deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-47521
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

can: sja1000: fix use after free in ems_pcmcia_add_card()

If the last channel is not available then "dev" is freed.  Fortunately,
we can just use "pdev->irq" instead.

Also we should check if at least one channel was set up.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1a295fea90e1acbe80c6d4940f5ff856edcd6bec; https://git.kernel.org/stable/c/1dd5b819f7e406dc15bbc7670596ff25261aaa2a; https://git.kernel.org/stable/c/3ec6ca6b1a8e64389f0212b5a1b0f6fed1909e45
CVE: CVE-2021-47522
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: bigbenff: prevent null pointer dereference

When emulating the device through uhid, there is a chance we don't have
output reports and so report_field is null.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/58f15f5ae7786c824868f3a7e093859b74669ce7; https://git.kernel.org/stable/c/6272b17001e6fdcf7b4a[PII_REDACTED]a1523fa6e; https://git.kernel.org/stable/c/8e0ceff632f48175ec7fb4706129c55ca8a7c7bd
CVE: CVE-2021-47523
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr

This buffer is currently allocated in hfi1_init():

	if (reinit)
		ret = init_after_reset(dd);
	else
		ret = loadtime_init(dd);
	if (ret)
		goto done;

	/* allocate dummy tail memory for all receive contexts */
	dd->rcvhdrtail_dummy_kvaddr = dma_alloc_coherent(&dd->pcidev->dev,
							 sizeof(u64),
							 &dd->rcvhdrtail_dummy_dma,
							 GFP_KERNEL);

	if (!dd->rcvhdrtail_dummy_kvaddr) {
		dd_dev_err(dd, "cannot allocate dummy tail memory\n");
		ret = -ENOMEM;
		goto done;
	}

The reinit triggered path will overwrite the old allocation and leak it.

Fix by moving the allocation to hfi1_alloc_devdata() and the deallocation
to hfi1_free_devdata().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2c08271f4ed0e24633b3f81ceff61052b9d45efc; https://git.kernel.org/stable/c/60a8b5a1611b4a26de4839ab9c1fc2a9cf3e17c1; https://git.kernel.org/stable/c/834d0fb978643eaf09da425de197cc16a7c2761b
CVE: CVE-2021-47524
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

serial: liteuart: fix minor-number leak on probe errors

Make sure to release the allocated minor number before returning on
probe errors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/888fc81107cacd2a4f681bac7bb785cef868214f; https://git.kernel.org/stable/c/dd5e90b16cca8a697cbe17b72e2a5f49291cabb2; https://git.kernel.org/stable/c/888fc81107cacd2a4f681bac7bb785cef868214f
CVE: CVE-2021-47525
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

serial: liteuart: fix use-after-free and memleak on unbind

Deregister the port when unbinding the driver to prevent it from being
used after releasing the driver data and leaking memory allocated by
serial core.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/05f929b395dec8957b636ff14e66b277ed022ed9; https://git.kernel.org/stable/c/602824cf9aa9db8830ffe5cfb2cd54365cada4fe; https://git.kernel.org/stable/c/05f929b395dec8957b636ff14e66b277ed022ed9
CVE: CVE-2021-47526
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

serial: liteuart: Fix NULL pointer dereference in ->remove()

drvdata has to be set in _probe() - otherwise platform_get_drvdata()
causes null pointer dereference BUG in _remove().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0f55f89d98c8b3e12b4f55f71c127a173e29557c; https://git.kernel.org/stable/c/189c99c629bbf85916c02c153f904649cc0a9d7f; https://git.kernel.org/stable/c/0f55f89d98c8b3e12b4f55f71c127a173e29557c
CVE: CVE-2021-47527
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

serial: core: fix transmit-buffer reset and memleak

Commit 761ed4a94582 ("tty: serial_core: convert uart_close to use
tty_port_close") converted serial core to use tty_port_close() but
failed to notice that the transmit buffer still needs to be freed on
final close.

Not freeing the transmit buffer means that the buffer is no longer
cleared on next open so that any ioctl() waiting for the buffer to drain
might wait indefinitely (e.g. on termios changes) or that stale data can
end up being transmitted in case tx is restarted.

Furthermore, the buffer of any port that has been opened would leak on
driver unbind.

Note that the port lock is held when clearing the buffer pointer due to
the ldisc race worked around by commit a5ba1d95e46e ("uart: fix race
between uart_put_char() and uart_shutdown()").

Also note that the tty-port shutdown() callback is not called for
console ports so it is not strictly necessary to free the buffer page
after releasing the lock (cf. d72402145ace ("tty/serial: do not free
trasnmit buffer page under port lock")).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/00de977f9e0aa9760d9a79d1e41ff780f74e3424; https://git.kernel.org/stable/c/011f6c92b5bf6e1fbfdedc8b5232f64c1c493206; https://git.kernel.org/stable/c/1179b168fa3f3a6aae3bd140000455a0e58457db
CVE: CVE-2021-47528
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: cdnsp: Fix a NULL pointer dereference in cdnsp_endpoint_init()

In cdnsp_endpoint_init(), cdnsp_ring_alloc() is assigned to pep->ring
and there is a dereference of it in cdnsp_endpoint_init(), which could
lead to a NULL pointer dereference on failure of cdnsp_ring_alloc().

Fix this bug by adding a check of pep->ring.

This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.

Builds with CONFIG_USB_CDNSP_GADGET=y show no new warnings,
and our static analyzer no longer warns about this code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/37307f7020ab38dde0892a578249bf63d00bca64; https://git.kernel.org/stable/c/7d94bc8e335cb33918e52efdbe192c36707bfa24; https://git.kernel.org/stable/c/37307f7020ab38dde0892a578249bf63d00bca64
CVE: CVE-2021-47529
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

iwlwifi: Fix memory leaks in error handling path

Should an error occur (invalid TLV len or memory allocation failure), the
memory already allocated in 'reduce_power_data' should be freed before
returning, otherwise it is leaking.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/4768935c25403ba96e7a745645df24a51a774b7e; https://git.kernel.org/stable/c/a571bc28326d9f3e13f5f2d9cda2883e0631b0ce; https://git.kernel.org/stable/c/4768935c25403ba96e7a745645df24a51a774b7e
CVE: CVE-2021-47530
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix wait_fence submitqueue leak

We weren't dropping the submitqueue reference in all paths.  In
particular, when the fence has already been signalled. Split out
a helper to simplify handling this in the various different return
paths.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4c3cdbf2540319ea674f1f3c54f31f14c6f39647; https://git.kernel.org/stable/c/ea0006d390a28012f8187717aea61498b2b341e5; https://git.kernel.org/stable/c/4c3cdbf2540319ea674f1f3c54f31f14c6f39647
CVE: CVE-2021-47531
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix mmap to include VM_IO and VM_DONTDUMP

In commit 510410bfc034 ("drm/msm: Implement mmap as GEM object
function") we switched to a new/cleaner method of doing things. That's
good, but we missed a little bit.

Before that commit, we used to _first_ run through the
drm_gem_mmap_obj() case where `obj->funcs->mmap()` was NULL. That meant
that we ran:

  vma->vm_flags |= VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;
  vma->vm_page_prot = pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
  vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);

...and _then_ we modified those mappings with our own. Now that
`obj->funcs->mmap()` is no longer NULL we don't run the default
code. It looks like the fact that the vm_flags got VM_IO / VM_DONTDUMP
was important because we're now getting crashes on Chromebooks that
use ARC++ while logging out. Specifically a crash that looks like this
(this is on a 5.10 kernel w/ relevant backports but also seen on a
5.15 kernel):

  Unable to handle kernel paging request at virtual address ffffffc008000000
  Mem abort info:
    ESR = 0x96000006
    EC = 0x25: DABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
  Data abort info:
    ISV = 0, ISS = 0x00000006
    CM = 0, WnR = 0
  swapper pgtable: 4k pages, 39-bit VAs, pgdp=[PII_REDACTED]93d000
  [ffffffc008000000] pgd=[PII_REDACTED]2b3003, p4d=[PII_REDACTED]2b3003,
                     pud=[PII_REDACTED]2b3003, pmd=[PII_REDACTED]
  Internal error: Oops: 96000006 [#1] PREEMPT SMP
  [...]
  CPU: 7 PID: 15734 Comm: crash_dump64 Tainted: G W 5.10.67 #1 [...]
  Hardware name: Qualcomm Technologies, Inc. sc7280 IDP SKU2 platform (DT)
  pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
  pc : __arch_copy_to_user+0xc0/0x30c
  lr : copyout+0xac/0x14c
  [...]
  Call trace:
   __arch_copy_to_user+0xc0/0x30c
   copy_page_to_iter+0x1a0/0x294
   process_vm_rw_core+0x240/0x408
   process_vm_rw+0x110/0x16c
   __arm64_sys_process_vm_readv+0x30/0x3c
   el0_svc_common+0xf8/0x250
   do_el0_svc+0x30/0x80
   el0_svc+0x10/0x1c
   el0_sync_handler+0x78/0x108
   el0_sync+0x184/0x1c0
  Code: f8408423 f80008c3 910020c6 36100082 (b8404423)

Let's add the two flags back in.

While we're at it, the fact that we aren't running the default means
that we _don't_ need to clear out VM_PFNMAP, so remove that and save
an instruction.

NOTE: it was confirmed that VM_IO was the important flag to fix the
problem I was seeing, but adding back VM_DONTDUMP seems like a sane
thing to do so I'm doing that too.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786; https://git.kernel.org/stable/c/8e2b7fe5e8a4be5e571561d9afcfbd92097288ba; https://git.kernel.org/stable/c/3466d9e217b337bf473ee629c608e53f9f3ab786
CVE: CVE-2021-47532
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/devfreq: Fix OPP refcnt leak
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/59ba1b2b[PII_REDACTED]300f66d785764be3fcb093; https://git.kernel.org/stable/c/a4eb55901df1dce8c6944438bbdf57caf08911e2; https://git.kernel.org/stable/c/59ba1b2b[PII_REDACTED]300f66d785764be3fcb093
CVE: CVE-2021-47533
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: kms: Clear the HVS FIFO commit pointer once done

Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a
commit") introduced a wait on the previous commit done on a given HVS
FIFO.

However, we never cleared that pointer once done. Since
drm_crtc_commit_put can free the drm_crtc_commit structure directly if
we were the last user, this means that it can lead to a use-after free
if we were to duplicate the state, and that stale pointer would even be
copied to the new state.

Set the pointer to NULL once we're done with the wait so that we don't
carry over a pointer to a free'd structure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89; https://git.kernel.org/stable/c/d134c5ff71c7f2320fc7997f2fbbdedf0c76889a; https://git.kernel.org/stable/c/2931db9a5ed219546cf2ae0546698faf78281b89
CVE: CVE-2021-47534
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/vc4: kms: Add missing drm_crtc_commit_put

Commit 9ec03d7f1ed3 ("drm/vc4: kms: Wait on previous FIFO users before a
commit") introduced a global state for the HVS, with each FIFO storing
the current CRTC commit so that we can properly synchronize commits.

However, the refcounting was off and we thus ended up leaking the
drm_crtc_commit structure every commit. Add a drm_crtc_commit_put to
prevent the leakage.
CVSS Score: 4.1 (MEDIUM)
References: https://git.kernel.org/stable/c/049cfff8d53a30cae3349ff71a4c01b7d9981bc2; https://git.kernel.org/stable/c/53f9601e908d42481addd67cdb01a9288c611124; https://git.kernel.org/stable/c/049cfff8d53a30cae3349ff71a4c01b7d9981bc2
CVE: CVE-2021-47535
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/a6xx: Allocate enough space for GMU registers

In commit 142639a52a01 ("drm/msm/a6xx: fix crashstate capture for
A650") we changed a6xx_get_gmu_registers() to read 3 sets of
registers. Unfortunately, we didn't change the memory allocation for
the array. That leads to a KASAN warning (this was on the chromeos-5.4
kernel, which has the problematic commit backported to it):

  BUG: KASAN: slab-out-of-bounds in _a6xx_get_gmu_registers+0x144/0x430
  Write of size 8 at addr ffffff80c89432b0 by task A618-worker/209
  CPU: 5 PID: 209 Comm: A618-worker Tainted: G        W         5.4.156-lockdep #22
  Hardware name: Google Lazor Limozeen without Touchscreen (rev5 - rev8) (DT)
  Call trace:
   dump_backtrace+0x0/0x248
   show_stack+0x20/0x2c
   dump_stack+0x128/0x1ec
   print_address_description+0x88/0x4a0
   __kasan_report+0xfc/0x120
   kasan_report+0x10/0x18
   __asan_report_store8_noabort+0x1c/0x24
   _a6xx_get_gmu_registers+0x144/0x430
   a6xx_gpu_state_get+0x330/0x25d4
   msm_gpu_crashstate_capture+0xa0/0x84c
   recover_worker+0x328/0x838
   kthread_worker_fn+0x32c/0x574
   kthread+0x2dc/0x39c
   ret_from_fork+0x10/0x18

  Allocated by task 209:
   __kasan_kmalloc+0xfc/0x1c4
   kasan_kmalloc+0xc/0x14
   kmem_cache_alloc_trace+0x1f0/0x2a0
   a6xx_gpu_state_get+0x164/0x25d4
   msm_gpu_crashstate_capture+0xa0/0x84c
   recover_worker+0x328/0x838
   kthread_worker_fn+0x32c/0x574
   kthread+0x2dc/0x39c
   ret_from_fork+0x10/0x18
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/83e54fcf0b14ca2d869dd37abe1bb6542805f538; https://git.kernel.org/stable/c/b4d25abf9720b69a03465b09d0d62d1998ed6708; https://git.kernel.org/stable/c/d646856a600e8635ba498f20b194219b158626e8
CVE: CVE-2021-47536
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix wrong list_del in smc_lgr_cleanup_early

smc_lgr_cleanup_early() meant to delete the link
group from the link group list, but it deleted
the list head by mistake.

This may cause memory corruption since we didn't
remove the real link group from the list and later
memseted the link group structure.
We got a list corruption panic when testing:

[  231.277259] list_del corruption. prev->next should be ffff8881398a8000, but was [PII_REDACTED]
[  231.278222] ------------[ cut here ]------------
[  231.278726] kernel BUG at lib/list_debug.c:53!
[  231.279326] invalid opcode: 0000 [#1] SMP NOPTI
[  231.279803] CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.10.46+ #435
[  231.280466] Hardware name: Alibaba Cloud ECS, BIOS 8c24b4c 04/01/2014
[  231.281248] Workqueue: events smc_link_down_work
[  231.281732] RIP: 0010:__list_del_entry_valid+0x70/0x90
[  231.282258] Code: 4c 60 82 e8 7d cc 6a 00 0f 0b 48 89 fe 48 c7 c7 88 4c
60 82 e8 6c cc 6a 00 0f 0b 48 89 fe 48 c7 c7 c0 4c 60 82 e8 5b cc 6a 00 <0f>
0b 48 89 fe 48 c7 c7 00 4d 60 82 e8 4a cc 6a 00 0f 0b cc cc cc
[  231.284146] RSP: 0018:ffffc90000033d58 EFLAGS: 00010292
[  231.284685] RAX: [PII_REDACTED] RBX: ffff8881398a8000 RCX: [PII_REDACTED]
[  231.285415] RDX: [PII_REDACTED] RSI: ffff88813bc18040 RDI: ffff88813bc18040
[  231.286141] RBP: ffffffff8305ad40 R08: [PII_REDACTED] R09: [PII_REDACTED]
[  231.286873] R10: ffffffff82803da0 R11: ffffc90000033b90 R12: [PII_REDACTED]
[  231.287606] R13: [PII_REDACTED] R14: ffff8881398a8000 R15: [PII_REDACTED]
[  231.288337] FS:  [PII_REDACTED](0000) GS:ffff88813bc00000(0000) knlGS:[PII_REDACTED]
[  231.289160] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[  231.289754] CR2:[PII_REDACTED]e72058 CR3: 000000010fa96006 CR4:[PII_REDACTED]3706f0
[  231.290485] DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
[  231.291211] DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
[  231.291940] Call Trace:
[  231.292211]  smc_lgr_terminate_sched+0x53/0xa0
[  231.292677]  smc_switch_conns+0x75/0x6b0
[  231.293085]  ? update_load_avg+0x1a6/0x590
[  231.293517]  ? ttwu_do_wakeup+0x17/0x150
[  231.293907]  ? update_load_avg+0x1a6/0x590
[  231.294317]  ? newidle_balance+0xca/0x3d0
[  231.294716]  smcr_link_down+0x50/0x1a0
[  231.295090]  ? __wake_up_common_lock+0x77/0x90
[  231.295534]  smc_link_down_work+0x46/0x60
[  231.295933]  process_one_work+0x18b/0x350
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/77731fede297a23d26f2d169b4269466b2c82529; https://git.kernel.org/stable/c/789b6cc2a5f9123b9c549b886fdc47c865cfe0ba; https://git.kernel.org/stable/c/95518fe354d712dca6f431cf2a11b8f63bc9a66c
CVE: CVE-2021-47537
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

octeontx2-af: Fix a memleak bug in rvu_mbox_init()

In rvu_mbox_init(), mbox_regions is not freed or passed out
under the switch-default region, which could lead to a memory leak.

Fix this bug by changing 'return err' to 'goto free_regions'.

This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.

Builds with CONFIG_OCTEONTX2_AF=y show no new warnings,
and our static analyzer no longer warns about this code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1c0ddef45b7e3dbe3ed073695d20faa572b7056a; https://git.kernel.org/stable/c/e07a097b4986afb8f925d0bb32612e1d3e88ce15; https://git.kernel.org/stable/c/1c0ddef45b7e3dbe3ed073695d20faa572b7056a
CVE: CVE-2021-47538
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()

Need to call rxrpc_put_local() for peer candidate before kfree() as it
holds a ref to rxrpc_local.

[DH: v2: Changed to abstract the peer freeing code out into a function]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3e70e3a72d80b16094faccbe438cd53761c3503a; https://git.kernel.org/stable/c/60f0b9c42cb80833a03ca57c1c8b078d716e71d1; https://git.kernel.org/stable/c/913c24af2d13a3fd304462916ee98e298d56bdce
CVE: CVE-2021-47539
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix rxrpc_peer leak in rxrpc_look_up_bundle()

Need to call rxrpc_put_peer() for bundle candidate before kfree() as it
holds a ref to rxrpc_peer.

[DH: v2: Changed to abstract out the bundle freeing code into a function]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/35b40f724c4ef0f683d94dab3af9ab38261d782b; https://git.kernel.org/stable/c/bc97458620e38961af9505cc060ad4cf5c9e4af7; https://git.kernel.org/stable/c/ca77fba[PII_REDACTED]77b236ce749d7c4d353102e
CVE: CVE-2021-47541
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources()

In mlx4_en_try_alloc_resources(), mlx4_en_copy_priv() is called and
tmp->tx_cq will be freed on the error path of mlx4_en_copy_priv().
After that mlx4_en_alloc_resources() is called and there is a dereference
of &tmp->tx_cq[t][i] in mlx4_en_alloc_resources(), which could lead to
a use after free problem on failure of mlx4_en_copy_priv().

Fix this bug by adding a check of mlx4_en_copy_priv()

This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.

Builds with CONFIG_MLX4_EN=m show no new warnings,
and our static analyzer no longer warns about this code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/676dc7d9b15bf8733233a2db1ec3f9091ab34275; https://git.kernel.org/stable/c/75917372eef0dbfb290ae45474314d35f97aea18; https://git.kernel.org/stable/c/addad7643142f500080417dd7272f49b7a185570
CVE: CVE-2021-47542
Published: 2024-05-24
Description: In the Linux kernel, the following vulnerability has been resolved:

net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings()

In qlcnic_83xx_add_rings(), the indirect function of
ahw->hw_ops->alloc_mbx_args will be called to allocate memory for
cmd.req.arg, and there is a dereference of it in qlcnic_83xx_add_rings(),
which could lead to a NULL pointer dereference on failure of the
indirect function like qlcnic_83xx_alloc_mbx_args().

Fix this bug by adding a check of alloc_mbx_args(), this patch
imitates the logic of mbx_cmd()'s failure handling.

This bug was found by a static analyzer. The analysis employs
differential checking to identify inconsistent security operations
(e.g., checks or kfrees) between two code paths and confirms that the
inconsistent operations are not recovered in the current function or
the callers, so they constitute bugs.

Note that, as a bug found by static analysis, it can be a false
positive or hard to trigger. Multiple researchers have cross-reviewed
the bug.

Builds with CONFIG_QLCNIC=m show no new warnings, and our
static analyzer no longer warns about this code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/15fa12c119f869173f9b710cbe6a4a14071d2105; https://git.kernel.org/stable/c/3a061d54e260b701b538873b43e399d9b8b83e03; https://git.kernel.org/stable/c/550658a2d61e4eaf522c8ebc7fad76dc376bfb45
CVE: CVE-2021-47543
Published: 2024-05-24
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.