deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-26877
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: xilinx - call finalize with bh disabled

When calling crypto_finalize_request, BH should be disabled to avoid
triggering the following calltrace:

    ------------[ cut here ]------------
    WARNING: CPU: 2 PID: 74 at crypto/crypto_engine.c:58 crypto_finalize_request+0xa0/0x118
    Modules linked in: cryptodev(O)
    CPU: 2 PID: 74 Comm: firmware:zynqmp Tainted: G           O       6.8.0-rc1-yocto-standard #323
    Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
    pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
    pc : crypto_finalize_request+0xa0/0x118
    lr : crypto_finalize_request+0x104/0x118
    sp : ffffffc085353ce0
    x29: ffffffc085353ce0 x28: [PII_REDACTED] x27: ffffff8808ea8688
    x26: ffffffc081715038 x25: [PII_REDACTED] x24: ffffff880100db00
    x23: ffffff880100da80 x22: [PII_REDACTED] x21: [PII_REDACTED]
    x20: ffffff8805b14000 x19: ffffff880100da80 x18: [PII_REDACTED]
    x17: [PII_REDACTED] x16: [PII_REDACTED] x15: [PII_REDACTED]
    x14: [PII_REDACTED] x13: [PII_REDACTED] x12: ffffff880100dad0
    x11: [PII_REDACTED] x10: ffffffc0832dcd08 x9 : ffffffc0812416d8
    x8 :[PII_REDACTED]0001f4 x7 : ffffffc0830d2830 x6 : [PII_REDACTED]
    x5 : ffffffc082091000 x4 : ffffffc082091658 x3 : [PII_REDACTED]
    x2 : ffffffc7f9653000 x1 : [PII_REDACTED] x0 : ffffff8802d20000
    Call trace:
     crypto_finalize_request+0xa0/0x118
     crypto_finalize_aead_request+0x18/0x30
     zynqmp_handle_aes_req+0xcc/0x388
     crypto_pump_work+0x168/0x2d8
     kthread_worker_fn+0xfc/0x3a0
     kthread+0x118/0x138
     ret_from_fork+0x10/0x20
    irq event stamp: 40
    hardirqs last  enabled at (39): [<ffffffc0812416f8>] _raw_spin_unlock_irqrestore+0x70/0xb0
    hardirqs last disabled at (40): [<ffffffc08122d208>] el1_dbg+0x28/0x90
    softirqs last  enabled at (36): [<ffffffc080017dec>] kernel_neon_begin+0x8c/0xf0
    softirqs last disabled at (34): [<ffffffc080017dc0>] kernel_neon_begin+0x60/0xf0
    ---[ end trace [PII_REDACTED] ]---
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/03e6d4e948432a61b35783323b6ab2be071d2619; https://git.kernel.org/stable/c/23bc89fdce71124cd2126fc919c7076e7cb489cf; https://git.kernel.org/stable/c/8a01335aedc50a66d04dd39203c89f4bc8042596
CVE: CVE-2024-26878
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

quota: Fix potential NULL pointer dereference

Below race may cause NULL pointer dereference

P1					P2
dquot_free_inode			quota_off
					  drop_dquot_ref
					   remove_dquot_ref
					   dquots = i_dquot(inode)
  dquots = i_dquot(inode)
  srcu_read_lock
  dquots[cnt]) != NULL (1)
					     dquots[type] = NULL (2)
  spin_lock(&dquots[cnt]->dq_dqb_lock) (3)
   ....

If dquot_free_inode(or other routines) checks inode's quota pointers (1)
before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer
dereference will be triggered.

So let's fix it by using a temporary pointer to avoid this issue.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-476
References: https://git.kernel.org/stable/c/1ca72a3de915f87232c9a4cb9bebbd3af8ed3e25; https://git.kernel.org/stable/c/40a673b4b07efd6f74ff3ab60f38b26aa91ee5d5; https://git.kernel.org/stable/c/49669f8e7eb053f91d239df7b1bfb4500255a9d0
CVE: CVE-2024-26879
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: meson: Add missing clocks to axg_clk_regmaps

Some clocks were missing from axg_clk_regmaps, which caused kernel panic
during cat /sys/kernel/debug/clk/clk_summary

[   57.349402] Unable to handle kernel NULL pointer dereference at virtual address[PII_REDACTED]0001fc
...
[   57.430002] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   57.436900] pc : regmap_read+0x1c/0x88
[   57.440608] lr : clk_regmap_gate_is_enabled+0x3c/0xb0
[   57.445611] sp : ffff800082f1b690
[   57.448888] x29: ffff800082f1b690 x28: [PII_REDACTED] x27: ffff800080eb9a70
[   57.455961] x26: [PII_REDACTED] x25: [PII_REDACTED] x24: [PII_REDACTED]
[   57.463033] x23: ffff800080e8b488 x22: [PII_REDACTED] x21: ffff00000e7e7000
[   57.470106] x20: ffff00000400ec00 x19: [PII_REDACTED] x18: ffffffffffffffff
[   57.477178] x17: [PII_REDACTED] x16: [PII_REDACTED] x15: ffff0000042a3000
[   57.484251] x14: [PII_REDACTED] x13: ffff0000042a2fec x12:[PII_REDACTED]f5e100
[   57.491323] x11: abcc77118461cefd x10: [PII_REDACTED] x9 : ffff8000805e4b24
[   57.498396] x8 : ffff[PII_REDACTED]c0 x7 : ffff800082f1b710 x6 : ffff800082f1b710
[   57.505468] x5 : 00000000ffffffd0 x4 : ffff800082f1b6e0 x3 : [PII_REDACTED]
[   57.512541] x2 : ffff800082f1b6e4 x1 :[PII_REDACTED]00012c x0 : [PII_REDACTED]
[   57.519615] Call trace:
[   57.522030]  regmap_read+0x1c/0x88
[   57.525393]  clk_regmap_gate_is_enabled+0x3c/0xb0
[   57.530050]  clk_core_is_enabled+0x44/0x120
[   57.534190]  clk_summary_show_subtree+0x154/0x2f0
[   57.538847]  clk_summary_show_subtree+0x220/0x2f0
[   57.543505]  clk_summary_show_subtree+0x220/0x2f0
[   57.548162]  clk_summary_show_subtree+0x220/0x2f0
[   57.552820]  clk_summary_show_subtree+0x220/0x2f0
[   57.557477]  clk_summary_show_subtree+0x220/0x2f0
[   57.562135]  clk_summary_show_subtree+0x220/0x2f0
[   57.566792]  clk_summary_show_subtree+0x220/0x2f0
[   57.571450]  clk_summary_show+0x84/0xb8
[   57.575245]  seq_read_iter+0x1bc/0x4b8
[   57.578954]  seq_read+0x8c/0xd0
[   57.582059]  full_proxy_read+0x68/0xc8
[   57.585767]  vfs_read+0xb0/0x268
[   57.588959]  ksys_read+0x70/0x108
[   57.592236]  __arm64_sys_read+0x24/0x38
[   57.596031]  invoke_syscall+0x50/0x128
[   57.599740]  el0_svc_common.constprop.0+0x48/0xf8
[   57.604397]  do_el0_svc+0x28/0x40
[   57.607675]  el0_svc+0x34/0xb8
[   57.610694]  el0t_64_sync_handler+0x13c/0x158
[   57.615006]  el0t_64_sync+0x190/0x198
[   57.618635] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (b941fc00)
[   57.624668] ---[ end trace [PII_REDACTED] ]---

[jbrunet: add missing Fixes tag]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0cbefc7b5bdad86b18a263d837450cdc9a56f8d7; https://git.kernel.org/stable/c/7ae1b0dc12ec407f12f80b49d22c6ad2308e2202; https://git.kernel.org/stable/c/9f3e5df38b[PII_REDACTED]e55b80f0316864f2a1c8
CVE: CVE-2024-26880
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

dm: call the resume method on internal suspend

There is this reported crash when experimenting with the lvm2 testsuite.
The list corruption is caused by the fact that the postsuspend and resume
methods were not paired correctly; there were two consecutive calls to the
origin_postsuspend function. The second call attempts to remove the
"hash_list" entry from a list, while it was already removed by the first
call.

Fix __dm_internal_resume so that it calls the preresume and resume
methods of the table's targets.

If a preresume method of some target fails, we are in a tricky situation.
We can't return an error because dm_internal_resume isn't supposed to
return errors. We can't return success, because then the "resume" and
"postsuspend" methods would not be paired correctly. So, we set the
DMF_SUSPENDED flag and we fake normal suspend - it may confuse userspace
tools, but it won't cause a kernel crash.

------------[ cut here ]------------
kernel BUG at lib/list_debug.c:56!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 8343 Comm: dmsetup Not tainted 6.8.0-rc6 #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
RIP: 0010:__list_del_entry_valid_or_report+0x77/0xc0
<snip>
RSP: 0018:ffff8881b831bcc0 EFLAGS: 00010282
RAX:[PII_REDACTED]00004e RBX: ffff888143b6eb80 RCX: [PII_REDACTED]
RDX: [PII_REDACTED] RSI: ffffffff819053d0 RDI: 00000000ffffffff
RBP: ffff8881b83a3400 R08: 00000000fffeffff R09: [PII_REDACTED]
R10: [PII_REDACTED] R11: ffffffff81a24080 R12: [PII_REDACTED]
R13: ffff88814538e000 R14: ffff888143bc6dc0 R15: ffffffffa02e4bb0
FS:  00000000f7c0f780(0000) GS:ffff8893f0a40000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 002b ES: 002b CR0: [PII_REDACTED]
CR2:[PII_REDACTED]fb5000 CR3: [PII_REDACTED] CR4:[PII_REDACTED]0006b0
Call Trace:
 <TASK>
 ? die+0x2d/0x80
 ? do_trap+0xeb/0xf0
 ? __list_del_entry_valid_or_report+0x77/0xc0
 ? do_error_trap+0x60/0x80
 ? __list_del_entry_valid_or_report+0x77/0xc0
 ? exc_invalid_op+0x49/0x60
 ? __list_del_entry_valid_or_report+0x77/0xc0
 ? asm_exc_invalid_op+0x16/0x20
 ? table_deps+0x1b0/0x1b0 [dm_mod]
 ? __list_del_entry_valid_or_report+0x77/0xc0
 origin_postsuspend+0x1a/0x50 [dm_snapshot]
 dm_table_postsuspend_targets+0x34/0x50 [dm_mod]
 dm_suspend+0xd8/0xf0 [dm_mod]
 dev_suspend+0x1f2/0x2f0 [dm_mod]
 ? table_deps+0x1b0/0x1b0 [dm_mod]
 ctl_ioctl+0x300/0x5f0 [dm_mod]
 dm_compat_ctl_ioctl+0x7/0x10 [dm_mod]
 __x64_compat_sys_ioctl+0x104/0x170
 do_syscall_64+0x184/0x1b0
 entry_SYSCALL_64_after_hwframe+0x46/0x4e
RIP: 0033:0xf7e6aead
<snip>
---[ end trace [PII_REDACTED] ]---
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/03ad5ad53e51abf3a4c7538c1bc67a5982b41dc5; https://git.kernel.org/stable/c/15a3fc5c8774c17589dabfe1d642d40685c985af; https://git.kernel.org/stable/c/360a7d1be8112654f1fb328ed3862be630bca3f4
CVE: CVE-2024-26881
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

net: hns3: fix kernel crash when 1588 is received on HIP08 devices

The HIP08 devices does not register the ptp devices, so the
hdev->ptp is NULL, but the hardware can receive 1588 messages,
and set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the
access of hdev->ptp->flags will cause a kernel crash:

[ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
[ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
...
[ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]
[ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge]
[ 5889.279101] sp : ffff800012c3bc50
[ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040
[ 5889.289927] x27: ffff[PII_REDACTED]84 x26: [PII_REDACTED]
[ 5889.296333] x25: [PII_REDACTED] x24: ffff204001c6f000
[ 5889.302738] x23: ffff204144f53c00 x22: [PII_REDACTED]
[ 5889.309134] x21: [PII_REDACTED] x20: ffff[PII_REDACTED]80
[ 5889.315520] x19: ffff204144f53c00 x18: [PII_REDACTED]
[ 5889.321897] x17: [PII_REDACTED] x16: [PII_REDACTED]
[ 5889.328263] x15:[PII_REDACTED]140ec8 x14: [PII_REDACTED]
[ 5889.334617] x13: [PII_REDACTED] x12:[PII_REDACTED]0011df
[ 5889.340965] x11: bbfeff4d22000000 x10: [PII_REDACTED]
[ 5889.347303] x9 : ffff[PII_REDACTED]24 x8 : 0200f78811dfbb4d
[ 5889.353637] x7 :[PII_REDACTED]191b01 x6 : ffff208002a7d480
[ 5889.359959] x5 : [PII_REDACTED] x4 : [PII_REDACTED]
[ 5889.366271] x3 : [PII_REDACTED] x2 : [PII_REDACTED]
[ 5889.372567] x1 : [PII_REDACTED] x0 : ffff20400095c080
[ 5889.378857] Call trace:
[ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge]
[ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3]
[ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3]
[ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3]
[ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3]
[ 5889.411084] napi_poll+0xcc/0x264
[ 5889.415329] net_rx_action+0xd4/0x21c
[ 5889.419911] __do_softirq+0x130/0x358
[ 5889.424484] irq_exit+0x134/0x154
[ 5889.428700] __handle_domain_irq+0x88/0xf0
[ 5889.433684] gic_handle_irq+0x78/0x2c0
[ 5889.438319] el1_irq+0xb8/0x140
[ 5889.442354] arch_cpu_idle+0x18/0x40
[ 5889.446816] default_idle_call+0x5c/0x1c0
[ 5889.451714] cpuidle_idle_call+0x174/0x1b0
[ 5889.456692] do_idle+0xc8/0x160
[ 5889.460717] cpu_startup_entry+0x30/0xfc
[ 5889.465523] secondary_start_kernel+0x158/0x1ec
[ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80)
[ 5889.477950] SMP: stopping secondary CPUs
[ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95
[ 5890.522951] Starting crashdump kernel...
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0fbcf2366ba9888cf02eda23e35fde7f7fcc07c3; https://git.kernel.org/stable/c/11b998360d96f6c76f04a95f54b49f24d3c858e4; https://git.kernel.org/stable/c/23ec1cec24293f9799c725941677d4e167997265
CVE: CVE-2024-26883
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix stackmap overflow check on 32-bit arches

The stackmap code relies on roundup_pow_of_two() to compute the number
of hash buckets, and contains an overflow check by checking if the
resulting value is 0. However, on 32-bit arches, the roundup code itself
can overflow by doing a 32-bit left-shift of an unsigned long value,
which is undefined behaviour, so it is not guaranteed to truncate
neatly. This was triggered by syzbot on the DEVMAP_HASH type, which
contains the same check, copied from the hashtab code.

The commit in the fixes tag actually attempted to fix this, but the fix
did not account for the UB, so the fix only works on CPUs where an
overflow does result in a neat truncation to zero, which is not
guaranteed. Checking the value before rounding does not have this
problem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://git.kernel.org/stable/c/0971126c8164abe2004b8536b49690a0d6005b0a; https://git.kernel.org/stable/c/15641007df0f0d35fa28742b25c2a7db9dcd6895; https://git.kernel.org/stable/c/21e5fa4688e1a4d3db6b72216231b24232f75c1d
CVE: CVE-2024-26884
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix hashtab overflow check on 32-bit arches

The hashtab code relies on roundup_pow_of_two() to compute the number of
hash buckets, and contains an overflow check by checking if the
resulting value is 0. However, on 32-bit arches, the roundup code itself
can overflow by doing a 32-bit left-shift of an unsigned long value,
which is undefined behaviour, so it is not guaranteed to truncate
neatly. This was triggered by syzbot on the DEVMAP_HASH type, which
contains the same check, copied from the hashtab code. So apply the same
fix to hashtab, by moving the overflow check to before the roundup.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-190
References: https://git.kernel.org/stable/c/33ec04cadb77605b71d[PII_REDACTED]303d390c4d5; https://git.kernel.org/stable/c/3b08cfc65f07b1132c1979d73f014ae6e04de55d; https://git.kernel.org/stable/c/64f00b4df0597590b199b62a37a165473bf658a6
CVE: CVE-2024-26885
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix DEVMAP_HASH overflow check on 32-bit arches

The devmap code allocates a number hash buckets equal to the next power
of two of the max_entries value provided when creating the map. When
rounding up to the next power of two, the 32-bit variable storing the
number of buckets can overflow, and the code checks for overflow by
checking if the truncated 32-bit value is equal to 0. However, on 32-bit
arches the rounding up itself can overflow mid-way through, because it
ends up doing a left-shift of 32 bits on an unsigned long value. If the
size of an unsigned long is four bytes, this is undefined behaviour, so
there is no guarantee that we'll end up with a nice and tidy 0-value at
the end.

Syzbot managed to turn this into a crash on arm32 by creating a
DEVMAP_HASH with max_entries > 0x80000000 and then trying to update it.
Fix this by moving the overflow check to before the rounding up
operation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://git.kernel.org/stable/c/1f5e352b9088211fa5eb4e1639cd365f4f7d2f65; https://git.kernel.org/stable/c/22079b3a423382335f47d9ed32114e6c9fe88d7c; https://git.kernel.org/stable/c/250051acc21f9d4c5c595e4fcb55986ea08c4691
CVE: CVE-2024-26886
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: af_bluetooth: Fix deadlock

Attemting to do sock_lock on .recvmsg may cause a deadlock as shown
bellow, so instead of using sock_sock this uses sk_receive_queue.lock
on bt_sock_ioctl to avoid the UAF:

INFO: task kworker/u9:1:121 blocked for more than 30 seconds.
      Not tainted 6.7.6-lemon #183
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __schedule+0x37d/0xa00
 schedule+0x32/0xe0
 __lock_sock+0x68/0xa0
 ? __pfx_autoremove_wake_function+0x10/0x10
 lock_sock_nested+0x43/0x50
 l2cap_sock_recv_cb+0x21/0xa0
 l2cap_recv_frame+0x55b/0x30a0
 ? psi_task_switch+0xeb/0x270
 ? finish_task_switch.isra.0+0x93/0x2a0
 hci_rx_work+0x33a/0x3f0
 process_one_work+0x13a/0x2f0
 worker_thread+0x2f0/0x410
 ? __pfx_worker_thread+0x10/0x10
 kthread+0xe0/0x110
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x2c/0x50
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1b/0x30
 </TASK>
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/2c9e2df022ef8b9d7fac58a04a2ef4ed25288955; https://git.kernel.org/stable/c/64be3c[PII_REDACTED]708da0dfe259705fb992416c; https://git.kernel.org/stable/c/817e8138ce86001b2fa5c63d6ede756e205a01f7
CVE: CVE-2024-26887
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btusb: Fix memory leak

This checks if CONFIG_DEV_COREDUMP is enabled before attempting to clone
the skb and also make sure btmtk_process_coredump frees the skb passed
following the same logic.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/620b9e60e4b55fa55540ce852a0f3c9e6091dbbc; https://git.kernel.org/stable/c/79f4127a502c5905f04da1f20a7bbe07103fb77c; https://git.kernel.org/stable/c/b08bd8f02a24e2b82fece5ac51dc1c3d9aa6c404
CVE: CVE-2024-26888
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: msft: Fix memory leak

Fix leaking buffer allocated to send MSFT_OP_LE_MONITOR_ADVERTISEMENT.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/5987b9f7d9314c[PII_REDACTED]b3a52f61a8cc0911; https://git.kernel.org/stable/c/5cb93417c93716a5404f762f331f5de3653fd952; https://git.kernel.org/stable/c/98e9920c75e0790bff947a00d192d24bf1c724e0
CVE: CVE-2024-26889
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_core: Fix possible buffer overflow

struct hci_dev_info has a fixed size name[8] field so in the event that
hdev->name is bigger than that strcpy would attempt to write past its
size, so this fixes this problem by switching to use strscpy.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://git.kernel.org/stable/c/2e845867b4e279eff0a19ade253390470e07e8a1; https://git.kernel.org/stable/c/2edce8e9a99dd5e4404259d52e754fdc97fb42c2; https://git.kernel.org/stable/c/54a03e4ac1a41edf8a5087bd59f8241b0de96d3d
CVE: CVE-2024-26892
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921e: fix use-after-free in free_irq()

From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test
to make sure the shared irq handler should be able to handle the unexpected
event after deregistration. For this case, let's apply MT76_REMOVED flag to
indicate the device was removed and do not run into the resource access
anymore.

BUG: KASAN: use-after-free in mt7921_irq_handler+0xd8/0x100 [mt7921e]
Read of size 8 at addr ffff88824a7d3b78 by task rmmod/11115
CPU: 28 PID: 11115 Comm: rmmod Tainted: G        W    L    5.17.0 #10
Hardware name: Micro-Star International Co., Ltd. MS-7D73/MPG B650I
EDGE WIFI (MS-7D73), BIOS 1.81 01/05/2024
Call Trace:
 <TASK>
 dump_stack_lvl+0x6f/0xa0
 print_address_description.constprop.0+0x1f/0x190
 ? mt7921_irq_handler+0xd8/0x100 [mt7921e]
 ? mt7921_irq_handler+0xd8/0x100 [mt7921e]
 kasan_report.cold+0x7f/0x11b
 ? mt7921_irq_handler+0xd8/0x100 [mt7921e]
 mt7921_irq_handler+0xd8/0x100 [mt7921e]
 free_irq+0x627/0xaa0
 devm_free_irq+0x94/0xd0
 ? devm_request_any_context_irq+0x160/0x160
 ? kobject_put+0x18d/0x4a0
 mt7921_pci_remove+0x153/0x190 [mt7921e]
 pci_device_remove+0xa2/0x1d0
 __device_release_driver+0x346/0x6e0
 driver_detach+0x1ef/0x2c0
 bus_remove_driver+0xe7/0x2d0
 ? __check_object_size+0x57/0x310
 pci_unregister_driver+0x26/0x250
 __do_sys_delete_module+0x307/0x510
 ? free_module+0x6a0/0x6a0
 ? fpregs_assert_state_consistent+0x4b/0xb0
 ? rcu_read_lock_sched_held+0x10/0x70
 ? syscall_enter_from_user_mode+0x20/0x70
 ? trace_hardirqs_on+0x1c/0x130
 do_syscall_64+0x5c/0x80
 ? trace_hardirqs_on_prepare+0x72/0x160
 ? do_syscall_64+0x68/0x80
 ? trace_hardirqs_on_prepare+0x72/0x160
 entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/bfe1adf1606f76c180324e53b130f0e76d5cc6c3; https://git.kernel.org/stable/c/bfeaef901194c5923ce[PII_REDACTED]eff2fac513a; https://git.kernel.org/stable/c/c7dd42fbebcfb02bef070fd48f774d6412d0b49d
CVE: CVE-2024-26893
Published: 2024-04-17
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Fix double free in SMC transport cleanup path

When the generic SCMI code tears down a channel, it calls the chan_free
callback function, defined by each transport. Since multiple protocols
might share the same transport_info member, chan_free() might want to
clean up the same member multiple times within the given SCMI transport
implementation. In this case, it is SMC transport. This will lead to a NULL
pointer dereference at the second time:

    | scmi_protocol scmi_dev.1: Enabled polling mode TX channel - prot_id:16
    | arm-scmi firmware:scmi: SCMI Notifications - Core Enabled.
    | arm-scmi firmware:scmi: unable to communicate with SCMI
    | Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]
    | Mem abort info:
    |   ESR = 0x[PII_REDACTED]000004
    |   EC = 0x25: DABT (current EL), IL = 32 bits
    |   SET = 0, FnV = 0
    |   EA = 0, S1PTW = 0
    |   FSC = 0x04: level 0 translation fault
    | Data abort info:
    |   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
    |   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
    |   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
    | user pgtable: 4k pages, 48-bit VAs, pgdp=[PII_REDACTED]ef8000
    | [[PII_REDACTED]] pgd=[PII_REDACTED], p4d=[PII_REDACTED]
    | Internal error: Oops: [PII_REDACTED] [#1] PREEMPT SMP
    | Modules linked in:
    | CPU: 4 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-00124-g455ef3d016c9-dirty #793
    | Hardware name: FVP Base RevC (DT)
    | pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
    | pc : smc_chan_free+0x3c/0x6c
    | lr : smc_chan_free+0x3c/0x6c
    | Call trace:
    |  smc_chan_free+0x3c/0x6c
    |  idr_for_each+0x68/0xf8
    |  scmi_cleanup_channels.isra.0+0x2c/0x58
    |  scmi_probe+0x434/0x734
    |  platform_probe+0x68/0xd8
    |  really_probe+0x110/0x27c
    |  __driver_probe_device+0x78/0x12c
    |  driver_probe_device+0x3c/0x118
    |  __driver_attach+0x74/0x128
    |  bus_for_each_dev+0x78/0xe0
    |  driver_attach+0x24/0x30
    |  bus_add_driver+0xe4/0x1e8
    |  driver_register+0x60/0x128
    |  __platform_driver_register+0x28/0x34
    |  scmi_driver_init+0x84/0xc0
    |  do_one_initcall+0x78/0x33c
    |  kernel_init_freeable+0x2b8/0x51c
    |  kernel_init+0x24/0x130
    |  ret_from_fork+0x10/0x20
    | Code: f0004701 910a0021 aa1403e5 97b91c70 (b9400280)
    | ---[ end trace [PII_REDACTED] ]---

Simply check for the struct pointer being NULL before trying to access
its members, to avoid this situation.

This was found when a transport doesn't really work (for instance no SMC
service), the probe routines then tries to clean up, and triggers a crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-415
References: https://git.kernel.org/stable/c/0d276d9f335f41d6524258d58c0c0241ef9a83a4; https://git.kernel.org/stable/c/857f56db8c3a71f9871922b6984ff74ad588cb2c; https://git.kernel.org/stable/c/8ffaa17ccb1eb1b65cf85db63225a3581c303773