Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
able stack unwinding of BPF programs that we never expect. To remedy this case, make bpf_prog_ksym_find treat IP == ksym.end as part of the BPF program, so that is_bpf_text_address returns true when such a case occurs, and we are able to unwind reliably when the final instruction ends up being a call instruction. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/6058e4829696412457729a00734969acc6fd1d18 - https://git.kernel.org/stable/c/cf353904a82873e952633fcac4385c2fcd3a46e1 - https://git.kernel.org/stable/c/aa42a7cb92647786719fe9608685da345883878f - https://git.kernel.org/stable/c/327b92e8cb527ae097961ffd1610c720481947
able/c/aa42a7cb92647786719fe9608685da345883878f - https://git.kernel.org/stable/c/327b92e8cb527ae097961ffd1610c720481947f5 - https://git.kernel.org/stable/c/821a7e4143af115b840ec199eb179537e18af922 - https://git.kernel.org/stable/c/66d9111f3517f85ef2af0337ece02683ce0faf21
CVE ID: CVE-2023-52829 State: PUBLISHED Published: 2024-05-21T15:31:32.164Z Last Updated: 2025-05-04T07:43:54.293Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps() reg_cap.phy_id is extracted from WMI event and could be an unexpected value in case some errors happen. As a result out-of-bound write may occur to soc->hal_reg_cap. Fix it by validating reg_cap.phy_id before using it. This is found during code review. Compile tested only. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/
Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/dfe13eaab043130f90dd3d57c7d88577c04adc97 - https://git.kernel.org/stable/c/4dd0547e8b45faf6f95373be5436b66cde326c0e - https://git.kernel.org/stable/c/b302dce3d9edea5b93d1902a541684a967f3c63c
CVE ID: CVE-2023-52830 State: REJECTED Published: 2024-05-21T15:31:32.881Z Last Updated: 2024-05-22T11:37:09.061Z Description: No description available.
CVE ID: CVE-2023-52831 State: PUBLISHED Published: 2024-05-21T15:31:33.566Z Last Updated: 2025-05-04T07:43:55.664Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cpu/hotplug: Don't offline the last non-isolated CPU If a system has isolated CPUs via the "isolcpus=" command line parameter, then an attempt to offline the last housekeeping CPU will result in a WARN_ON() when rebuilding the scheduler domains and a subsequent panic due to and unhandled empty CPU mas in partition_sched_domains_locked(). cpuset_hotplug_workfn() rebuild_sched_domains_locked() ndoms = generate_sched_domains(&doms, &attr); cpumask_and(doms[0], top_cpuset.
g_workfn() rebuild_sched_domains_locked() ndoms = generate_sched_domains(&doms, &attr); cpumask_and(doms[0], top_cpuset.effective_cpus, housekeeping_cpumask(HK_FLAG_DOMAIN)); Thus results in an empty CPU mask which triggers the warning and then the subsequent crash: WARNING: CPU: 4 PID: 80 at kernel/sched/topology.c:2366 build_sched_domains+0x120c/0x1408 Call trace: build_sched_domains+0x120c/0x1408 partition_sched_domains_locked+0x234/0x880 rebuild_sched_domains_locked+0x37c/0x798 rebuild_sched_domains+0x30/0x58 cpuset_hotplug_workfn+0x2a8/0x930 Unable to handle kernel paging request at virtual address fffe80027ab37080 partition_sched_domains_locked+0x318/0x880 rebuild_sched_domains_locked+
ing request at virtual address fffe80027ab37080 partition_sched_domains_locked+0x318/0x880 rebuild_sched_domains_locked+0x37c/0x798 Aside of the resulting crash, it does not make any sense to offline the last last housekeeping CPU. Prevent this by masking out the non-housekeeping CPUs when selecting a target CPU for initiating the CPU unplug operation via the work queue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/3410b702354702b500bde10e3cc1f9db8731d908 - https://git.kernel.org/stable/c/335a47ed71e332c82339d1aec0c7f6caccfcda13 - https://git.kernel.org/stable/c/3073f6df783d9d75f7f69f73e16c7ef85d6cfb63 - https://git
1e332c82339d1aec0c7f6caccfcda13 - https://git.kernel.org/stable/c/3073f6df783d9d75f7f69f73e16c7ef85d6cfb63 - https://git.kernel.org/stable/c/38685e2a0476127db766f81b1c06019ddc4c9ffa
CVE ID: CVE-2023-52832 State: PUBLISHED Published: 2024-05-21T15:31:34.247Z Last Updated: 2025-05-04T07:43:56.728Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return unset power in ieee80211_get_tx_power() We can get a UBSAN warning if ieee80211_get_tx_power() returns the INT_MIN value mac80211 internally uses for "unset power level". UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 -2147483648 * 100 cannot be represented in type 'int' CPU: 0 PID: 20433 Comm: insmod Tainted: G WC OE Call Trace: dump_stack+0x74/0x92 ubsan_epilogue+0x9/0x50 handle_overflow+0x8d/0xd0 __ubsan_handle_mul_overf
ted: G WC OE Call Trace: dump_stack+0x74/0x92 ubsan_epilogue+0x9/0x50 handle_overflow+0x8d/0xd0 __ubsan_handle_mul_overflow+0xe/0x10 nl80211_send_iface+0x688/0x6b0 [cfg80211] [...] cfg80211_register_wdev+0x78/0xb0 [cfg80211] cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211] [...] ieee80211_if_add+0x60e/0x8f0 [mac80211] ieee80211_register_hw+0xda5/0x1170 [mac80211] In this case, simply return an error instead, to indicate that no data is available. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/1571120c44dbe5757aee1612c5b6097cdc42710f - https://git.kernel.org/stable/c/298e767362cade639b7121ecb3cc5345b6529f62 - https
1120c44dbe5757aee1612c5b6097cdc42710f - https://git.kernel.org/stable/c/298e767362cade639b7121ecb3cc5345b6529f62 - https://git.kernel.org/stable/c/efeae5f4972f75d50002bc50eb112ab9e7069b18 - https://git.kernel.org/stable/c/717de20abdcd1d4993fa450e28b8086a352620ea - https://git.kernel.org/stable/c/21a0f310a9f3bfd2b4cf4f382430e638607db846 - https://git.kernel.org/stable/c/2be24c47ac19bf639c48c082486c08888bd603c6 - https://git.kernel.org/stable/c/adc2474d823fe81d8da759207f4f1d3691aa775a - https://git.kernel.org/stable/c/5a94cffe90e20e8fade0b9abd4370bd671fe87c7 - https://git.kernel.org/stable/c/e160ab85166e77347d0cbe5149045cb25e83937f
CVE ID: CVE-2023-52833 State: PUBLISHED Published: 2024-05-21T15:31:34.915Z Last Updated: 2025-05-04T07:43:57.863Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Add date->evt_skb is NULL check fix crash because of null pointers [ 6104.969662] BUG: kernel NULL pointer dereference, address: 00000000000000c8 [ 6104.969667] #PF: supervisor read access in kernel mode [ 6104.969668] #PF: error_code(0x0000) - not-present page [ 6104.969670] PGD 0 P4D 0 [ 6104.969673] Oops: 0000 [#1] SMP NOPTI [ 6104.969684] RIP: 0010:btusb_mtk_hci_wmt_sync+0x144/0x220 [btusb] [ 6104.969688] RSP: 0018:ffffb8d681533d48 EFLAGS: 0001024
4.969684] RIP: 0010:btusb_mtk_hci_wmt_sync+0x144/0x220 [btusb] [ 6104.969688] RSP: 0018:ffffb8d681533d48 EFLAGS: 00010246 [ 6104.969689] RAX: 0000000000000000 RBX: ffff8ad560bb2000 RCX: 0000000000000006 [ 6104.969691] RDX: 0000000000000000 RSI: ffffb8d681533d08 RDI: 0000000000000000 [ 6104.969692] RBP: ffffb8d681533d70 R08: 0000000000000001 R09: 0000000000000001 [ 6104.969694] R10: 0000000000000001 R11: 00000000fa83b2da R12: ffff8ad461d1d7c0 [ 6104.969695] R13: 0000000000000000 R14: ffff8ad459618c18 R15: ffffb8d681533d90 [ 6104.969697] FS: 00007f5a1cab9d40(0000) GS:ffff8ad578200000(0000) knlGS:00000 [ 6104.969699] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6104.969700] CR2: 000000000
78200000(0000) knlGS:00000 [ 6104.969699] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6104.969700] CR2: 00000000000000c8 CR3: 000000018620c001 CR4: 0000000000760ef0 [ 6104.969701] PKRU: 55555554 [ 6104.969702] Call Trace: [ 6104.969708] btusb_mtk_shutdown+0x44/0x80 [btusb] [ 6104.969732] hci_dev_do_close+0x470/0x5c0 [bluetooth] [ 6104.969748] hci_rfkill_set_block+0x56/0xa0 [bluetooth] [ 6104.969753] rfkill_set_block+0x92/0x160 [ 6104.969755] rfkill_fop_write+0x136/0x1e0 [ 6104.969759] __vfs_write+0x18/0x40 [ 6104.969761] vfs_write+0xdf/0x1c0 [ 6104.969763] ksys_write+0xb1/0xe0 [ 6104.969765] __x64_sys_write+0x1a/0x20 [ 6104.969769] do_syscall_64+0x51/0x180 [ 6104.969771] entry_SYSCALL
+0xb1/0xe0 [ 6104.969765] __x64_sys_write+0x1a/0x20 [ 6104.969769] do_syscall_64+0x51/0x180 [ 6104.969771] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 6104.969773] RIP: 0033:0x7f5a21f18fef [ 6104.9] RSP: 002b:00007ffeefe39010 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 6104.969780] RAX: ffffffffffffffda RBX: 000055c10a7560a0 RCX: 00007f5a21f18fef [ 6104.969781] RDX: 0000000000000008 RSI: 00007ffeefe39060 RDI: 0000000000000012 [ 6104.969782] RBP: 00007ffeefe39060 R08: 0000000000000000 R09: 0000000000000017 [ 6104.969784] R10: 00007ffeefe38d97 R11: 0000000000000293 R12: 0000000000000002 [ 6104.969785] R13: 00007ffeefe39220 R14: 00007ffeefe391a0 R15: 000055c10a72acf0 Additional Analyst Notes:
000000000002 [ 6104.969785] R13: 00007ffeefe39220 R14: 00007ffeefe391a0 R15: 000055c10a72acf0 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/9f8e4d1a4ca1179aaeb43f91f3e2a386e7e616b3 - https://git.kernel.org/stable/c/f9de14bde56dcbb0765284c6dfc35842b021733c - https://git.kernel.org/stable/c/a556f2ef556a04790f67f2fa272f1a77336d15a0 - https://git.kernel.org/stable/c/0048ddf045bddc4dacb3e783fd869a2f8fb5be30 - https://git.kernel.org/stable/c/13b1ebad4c175e6a9b0748acbf133c21a15d282a - https://git.kernel.org/stable/c/624820f7c8826dd010e8b1963303c145f99816e9
CVE ID: CVE-2023-52834 State: PUBLISHED Published: 2024-05-21T15:31:35.575Z Last Updated: 2025-05-04T07:43:59.052Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: atl1c: Work around the DMA RX overflow issue This is based on alx driver commit 881d0327db37 ("net: alx: Work around the DMA RX overflow issue"). The alx and atl1c drivers had RX overflow error which was why a custom allocator was created to avoid certain addresses. The simpler workaround then created for alx driver, but not for atl1c due to lack of tester. Instead of using a custom allocator, check the allocated skb address and use skb_reserve() to move away from prob
ester. Instead of using a custom allocator, check the allocated skb address and use skb_reserve() to move away from problematic 0x...fc0 address. Tested on AR8131 on Acer 4540. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/c29a89b23f67ee592f4dee61f9d7efbf86d60315 - https://git.kernel.org/stable/c/57e44ff9c2c9747b2b1a53556810b0e5192655d6 - https://git.kernel.org/stable/c/54a6152da4993ec8e4b53dc3cf577f5a2c829afa - https://git.kernel.org/stable/c/32f08b7b430ee01ec47d730f961a3306c1c7b6fb - https://git.kernel.org/stable/c/86565682e9053e5deb128193ea9e88531bbae9cf
CVE ID: CVE-2023-52835 State: PUBLISHED Published: 2024-05-21T15:31:36.239Z Last Updated: 2025-05-04T07:44:00.575Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record with a large AUX area, e.g 4GB, it fails with: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory) and it reveals a WARNING with __alloc_pages(): ------------[ cut here ]------------ WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248 Call trace: __alloc_pages+0x1ec/0x248 __kmalloc_large_node+0xc0/0x1f8 __kmalloc_no
lloc.c:5568 __alloc_pages+0x1ec/0x248 Call trace: __alloc_pages+0x1ec/0x248 __kmalloc_large_node+0xc0/0x1f8 __kmalloc_node+0x134/0x1e8 rb_alloc_aux+0xe0/0x298 perf_mmap+0x440/0x660 mmap_region+0x308/0x8a8 do_mmap+0x3c0/0x528 vm_mmap_pgoff+0xf4/0x1b8 ksys_mmap_pgoff+0x18c/0x218 __arm64_sys_mmap+0x38/0x58 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x58/0x188 do_el0_svc+0x34/0x50 el0_svc+0x34/0x108 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x1a4/0x1a8 'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to maintains AUX trace pages. The allocated page for this array is physically contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the size of p
page for this array is physically contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the size of pointer array crosses the limitation set by MAX_ORDER, it reveals a WARNING. So bail out early with -ENOMEM if the request AUX area is out of bound, e.g.: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8c504f615d7ed60ae035c51d0c789137ced6797f - https://git.kernel.org/stable/c/788c0b3442ead737008934947730a6d1ff703734 - https://git.kernel.org/stable/c/1a2a4202c60fcdffbf04f259002ce9bff39edece - https://git.
ead737008934947730a6d1ff703734 - https://git.kernel.org/stable/c/1a2a4202c60fcdffbf04f259002ce9bff39edece - https://git.kernel.org/stable/c/fd0df3f8719201dbe61a4d39083d5aecd705399a - https://git.kernel.org/stable/c/9ce4e87a8efd37c85766ec08b15e885cab08553a - https://git.kernel.org/stable/c/2424410f94a94d91230ced094062d859714c984a - https://git.kernel.org/stable/c/2e905e608e38cf7f8dcddcf8a6036e91a78444cb - https://git.kernel.org/stable/c/54aee5f15b83437f23b2b2469bcf21bdd9823916
CVE ID: CVE-2023-52836 State: PUBLISHED Published: 2024-05-21T15:31:37.174Z Last Updated: 2025-05-04T07:44:01.742Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: locking/ww_mutex/test: Fix potential workqueue corruption In some cases running with the test-ww_mutex code, I was seeing odd behavior where sometimes it seemed flush_workqueue was returning before all the work threads were finished. Often this would cause strange crashes as the mutexes would be freed while they were being used. Looking at the code, there is a lifetime problem as the controlling thread that spawns the work allocates the "struct stress" structures that
here is a lifetime problem as the controlling thread that spawns the work allocates the "struct stress" structures that are passed to the workqueue threads. Then when the workqueue threads are finished, they free the stress struct that was passed to them. Unfortunately the workqueue work_struct node is in the stress struct. Which means the work_struct is freed before the work thread returns and while flush_workqueue is waiting. It seems like a better idea to have the controlling thread both allocate and free the stress structures, so that we can be sure we don't corrupt the workqueue by freeing the structure prematurely. So this patch reworks the test to do so, and with this change I no long
workqueue by freeing the structure prematurely. So this patch reworks the test to do so, and with this change I no longer see the early flush_workqueue returns. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/d4d37c9e6a4dbcca958dabd99216550525c7e389 - https://git.kernel.org/stable/c/d8267cabbe1bed15ccf8b0e684c528bf8eeef715 - https://git.kernel.org/stable/c/dcd85e3c929368076a7592b27f541e0da8b427f5 - https://git.kernel.org/stable/c/9ed2d68b3925145f5f51c46559484881d6082f75 - https://git.kernel.org/stable/c/e89d0ed45a419c485bae999426ecf92697cbdda3 - https://git.kernel.org/stable/c/c56df79d68677cf062da1b6e3b33e74299a92dfc
e/c/e89d0ed45a419c485bae999426ecf92697cbdda3 - https://git.kernel.org/stable/c/c56df79d68677cf062da1b6e3b33e74299a92dfc - https://git.kernel.org/stable/c/e36407713163363e65566e7af0abe207d5f59a0c - https://git.kernel.org/stable/c/304a2c4aad0fff887ce493e4197bf9cbaf394479 - https://git.kernel.org/stable/c/bccdd808902f8c677317cec47c306e42b93b849e
CVE ID: CVE-2023-52837 State: PUBLISHED Published: 2024-05-21T15:31:37.859Z Last Updated: 2025-05-04T07:44:02.911Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_open Commit 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set disk->private_data as NULL as before. UAF may be triggered in nbd_open() if someone tries to open nbd device right after nbd_put() since nbd has been free in nbd_dev_remove(). Fix this by implementing ->free_disk and free private data in it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refe
>free_disk and free private data in it. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/4e9b3ec84dc97909876641dad14e0a2300d6c2a3 - https://git.kernel.org/stable/c/879947f4180bc6e83af64eb0515e0cf57fce15db - https://git.kernel.org/stable/c/56bd7901b5e9dbc9112036ea615ebcba1565fafe - https://git.kernel.org/stable/c/327462725b0f759f093788dfbcb2f1fd132f956b
CVE ID: CVE-2023-52838 State: PUBLISHED Published: 2024-05-21T15:31:38.539Z Last Updated: 2025-05-04T12:49:37.526Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev: imsttfb: fix a resource leak in probe I've re-written the error handling but the bug is that if init_imstt() fails we need to call iounmap(par->cmap_regs). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/382e1931e0c9cd58a5a8519cdc6cd9dc4d82b485 - https://git.kernel.org/stable/c/6c66d737b2726ac7784269ddf32a31634f8f269d - https://git.kernel.org/stable/c/a4dfebec32ec6d420a5506dd56a7834c91be28
able/c/6c66d737b2726ac7784269ddf32a31634f8f269d - https://git.kernel.org/stable/c/a4dfebec32ec6d420a5506dd56a7834c91be28e4 - https://git.kernel.org/stable/c/8e4b510fe91782522b7ca0ca881b663b5d35e513 - https://git.kernel.org/stable/c/7bc7b82fb2191b0d50a80ee4e27030918767dd1d - https://git.kernel.org/stable/c/18d26f9baca7d0d309303e3074a2252b8310884a - https://git.kernel.org/stable/c/b346a531159d08c564a312a9eaeea691704f3c00 - https://git.kernel.org/stable/c/aba6ab57a910ad4b940c2024d15f2cdbf5b7f76b
CVE ID: CVE-2023-52839 State: PUBLISHED Published: 2024-05-21T15:31:39.196Z Last Updated: 2025-05-04T07:44:05.060Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drivers: perf: Do not broadcast to other cpus when starting a counter This command: $ perf record -e cycles:k -e instructions:k -c 10000 -m 64M dd if=/dev/zero of=/dev/null count=1000 gives rise to this kernel warning: [ 444.364395] WARNING: CPU: 0 PID: 104 at kernel/smp.c:775 smp_call_function_many_cond+0x42c/0x436 [ 444.364515] Modules linked in: [ 444.364657] CPU: 0 PID: 104 Comm: perf-exec Not tainted 6.6.0-rc6-00051-g391df82e8ec3-dirty #73 [ 444.364771] Hardware n
444.364657] CPU: 0 PID: 104 Comm: perf-exec Not tainted 6.6.0-rc6-00051-g391df82e8ec3-dirty #73 [ 444.364771] Hardware name: riscv-virtio,qemu (DT) [ 444.364868] epc : smp_call_function_many_cond+0x42c/0x436 [ 444.364917] ra : on_each_cpu_cond_mask+0x20/0x32 [ 444.364948] epc : ffffffff8009f9e0 ra : ffffffff8009fa5a sp : ff20000000003800 [ 444.364966] gp : ffffffff81500aa0 tp : ff60000002b83000 t0 : ff200000000038c0 [ 444.364982] t1 : ffffffff815021f0 t2 : 000000000000001f s0 : ff200000000038b0 [ 444.364998] s1 : ff60000002c54d98 a0 : ff60000002a73940 a1 : 0000000000000000 [ 444.365013] a2 : 0000000000000000 a3 : 0000000000000003 a4 : 0000000000000100 [ 444.365029] a5 : 0000000000010100 a6 :
[ 444.365013] a2 : 0000000000000000 a3 : 0000000000000003 a4 : 0000000000000100 [ 444.365029] a5 : 0000000000010100 a6 : 0000000000f00000 a7 : 0000000000000000 [ 444.365044] s2 : 0000000000000000 s3 : ffffffffffffffff s4 : ff60000002c54d98 [ 444.365060] s5 : ffffffff81539610 s6 : ffffffff80c20c48 s7 : 0000000000000000 [ 444.365075] s8 : 0000000000000000 s9 : 0000000000000001 s10: 0000000000000001 [ 444.365090] s11: ffffffff80099394 t3 : 0000000000000003 t4 : 00000000eac0c6e6 [ 444.365104] t5 : 0000000400000000 t6 : ff60000002e010d0 [ 444.365120] status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003 [ 444.365226] [<ffffffff8009f9e0>] smp_call_function_many_cond+0x42c/0x43
addr: 0000000000000000 cause: 0000000000000003 [ 444.365226] [<ffffffff8009f9e0>] smp_call_function_many_cond+0x42c/0x436 [ 444.365295] [<ffffffff8009fa5a>] on_each_cpu_cond_mask+0x20/0x32 [ 444.365311] [<ffffffff806e90dc>] pmu_sbi_ctr_start+0x7a/0xaa [ 444.365327] [<ffffffff806e880c>] riscv_pmu_start+0x48/0x66 [ 444.365339] [<ffffffff8012111a>] perf_adjust_freq_unthr_context+0x196/0x1ac [ 444.365356] [<ffffffff801237aa>] perf_event_task_tick+0x78/0x8c [ 444.365368] [<ffffffff8003faf4>] scheduler_tick+0xe6/0x25e [ 444.365383] [<ffffffff8008a042>] update_process_times+0x80/0x96 [ 444.365398] [<ffffffff800991ec>] tick_sched_handle+0x26/0x52 [ 444.365410] [<ffffffff800993e4>] tick_sched_timer+0
x96 [ 444.365398] [<ffffffff800991ec>] tick_sched_handle+0x26/0x52 [ 444.365410] [<ffffffff800993e4>] tick_sched_timer+0x50/0x98 [ 444.365422] [<ffffffff8008a6aa>] __hrtimer_run_queues+0x126/0x18a [ 444.365433] [<ffffffff8008b350>] hrtimer_interrupt+0xce/0x1da [ 444.365444] [<ffffffff806cdc60>] riscv_timer_interrupt+0x30/0x3a [ 444.365457] [<ffffffff8006afa6>] handle_percpu_devid_irq+0x80/0x114 [ 444.365470] [<ffffffff80065b82>] generic_handle_domain_irq+0x1c/0x2a [ 444.365483] [<ffffffff8045faec>] riscv_intc_irq+0x2e/0x46 [ 444.365497] [<ffffffff808a9c62>] handle_riscv_irq+0x4a/0x74 [ 444.365521] [<ffffffff808aa760>] do_irq+0x7c/0x7e [ 444.365796] ---[ end trace 0000000000000000 ]--- That's
+0x4a/0x74 [ 444.365521] [<ffffffff808aa760>] do_irq+0x7c/0x7e [ 444.365796] ---[ end trace 0000000000000000 ]--- That's because the fix in commit 3fec323339a4 ("drivers: perf: Fix panic in riscv SBI mmap support") was wrong since there is no need to broadcast to other cpus when starting a counter, that's only needed in mmap when the counters could have already been started on other cpus, so simply remove this broadcast. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/85be1a73fd298ed3fd060dfce97caef5f9928c57 - https://git.kernel.org/stable/c/61e3d993c8bd3e80f8f1363ed5e04f88ab531b72
CVE ID: CVE-2023-52840 State: PUBLISHED Published: 2024-05-21T15:31:39.862Z Last Updated: 2025-05-04T07:44:06.206Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() The put_device() calls rmi_release_function() which frees "fn" so the dereference on the next line "fn->num_of_irqs" is a use after free. Move the put_device() to the end to fix this. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://git.kernel.org/stable/c/2f236d8638f5b43e0c72919a6a27fe286c32053f - https://git.kernel.org/stable/c/50d12253666195a14c6c
/git.kernel.org/stable/c/2f236d8638f5b43e0c72919a6a27fe286c32053f - https://git.kernel.org/stable/c/50d12253666195a14c6cd2b81c376e2dbeedbdff - https://git.kernel.org/stable/c/6c71e065befb2fae8f1461559b940c04e1071bd5 - https://git.kernel.org/stable/c/303766bb92c5c225cf40f9bbbe7e29749406e2f2 - https://git.kernel.org/stable/c/7082b1fb5321037bc11ba1cf2d7ed23c6b2b521f - https://git.kernel.org/stable/c/cc56c4d17721dcb10ad4e9c9266e449be1462683 - https://git.kernel.org/stable/c/c8e639f5743cf4b01f8c65e0df075fe4d782b585 - https://git.kernel.org/stable/c/eb988e46da2e4eae89f5337e047ce372fe33d5b1