deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-47654
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

samples/landlock: Fix path_list memory leak

Clang static analysis reports this error

sandboxer.c:134:8: warning: Potential leak of memory
  pointed to by 'path_list'
        ret = 0;
              ^
path_list is allocated in parse_path() but never freed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/[PII_REDACTED]99ccd6eed24bbfabed8af4ffd81530; https://git.kernel.org/stable/c/20fbf100f84b9aeb9c91421abe1927bc152bc32b; https://git.kernel.org/stable/c/49b0d8bf05809df5f87e5c03e26d74bdfdab4571
CVE: CVE-2021-47655
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

media: venus: vdec: fixed possible memory leak issue

The venus_helper_alloc_dpb_bufs() implementation allows an early return
on an error path when checking the id from ida_alloc_min() which would
not release the earlier buffer allocation.

Move the direct kfree() from the error checking of dma_alloc_attrs() to
the common fail path to ensure that allocations are released on all
error paths in this function.

Addresses-Coverity: 1494120 ("Resource leak")
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/55bccafc246b2e64763a155ec454470c07a54a6e; https://git.kernel.org/stable/c/5cedfe8aaf1875a[PII_REDACTED]b7f298db4260019; https://git.kernel.org/stable/c/5f89d05ba93df9c2cdfe493843f93288e55e99eb
CVE: CVE-2021-47657
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()

If virtio_gpu_object_shmem_init() fails (e.g. due to fault injection, as it
happened in the bug report by syzbot), virtio_gpu_array_put_free() could be
called with objs equal to NULL.

Ensure that objs is not NULL in virtio_gpu_array_put_free(), or otherwise
return from the function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/6b79f96f4a23846516e5e6e4dd37fc06f43a60dd; https://git.kernel.org/stable/c/abc9ad36df16e27ac1c665085157f1a082d39bac; https://git.kernel.org/stable/c/ac92b474eeeed75b8660374ba1d129a121c09da8
CVE: CVE-2021-47658
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: fix a potential gpu_metrics_table memory leak

Memory is allocated for gpu_metrics_table in renoir_init_smc_tables(),
but not freed in int smu_v12_0_fini_smc_tables(). Free it!
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/583637d66a70fc7090e12fb0ebbacc33d39e2214
CVE: CVE-2021-47659
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/plane: Move range check for format_count earlier

While the check for format_count > 64 in __drm_universal_plane_init()
shouldn't be hit (it's a WARN_ON), in its current position it will then
leak the plane->format_types array and fail to call
drm_mode_object_unregister() leaking the modeset identifier. Move it to
the start of the function to avoid allocating those resources in the
first place.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1e29d829ad51d1472dd035487953a6724b56fc33; https://git.kernel.org/stable/c/4ab7e453a3ee88c274cf97bee9487ab92a66d313; https://git.kernel.org/stable/c/4b674dd69701c2e22e8e7770c1706a69f3b17269
CVE: CVE-2021-47660
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()'

All error handling paths lead to 'out' where many resources are freed.

Do it as well here instead of a direct return, otherwise 'log', 'ra' and
'log->one_page_buf' (at least) will leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/2c97519ed6b4239594c58ddacf3d0d576cf070cc; https://git.kernel.org/stable/c/bc4a1d384a04c6dba9312e1421a9f9f7c03339a4; https://git.kernel.org/stable/c/d8be98ab88250dc12a98efdb703792a537b0eac3
CVE: CVE-2021-4453
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: fix a potential gpu_metrics_table memory leak

Memory is allocated for gpu_metrics_table in renoir_init_smc_tables(),
but not freed in int smu_v12_0_fini_smc_tables(). Free it!
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/222cebd995cdf11fe0d502749560f65e64990e55; https://git.kernel.org/stable/c/257b3bb16634fd936129fe2f57a91594a75b8751; https://git.kernel.org/stable/c/aa464957f7e660abd554f2546a588f6533720e21
CVE: CVE-2022-49044
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

dm integrity: fix memory corruption when tag_size is less than digest size

It is possible to set up dm-integrity in such a way that the
"tag_size" parameter is less than the actual digest size. In this
situation, a part of the digest beyond tag_size is ignored.

In this case, dm-integrity would write beyond the end of the
ic->recalc_tags array and corrupt memory. The corruption happened in
integrity_recalc->integrity_sector_checksum->crypto_shash_final.

Fix this corruption by increasing the tags array so that it has enough
padding at the end to accomodate the loop in integrity_recalc() being
able to write a full digest size for the last member of the tags
array.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/08c1af8f1c13bbf210f1760132f4df24d0ed46d6; https://git.kernel.org/stable/c/4d485cf9b609709e45d5113e6e2b1b01254b2fe9; https://git.kernel.org/stable/c/6a95d91c0b315c965198f6ab7dec7c94129e17e0
CVE: CVE-2022-49045
Published: 2025-02-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-49046
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

i2c: dev: check return value when calling dev_set_name()

If dev_set_name() fails, the dev_name() is null, check the return
value of dev_set_name() to avoid the null-ptr-deref.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/2e539b17d4cbe5fb8b5152dd9a6e4a8828f97db2; https://git.kernel.org/stable/c/2f345bb14ad[PII_REDACTED]ff222e[PII_REDACTED]afa; https://git.kernel.org/stable/c/993eb48fa199b5f476df8204e652eff63dd19361
CVE: CVE-2022-49047
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ep93xx: clock: Fix UAF in ep93xx_clk_register_gate()

arch/arm/mach-ep93xx/clock.c:154:2: warning: Use of memory after it is freed [clang-analyzer-unix.Malloc]
arch/arm/mach-ep93xx/clock.c:151:2: note: Taking true branch
if (IS_ERR(clk))
^
arch/arm/mach-ep93xx/clock.c:152:3: note: Memory is released
kfree(psc);
^~~~~~~~~~
arch/arm/mach-ep93xx/clock.c:154:2: note: Use of memory after it is freed
return &psc->hw;
^ ~~~~~~~~
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0f12166872da46c6b57ba2f1314bbf310b3bf017; https://git.kernel.org/stable/c/3b68b08885217abd9c57ff9b3bb3eb173eee02a9
CVE: CVE-2022-49048
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix panic when forwarding a pkt with no in6 dev

kongweibin reported a kernel panic in ip6_forward() when input interface
has no in6 dev associated.

The following tc commands were used to reproduce this panic:
tc qdisc del dev vxlan100 root
tc qdisc add dev vxlan100 root netem corrupt 5%
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/74b68f5249f16c5f7f675d0f604fa6ae20e3a151; https://git.kernel.org/stable/c/a263712ba8c9ded25dd9d2d5ced11bcea5b33a3e; https://git.kernel.org/stable/c/ab2f5afb7af5c68389e8c7dd29e0a98fbeaaa435
CVE: CVE-2022-49050
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

memory: renesas-rpc-if: fix platform-device leak in error path

Make sure to free the flash platform device in the event that
registration fails during probe.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/05d1824a7fb43ab9adb1eb82404954af81d8c984; https://git.kernel.org/stable/c/66b9b707ea4dcafca92b6261c[PII_REDACTED]e3b73; https://git.kernel.org/stable/c/b452dbf24d7d9a990d[PII_REDACTED]5f6ee287d135
CVE: CVE-2022-49051
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net: usb: aqc111: Fix out-of-bounds accesses in RX fixup

aqc111_rx_fixup() contains several out-of-bounds accesses that can be
triggered by a malicious (or defective) USB device, in particular:

 - The metadata array (desc_offset..desc_offset+2*pkt_count) can be out of bounds,
   causing OOB reads and (on big-endian systems) OOB endianness flips.
 - A packet can overlap the metadata array, causing a later OOB
   endianness flip to corrupt data used by a cloned SKB that has already
   been handed off into the network stack.
 - A packet SKB can be constructed whose tail is far beyond its end,
   causing out-of-bounds heap data to be considered part of the SKB's
   data.

Found doing variant analysis. Tested it with another driver (ax88179_178a), since
I don't have a aqc111 device to test it, but the code looks very similar.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://git.kernel.org/stable/c/36311fe98f55dea9200c69e2dd6d6ddb8fc94080; https://git.kernel.org/stable/c/404998a137bcb8a926f7c949030afbe285472593; https://git.kernel.org/stable/c/afb8e[PII_REDACTED]48b9b4025b40e613edf776a9d
CVE: CVE-2022-49052
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

mm: fix unexpected zeroed page mapping with zram swap

Two processes under CLONE_VM cloning, user process can be corrupted by
seeing zeroed page unexpectedly.

      CPU A                        CPU B

  do_swap_page                do_swap_page
  SWP_SYNCHRONOUS_IO path     SWP_SYNCHRONOUS_IO path
  swap_readpage valid data
    swap_slot_free_notify
      delete zram entry
                              swap_readpage zeroed(invalid) data
                              pte_lock
                              map the *zero data* to userspace
                              pte_unlock
  pte_lock
  if (!pte_same)
    goto out_nomap;
  pte_unlock
  return and next refault will
  read zeroed data

The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't
increase the refcount of swap slot at copy_mm so it couldn't catch up
whether it's safe or not to discard data from backing device.  In the
case, only the lock it could rely on to synchronize swap slot freeing is
page table lock.  Thus, this patch gets rid of the swap_slot_free_notify
function.  With this patch, CPU A will see correct data.

      CPU A                        CPU B

  do_swap_page                do_swap_page
  SWP_SYNCHRONOUS_IO path     SWP_SYNCHRONOUS_IO path
                              swap_readpage original data
                              pte_lock
                              map the original data
                              swap_free
                                swap_range_free
                                  bd_disk->fops->swap_slot_free_notify
  swap_readpage read zeroed data
                              pte_unlock
  pte_lock
  if (!pte_same)
    goto out_nomap;
  pte_unlock
  return
  on next refault will see mapped data by CPU B

The concern of the patch would increase memory consumption since it
could keep wasted memory with compressed form in zram as well as
uncompressed form in address space.  However, most of cases of zram uses
no readahead and do_swap_page is followed by swap_free so it will free
the compressed form from in zram quickly.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/12ba1d38115a101c45d8e0ca3aa1181fd148e57f; https://git.kernel.org/stable/c/20ed94f8181a25212e7404e44958e234f407624b; https://git.kernel.org/stable/c/afac4b88699a06c8b9369f9d759a1ec3c254b788
CVE: CVE-2022-49053
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: target: tcmu: Fix possible page UAF

tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not
take refcount properly and just returns page pointer. When
tcmu_try_get_data_page() returns, the returned page may have been freed by
tcmu_blocks_release().

We need to get_page() under cmdr_lock to avoid concurrent
tcmu_blocks_release().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/a6968f7a367f128d[PII_REDACTED]4344d5a3d5336; https://git.kernel.org/stable/c/a9564d84ed9f6ee71017d062d0d[PII_REDACTED]a4b; https://git.kernel.org/stable/c/aec36b98a1bbaa84bfd8299a306e4c12314af626
CVE: CVE-2022-49054
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated guests

hv_panic_page might contain guest-sensitive information, do not dump it
over to Hyper-V by default in isolated guests.

While at it, update some comments in hyperv_{panic,die}_event().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1b576e81d31b56b248316b8ff816b1cc5c4407c7; https://git.kernel.org/stable/c/6230bc50d6d21cae4c084766623d0a6d17958721; https://git.kernel.org/stable/c/9f8b577f7b43b2170628d6c537252785dcc2dcea
CVE: CVE-2022-49055
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Check for potential null return of kmalloc_array()

As the kmalloc_array() may return null, the 'event_waiters[i].wait' would lead to null-pointer dereference.
Therefore, it is better to check the return value of kmalloc_array() to avoid this confusion.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/0a692c625e373fef692ffbc7fc41f8a025f01cb7; https://git.kernel.org/stable/c/1d7a5aae884ca727d41c7ed15d4c82fdb67c040c; https://git.kernel.org/stable/c/32cf90a521dcc0f136db7ee5ba32bfe5f79e460e
CVE: CVE-2022-49056
Published: 2025-02-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-49057
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

block: null_blk: end timed out poll request

When poll request is timed out, it is removed from the poll list,
but not completed, so the request is leaked, and never get chance
to complete.

Fix the issue by ending it in timeout handler.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3e3876d322aef82416ecc496a4d4a587e0fdf7a3; https://git.kernel.org/stable/c/407d09a22f3f685fd634aa5d05840c64b23bfebc
CVE: CVE-2022-49058
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

cifs: potential buffer overflow in handling symlinks

Smatch printed a warning:
	arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error:
	__memcpy() 'dctx->buf' too small (16 vs u32max)

It's caused because Smatch marks 'link_len' as untrusted since it comes
from sscanf(). Add a check to ensure that 'link_len' is not larger than
the size of the 'link_str' buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://git.kernel.org/stable/c/1316c28569a80ab3596eeab05bf5e01991e7e739; https://git.kernel.org/stable/c/22d658c6c5affed10c8907e67160cef0b6c92186; https://git.kernel.org/stable/c/3e582749e742e662a8e9bb37cffac62dccaaa1e2
CVE: CVE-2022-49060
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()

dev_name() was called with dev.parent as argument but without to
NULL-check it before.
Solve this by checking the pointer before the call to dev_name().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/22025513ced3d599ee8b24169141c95cf2467a4a; https://git.kernel.org/stable/c/35b91e49bc80ca944a8679c3b139ddaf2f8eea0f; https://git.kernel.org/stable/c/3a523807f01455fe9a0c1a433f27cd4411ee400f
CVE: CVE-2022-49061
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link

When using a fixed-link, the altr_tse_pcs driver crashes
due to null-pointer dereference as no phy_device is provided to
tse_pcs_fix_mac_speed function. Fix this by adding a check for
phy_dev before calling the tse_pcs_fix_mac_speed() function.

Also clean up the tse_pcs_fix_mac_speed function a bit. There is
no need to check for splitter_base and sgmii_adapter_base
because the driver will fail if these 2 variables are not
derived from the device tree.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/08d5e3e954537931c8da[PII_REDACTED]d202e98299; https://git.kernel.org/stable/c/62a48383ebe2e159fd68425dd3e16d4c6bd6599a; https://git.kernel.org/stable/c/6c020f05253df04c3480b586fe188a[PII_REDACTED]
CVE: CVE-2022-49062
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr

Use the actual length of volume coherency data when setting the
xattr to avoid the following KASAN report.

 BUG: KASAN: slab-out-of-bounds in cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]
 Write of size 4 at addr ffff888101e02af4 by task kworker/6:0/1347

 CPU: 6 PID: 1347 Comm: kworker/6:0 Kdump: loaded Not tainted 5.18.0-rc1-nfs-fscache-netfs+ #13
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-4.fc34 04/01/2014
 Workqueue: events fscache_create_volume_work [fscache]
 Call Trace:
  <TASK>
  dump_stack_lvl+0x45/0x5a
  print_report.cold+0x5e/0x5db
  ? __lock_text_start+0x8/0x8
  ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]
  kasan_report+0xab/0x120
  ? cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]
  kasan_check_range+0xf5/0x1d0
  memcpy+0x39/0x60
  cachefiles_set_volume_xattr+0xa0/0x350 [cachefiles]
  cachefiles_acquire_volume+0x2be/0x500 [cachefiles]
  ? __cachefiles_free_volume+0x90/0x90 [cachefiles]
  fscache_create_volume_work+0x68/0x160 [fscache]
  process_one_work+0x3b7/0x6a0
  worker_thread+0x2c4/0x650
  ? process_one_work+0x6a0/0x6a0
  kthread+0x16c/0x1a0
  ? kthread_complete_and_exit+0x20/0x20
  ret_from_fork+0x22/0x30
  </TASK>

 Allocated by task 1347:
  kasan_save_stack+0x1e/0x40
  __kasan_kmalloc+0x81/0xa0
  cachefiles_set_volume_xattr+0x76/0x350 [cachefiles]
  cachefiles_acquire_volume+0x2be/0x500 [cachefiles]
  fscache_create_volume_work+0x68/0x160 [fscache]
  process_one_work+0x3b7/0x6a0
  worker_thread+0x2c4/0x650
  kthread+0x16c/0x1a0
  ret_from_fork+0x22/0x30

 The buggy address belongs to the object at ffff888101e02af0
 which belongs to the cache kmalloc-8 of size 8
 The buggy address is located 4 bytes inside of
 8-byte region [ffff888101e02af0, ffff888101e02af8)

 The buggy address belongs to the physical page:
 page:00000000a2292d70 refcount:1 mapcount:0 mapping:[PII_REDACTED] index:0x0 pfn:0x101e02
 flags: 0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff)
 raw: 0017ffffc0000200 [PII_REDACTED] dead[PII_REDACTED]01 ffff[PII_REDACTED]80
 raw: [PII_REDACTED] [PII_REDACTED] 00000001ffffffff [PII_REDACTED]
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
 ffff888101e02980: fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc
 ffff888101e02a00: 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00
 >ffff888101e02a80: fc fc fc fc 00 fc fc fc fc 00 fc fc fc fc 04 fc
                                                            ^
 ffff888101e02b00: fc fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc
 ffff888101e02b80: fc fc 00 fc fc fc fc 00 fc fc fc fc 00 fc fc fc
 ==================================================================
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://git.kernel.org/stable/c/09a5df1b88c8f126c8ff9938edf160edd4e92f42; https://git.kernel.org/stable/c/7b2f6c[PII_REDACTED]35c72caa61f682e74d4591b2
CVE: CVE-2022-49064
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

cachefiles: unmark inode in use in error path

Unmark inode in use if error encountered. If the in-use flag leakage
occurs in cachefiles_open_file(), Cachefiles will complain "Inode
already in use" when later another cookie with the same index key is
looked up.

If the in-use flag leakage occurs in cachefiles_create_tmpfile(), though
the "Inode already in use" warning won't be triggered, fix the leakage
anyway.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/b2055abafd3d4ee0376fb3eed5cae866316995a1; https://git.kernel.org/stable/c/ea5dc046127e857a7873ae55fd57c866e9e86fb2
CVE: CVE-2022-49065
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: Fix the svc_deferred_event trace class

Fix a NULL deref crash that occurs when an svc_rqst is deferred
while the sunrpc tracing subsystem is enabled. svc_revisit() sets
dr->xprt to NULL, so it can't be relied upon in the tracepoint to
provide the remote's address.

Unfortunately we can't revert the "svc_deferred_class" hunk in
commit ece200ddd54b ("sunrpc: Save remote presentation address in
svc_xprt for trace events") because there is now a specific check
of event format specifiers for unsafe dereferences. The warning
that check emits is:

  event svc_defer_recv has unsafe dereference of argument 1

A "%pISpc" format specifier with a "struct sockaddr *" is indeed
flagged by this check.

Instead, take the brute-force approach used by the svcrdma_qp_error
tracepoint. Convert the dr::addr field into a presentation address
in the TP_fast_assign() arm of the trace event, and store that as
a string. This fix can be backported to -stable kernels.

In the meantime, commit c6ced22997ad ("tracing: Update print fmt
check to handle new __get_sockaddr() macro") is now in v5.18, so
this wonky fix can be replaced with __sockaddr() and friends
properly during the v5.19 merge window.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/4d5004451ab2218eab94a30e1841462c9316ba19; https://git.kernel.org/stable/c/726ae7300fcc25fefa46d188cc07eb16dc908f9e; https://git.kernel.org/stable/c/85ee17ca21cf92989e8c923e3ea4514c291e9d38
CVE: CVE-2022-49066
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

veth: Ensure eth header is in skb's linear part

After feeding a decapsulated packet to a veth device with act_mirred,
skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(),
which expects at least ETH_HLEN byte of linear data (as
__dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes
unconditionally).

Use pskb_may_pull() to ensure veth_xmit() respects this constraint.

kernel BUG at include/linux/skbuff.h:2328!
RIP: 0010:eth_type_trans+0xcf/0x140
Call Trace:
 <IRQ>
 __dev_forward_skb2+0xe3/0x160
 veth_xmit+0x6e/0x250 [veth]
 dev_hard_start_xmit+0xc7/0x200
 __dev_queue_xmit+0x47f/0x520
 ? skb_ensure_writable+0x85/0xa0
 ? skb_mpls_pop+0x98/0x1c0
 tcf_mirred_act+0x442/0x47e [act_mirred]
 tcf_action_exec+0x86/0x140
 fl_classify+0x1d8/0x1e0 [cls_flower]
 ? dma_pte_clear_level+0x129/0x1a0
 ? dma_pte_clear_level+0x129/0x1a0
 ? prb_fill_curr_block+0x2f/0xc0
 ? skb_copy_bits+0x11a/0x220
 __tcf_classify+0x58/0x110
 tcf_classify_ingress+0x6b/0x140
 __netif_receive_skb_core.constprop.0+0x47d/0xfd0
 ? __iommu_dma_unmap_swiotlb+0x44/0x90
 __netif_receive_skb_one_core+0x3d/0xa0
 netif_receive_skb+0x116/0x170
 be_process_rx+0x22f/0x330 [be2net]
 be_poll+0x13c/0x370 [be2net]
 __napi_poll+0x2a/0x170
 net_rx_action+0x22f/0x2f0
 __do_softirq+0xca/0x2a8
 __irq_exit_rcu+0xc1/0xe0
 common_interrupt+0x83/0xa0
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1ef0088e43af1de4e3b365218c4d3179d9a37eec; https://git.kernel.org/stable/c/2fd90b86dff413fbf8128780c04ea9c6849c16e2; https://git.kernel.org/stable/c/3de2a02b60a4ef0ab76263216f08c7d095fc7c42