeff402 - https://git.kernel.org/stable/c/91784f3d77b73885e1b2e6b59d3cbf0de0a1126a - https://git.kernel.org/stable/c/11270e7ca268e8d61b5d9e5c3a54bd1550642c9c
CVE ID: CVE-2022-49322 State: PUBLISHED Published: 2025-02-26T02:10:46.658Z Last Updated: 2025-10-01T19:46:56.506Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix sleeping function called from invalid context on RT kernel When setting bootparams="trace_event=initcall:initcall_start tp_printk=1" in the cmdline, the output_printk() was called, and the spin_lock_irqsave() was called in the atomic and irq disable interrupt context suitation. On the PREEMPT_RT kernel, these locks are replaced with sleepable rt-spinlock, so the stack calltrace will be triggered. Fix it by raw_spin_lock_irqsave when PREEMPT_RT and "trace_e