deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-56555
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

binder: fix OOB in binder_add_freeze_work()

In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped to
acquire the node->lock first (lock nesting order). This can race with
binder_deferred_release() which removes the nodes from the proc->nodes
rbtree and adds them into binder_dead_nodes list. This leads to a broken
iteration in binder_add_freeze_work() as rb_next() will use data from
binder_dead_nodes, triggering an out-of-bounds access:

  ==================================================================
  BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124
  Read of size 8 at addr ffffcb84285f7170 by task freeze/660

  CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   rb_next+0xfc/0x124
   binder_add_freeze_work+0x344/0x534
   binder_ioctl+0x1e70/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  The buggy address belongs to the variable:
   binder_dead_nodes+0x10/0x40
  [...]
  ==================================================================

This is possible because proc->nodes (rbtree) and binder_dead_nodes
(list) share entries in binder_node through a union:

	struct binder_node {
	[...]
		union {
			struct rb_node rb_node;
			struct hlist_node dead_node;
		};

Fix the race by checking that the proc is still alive. If not, simply
break out of the iteration.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://git.kernel.org/stable/c/011e69a1b23011c0db3af4b8293fdd4522cc97b0; https://git.kernel.org/stable/c/6b1be1da1f8279cf091266e71b5153c5b02aaff6
CVE: CVE-2024-56556
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

binder: fix node UAF in binder_add_freeze_work()

In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped in
order to acquire the node->lock first (lock nesting order). This can
race with binder_node_release() and trigger a use-after-free:

  ==================================================================
  BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
  Write of size 4 at addr ffff53c04c29dd04 by task freeze/640

  CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17
  Hardware name: linux,dummy-virt (DT)
  Call trace:
   _raw_spin_lock+0xe4/0x19c
   binder_add_freeze_work+0x148/0x478
   binder_ioctl+0x1e70/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  Allocated by task 637:
   __kmalloc_cache_noprof+0x12c/0x27c
   binder_new_node+0x50/0x700
   binder_transaction+0x35ac/0x6f74
   binder_thread_write+0xfb8/0x42a0
   binder_ioctl+0x18f0/0x25ac
   __arm64_sys_ioctl+0x124/0x190

  Freed by task 637:
   kfree+0xf0/0x330
   binder_thread_read+0x1e88/0x3a68
   binder_ioctl+0x16d8/0x25ac
   __arm64_sys_ioctl+0x124/0x190
  ==================================================================

Fix the race by taking a temporary reference on the node before
releasing the proc->inner lock. This ensures the node remains alive
while in use.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416, CWE-416
References: https://git.kernel.org/stable/c/38fbefeb2c140b581ed7de8117a5c90d6dd89c22; https://git.kernel.org/stable/c/dc8aea47b928cc153b591b3558829ce42f685074
CVE: CVE-2024-56557
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer

The AD7923 was updated to support devices with 8 channels, but the size
of tx_buf and ring_xfer was not increased accordingly, leading to a
potential buffer overflow in ad7923_update_scan_mode().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://git.kernel.org/stable/c/00663d3e000c31d0d49ef86a809f5c107c2d09cd; https://git.kernel.org/stable/c/218ecc[PII_REDACTED]1ca39bcc0d407c8dc4cd0bbc; https://git.kernel.org/stable/c/3a4187ec454e19903fd15f6e1825a4b84e59a4cd
CVE: CVE-2024-56558
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

nfsd: make sure exp active before svc_export_show

The function `e_show` was called with protection from RCU. This only
ensures that `exp` will not be freed. Therefore, the reference count for
`exp` can drop to zero, which will trigger a refcount use-after-free
warning when `exp_get` is called. To resolve this issue, use
`cache_get_rcu` to ensure that `exp` remains active.

------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 3 PID: 819 at lib/refcount.c:25
refcount_warn_saturate+0xb1/0x120
CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
RIP: 0010:refcount_warn_saturate+0xb1/0x120
...
Call Trace:
 <TASK>
 e_show+0x20b/0x230 [nfsd]
 seq_read_iter+0x589/0x770
 seq_read+0x1e5/0x270
 vfs_read+0x125/0x530
 ksys_read+0xc1/0x160
 do_syscall_64+0x5f/0x170
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/1cecfdbc6bfc89c516d286884c7f29267b95de2b; https://git.kernel.org/stable/c/6cefcadd34e3c71c81ea64b899a0daa86314a51a; https://git.kernel.org/stable/c/7365d1f8de63cffdbbaa2287ce0205438e1a922f
CVE: CVE-2024-56560
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

slab: Fix too strict alignment check in create_cache()

On m68k, where the minimum alignment of unsigned long is 2 bytes:

    Kernel panic - not syncing: __kmem_cache_create_args: Failed to create slab 'io_kiocb'. Error -22
    CPU: 0 UID: 0 PID: 1 Comm: swapper Not tainted 6.12.0-atari-03776-g7eaa1f99261a #1783
    Stack from 0102fe5c:
	    0102fe5c 00514a2b 00514a2b ffffff00 00[PII_REDACTED]f5ed 00425e78 00514a2b
	    0041eb74 ffffffea 00[PII_REDACTED]f5ed ffffffea ffffffea 00601f60 00000044
	    0102ff20 000e7a68 0051ab8e 004383b8 0051f5ed ffffffea 000000b8 00000007
	    01020c00 00000000 000e77f0 0041e5f0 005f67c0 0051f5ed 000000b6 0102fef4
	    00[PII_REDACTED]fef4 [PII_REDACTED] 005f676c 0060a34c [PII_REDACTED]
	    00[PII_REDACTED]009a 0[PII_REDACTED]00b8 005f668e 0102e[PII_REDACTED]2 0102ff88
    Call Trace: [<00425e78>] dump_stack+0xc/0x10
     [<0041eb74>] panic+0xd8/0x26c
     [<000e7a68>] __kmem_cache_create_args+0x278/0x2e8
     [<000e77f0>] __kmem_cache_create_args+0x0/0x2e8
     [<0041e5f0>] memset+0x0/0x8c
     [<005f67c0>] io_uring_init+0x54/0xd2

The minimal alignment of an integral type may differ from its size,
hence is not safe to assume that an arbitrary freeptr_t (which is
basically an unsigned long) is always aligned to 4 or 8 bytes.

As nothing seems to require the additional alignment, it is safe to fix
this by relaxing the check to the actual minimum alignment of freeptr_t.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/8b5aea5e5186733fa4e5aa4293b0a65a933f1a16; https://git.kernel.org/stable/c/9008fe8fad8255edfdbecea32d7eb0485d939d0d
CVE: CVE-2024-56561
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()

pci_epc_destroy() invokes pci_bus_release_domain_nr() to release the PCI
domain ID, but there are two issues:

  - 'epc->dev' is passed to pci_bus_release_domain_nr() which was already
    freed by device_unregister(), leading to a use-after-free issue.

  - Domain ID corresponds to the EPC device parent, so passing 'epc->dev'
    is also wrong.

Fix these issues by passing 'epc->dev.parent' to
pci_bus_release_domain_nr() and also do it before device_unregister().

[mani: reworded subject and description]
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://git.kernel.org/stable/c/4acc902ed3743edd4ac2d3846604a99d17104359; https://git.kernel.org/stable/c/c74a1df6c2a2df7dd45c3fc1a5edc29a075dcf22
CVE: CVE-2024-56562
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()

if (dev->boardinfo && dev->boardinfo->init_dyn_addr)
                                      ^^^ here check "init_dyn_addr"
	i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, ...)
						             ^^^^
							free "dyn_addr"
Fix copy/paste error "dyn_addr" by replacing it with "init_dyn_addr".
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/093ecc6d82ff1d2e0cbf6f2000438b6c698145cb; https://git.kernel.org/stable/c/0cb21f1ea3a2e19ee314a8fcf95461b5c453c59e; https://git.kernel.org/stable/c/0e8ab955c6d06f9d907761c07c02d1492f0a8ac1
CVE: CVE-2024-56563
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ceph: fix cred leak in ceph_mds_check_access()

get_current_cred() increments the reference counter, but the
put_cred() call was missing.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/c5cf420303256dcd6ff175643e9e9558543c2047; https://git.kernel.org/stable/c/e3d1c9e2b811f13bdbbb962c2b17a6091c28522c
CVE: CVE-2024-56564
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ceph: pass cred pointer to ceph_mds_auth_match()

This eliminates a redundant get_current_cred() call, because
ceph_mds_check_access() has already obtained this pointer.

As a side effect, this also fixes a reference leak in
ceph_mds_auth_match(): by omitting the get_current_cred() call, no
additional cred reference is taken.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/23426309a4064b25a961e1c72961d8bfc7c8c990; https://git.kernel.org/stable/c/ffa6ba7bdb7f07f49c9e9150b0176df066520f62
CVE: CVE-2024-56565
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to drop all discards after creating snapshot on lvm device

Piergiorgio reported a bug in bugzilla as below:

------------[ cut here ]------------
WARNING: CPU: 2 PID: 969 at fs/f2fs/segment.c:1330
RIP: 0010:__submit_discard_cmd+0x27d/0x400 [f2fs]
Call Trace:
 __issue_discard_cmd+0x1ca/0x350 [f2fs]
 issue_discard_thread+0x191/0x480 [f2fs]
 kthread+0xcf/0x100
 ret_from_fork+0x31/0x50
 ret_from_fork_asm+0x1a/0x30

w/ below testcase, it can reproduce this bug quickly:
- pvcreate /dev/vdb
- vgcreate myvg1 /dev/vdb
- lvcreate -L 1024m -n mylv1 myvg1
- mount /dev/myvg1/mylv1 /mnt/f2fs
- dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=20
- sync
- rm /mnt/f2fs/file
- sync
- lvcreate -L 1024m -s -n mylv1-snapshot /dev/myvg1/mylv1
- umount /mnt/f2fs

The root cause is: it will update discard_max_bytes of mounted lvm
device to zero after creating snapshot on this lvm device, then,
__submit_discard_cmd() will pass parameter @nr_sects w/ zero value
to __blkdev_issue_discard(), it returns a NULL bio pointer, result
in panic.

This patch changes as below for fixing:
1. Let's drop all remained discards in f2fs_unfreeze() if snapshot
of lvm device is created.
2. Checking discard_max_bytes before submitting discard during
__submit_discard_cmd().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/15136c3861a3341db261ebdbb6ae4ae1765635e2; https://git.kernel.org/stable/c/bc8aeb04fd80cb8cfae3058445c84410fd0beb5e; https://git.kernel.org/stable/c/ed24ab98242f8d22b66fbe0452c97751b5ea4e22
CVE: CVE-2024-56567
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ad7780: fix division by zero in ad7780_write_raw()

In the ad7780_write_raw() , val2 can be zero, which might lead to a
division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw()
is based on iio_info's write_raw. While val is explicitly declared that
can be zero (in read mode), val2 is not specified to be non-zero.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369, CWE-369
References: https://git.kernel.org/stable/c/022e13518ba6cc1b4fdd291f49e4f57b2d5718e0; https://git.kernel.org/stable/c/18fb33df1de83a014d7f784089f9b124facc157f; https://git.kernel.org/stable/c/68e79b848196a0b0ec006009cc69da1f835d1ae8
CVE: CVE-2024-56568
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/arm-smmu: Defer probe of clients after smmu device bound

Null pointer dereference occurs due to a race between smmu
driver probe and client driver probe, when of_dma_configure()
for client is called after the iommu_device_register() for smmu driver
probe has executed but before the driver_bound() for smmu driver
has been called.

Following is how the race occurs:

T1:Smmu device probe		T2: Client device probe

really_probe()
arm_smmu_device_probe()
iommu_device_register()
					really_probe()
					platform_dma_configure()
					of_dma_configure()
					of_dma_configure_id()
					of_iommu_configure()
					iommu_probe_device()
					iommu_init_device()
					arm_smmu_probe_device()
					arm_smmu_get_by_fwnode()
						driver_find_device_by_fwnode()
						driver_find_device()
						next_device()
						klist_next()
						    /* null ptr
						       assigned to smmu */
					/* null ptr dereference
					   while smmu->streamid_mask */
driver_bound()
	klist_add_tail()

When this null smmu pointer is dereferenced later in
arm_smmu_probe_device, the device crashes.

Fix this by deferring the probe of the client device
until the smmu device has bound to the arm smmu driver.

[will: Add comment]
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362, CWE-476, CWE-476
References: https://git.kernel.org/stable/c/229e6ee43d2a160a1592b83aad620d6027084aad; https://git.kernel.org/stable/c/4a9485918a042e3114890dfbe19839a1897f8b2c; https://git.kernel.org/stable/c/5018696b19bc6c021e934a8a59f4b1dd8c0ac9f8
CVE: CVE-2024-56569
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ftrace: Fix regression with module command in stack_trace_filter

When executing the following command:

    # echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter

The current mod command causes a null pointer dereference. While commit
0f17976568b3f ("ftrace: Fix regression with module command in stack_trace_filter")
has addressed part of the issue, it left a corner case unhandled, which still
results in a kernel crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/19cacabdd5a8487ae566cbecb4d03bcb038a067e; https://git.kernel.org/stable/c/43ca32ce12888fb0eeb2d74dfc558dea60d3473e; https://git.kernel.org/stable/c/45af52e7d3b8560f21d139b3759735eead8b1653
CVE: CVE-2024-56570
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

ovl: Filter invalid inodes with missing lookup function

Add a check to the ovl_dentry_weird() function to prevent the
processing of directory inodes that lack the lookup function.
This is important because such inodes can cause errors in overlayfs
when passed to the lowerstack.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/065bf5dd21639f80e68450de16bda829784dbb8c; https://git.kernel.org/stable/c/5f86e79c0b2287ffdabe6c1b305a36c4e0f40fe3; https://git.kernel.org/stable/c/72014e7745cc8250bb8f27bd78694dfd3f1b5773
CVE: CVE-2024-56571
Published: 2024-12-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-56572
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()

The buffer in the loop should be released under the exception path,
otherwise there may be a memory leak here.

To mitigate this, free the buffer when allegro_alloc_buffer fails.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/0f514068fbc5d4d189c817adc7c4e32cffdc2e47; https://git.kernel.org/stable/c/17e[PII_REDACTED]be4e5be1f1894f1a6014a8a0658; https://git.kernel.org/stable/c/64f72a738864b506ab50b4a6cb3ce3c3e04b71af
CVE: CVE-2024-56573
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

efi/libstub: Free correct pointer on failure

cmdline_ptr is an out parameter, which is not allocated by the function
itself, and likely points into the caller's stack.

cmdline refers to the pool allocation that should be freed when cleaning
up after a failure, so pass this instead to free_pool().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-763
References: https://git.kernel.org/stable/c/06d39d79cbd5a91a33707951ebf2512d0e759847; https://git.kernel.org/stable/c/d173aee5709bd0994d216d60589ec67f8b11376a; https://git.kernel.org/stable/c/eaafbcf0a5782ae412ca7de12ef83fc48ccea4cf
CVE: CVE-2024-56574
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

media: ts2020: fix null-ptr-deref in ts2020_probe()

KASAN reported a null-ptr-deref issue when executing the following
command:

  # echo ts2020 0x20 > /sys/bus/i2c/devices/i2c-0/new_device
    KASAN: null-ptr-deref in range [0x[PII_REDACTED]000010-0x[PII_REDACTED]000017]
    CPU: 53 UID: 0 PID: 970 Comm: systemd-udevd Not tainted 6.12.0-rc2+ #24
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
    RIP: 0010:ts2020_probe+0xad/0xe10 [ts2020]
    RSP: 0018:ffffc9000abbf598 EFLAGS: 00010202
    RAX: dffffc[PII_REDACTED] RBX: [PII_REDACTED] RCX: ffffffffc0714809
    RDX: [PII_REDACTED] RSI: ffff88811550be00 RDI: [PII_REDACTED]
    RBP: ffff[PII_REDACTED]00 R08: [PII_REDACTED] R09: fffff52001577eb6
    R10: [PII_REDACTED] R11: ffffc9000abbff50 R12: ffffffffc0714790
    R13: 1ffff92001577eb8 R14: ffffffffc07190d0 R15: [PII_REDACTED]
    FS:  00007f95f13b98c0(0000) GS:ffff[PII_REDACTED]00(0000) knlGS:[PII_REDACTED]
    CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
    CR2: 0000555d2634b000 CR3: [PII_REDACTED] CR4:[PII_REDACTED]0006f0
    DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
    DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
    Call Trace:
     <TASK>
     ts2020_probe+0xad/0xe10 [ts2020]
     i2c_device_probe+0x421/0xb40
     really_probe+0x266/0x850
    ...

The cause of the problem is that when using sysfs to dynamically register
an i2c device, there is no platform data, but the probe process of ts2020
needs to use platform data, resulting in a null pointer being accessed.

Solve this problem by adding checks to platform data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/4a058b34b52ed3feb1f3ff6fd26aefeeeed20cba; https://git.kernel.org/stable/c/5a53f97cd[PII_REDACTED]b695add057f9965c1a2d6; https://git.kernel.org/stable/c/901070571bc191d1d8d7a1379bc5ba[PII_REDACTED]
CVE: CVE-2024-56576
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

media: i2c: tc358743: Fix crash in the probe error path when using polling

If an error occurs in the probe() function, we should remove the polling
timer that was alarmed earlier, otherwise the timer is called with
arguments that are already freed, which results in a crash.

------------[ cut here ]------------
WARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268
Modules linked in:
CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226
Hardware name: Diasom DS-RK3568-SOM-EVB (DT)
pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __run_timers+0x244/0x268
lr : __run_timers+0x1d4/0x268
sp : ffffff80eff2baf0
x29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00
x26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00
x23: [PII_REDACTED] x22: dead[PII_REDACTED]22 x21: [PII_REDACTED]
x20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff
x17: ffffffc06f146000 x16: ffffff80eff27dc0 x15:[PII_REDACTED]00003e
x14: [PII_REDACTED] x13:[PII_REDACTED]0054da x12: [PII_REDACTED]
x11:[PII_REDACTED]0639c0 x10:[PII_REDACTED]00000c x9 : [PII_REDACTED]
x8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480
x5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 :[PII_REDACTED]0f4240
x2 : [PII_REDACTED] x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0
Call trace:
 __run_timers+0x244/0x268
 timer_expire_remote+0x50/0x68
 tmigr_handle_remote+0x388/0x39c
 run_timer_softirq+0x38/0x44
 handle_softirqs+0x138/0x298
 __do_softirq+0x14/0x20
 ____do_softirq+0x10/0x1c
 call_on_irq_stack+0x24/0x4c
 do_softirq_own_stack+0x1c/0x2c
 irq_exit_rcu+0x9c/0xcc
 el1_interrupt+0x48/0xc0
 el1h_64_irq_handler+0x18/0x24
 el1h_64_irq+0x7c/0x80
 default_idle_call+0x34/0x68
 do_idle+0x23c/0x294
 cpu_startup_entry+0x38/0x3c
 secondary_start_kernel+0x128/0x160
 __secondary_switched+0xb8/0xbc
---[ end trace [PII_REDACTED] ]---
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/13193a97ddd5a6a5b11408ddbc1ae85588b1860c; https://git.kernel.org/stable/c/1def915b1564f4375330bd113ea1d768a569cfd8; https://git.kernel.org/stable/c/34a3466a92f50c51d984f0ec2e96864886d460eb
CVE: CVE-2024-56577
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

media: mtk-jpeg: Fix null-ptr-deref during unload module

The workqueue should be destroyed in mtk_jpeg_core.c since commit
09aea13ecf6f ("media: mtk-jpeg: refactor some variables"), otherwise
the below calltrace can be easily triggered.

[  677.862514] Unable to handle kernel paging request at virtual address dfff[PII_REDACTED]23
[  677.863633] KASAN: null-ptr-deref in range [0x[PII_REDACTED]000118-0x[PII_REDACTED]00011f]
...
[  677.879654] CPU: 6 PID: 1071 Comm: modprobe Tainted: G           O       6.8.12-mtk+gfa1a78e5d24b+ #17
...
[  677.882838] pc : destroy_workqueue+0x3c/0x770
[  677.883413] lr : mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw]
[  677.884314] sp : ffff80008ad974f0
[  677.884744] x29: ffff80008ad974f0 x28: ffff0000d7115580 x27: ffff0000dd691070
[  677.885669] x26: ffff0000dd691408 x25: ffff8000844af3e0 x24: ffff80008ad97690
[  677.886592] x23: ffff0000e051d400 x22: ffff0000dd691010 x21: dfff[PII_REDACTED]00
[  677.887515] x20: [PII_REDACTED] x19: [PII_REDACTED] x18: ffff800085397ac0
[  677.888438] x17: [PII_REDACTED] x16: ffff8000801b87c8 x15: 1ffff000115b2e10
[  677.889361] x14: 00000000f1f1f1f1 x13: [PII_REDACTED] x12: ffff7000115b2e4d
[  677.890285] x11: 1ffff000115b2e4c x10: ffff7000115b2e4c x9 : ffff80000aa43e90
[  677.891208] x8 : 00008fffeea4d1b4 x7 : ffff80008ad97267 x6 : [PII_REDACTED]
[  677.892131] x5 : ffff80008ad97260 x4 : ffff7000115b2e4d x3 : [PII_REDACTED]
[  677.893054] x2 : [PII_REDACTED] x1 : dfff[PII_REDACTED]00 x0 : [PII_REDACTED]
[  677.893977] Call trace:
[  677.894297]  destroy_workqueue+0x3c/0x770
[  677.894826]  mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw]
[  677.895677]  devm_action_release+0x50/0x90
[  677.896211]  release_nodes+0xe8/0x170
[  677.896688]  devres_release_all+0xf8/0x178
[  677.897219]  device_unbind_cleanup+0x24/0x170
[  677.897785]  device_release_driver_internal+0x35c/0x480
[  677.898461]  device_release_driver+0x20/0x38
...
[  677.912665] ---[ end trace [PII_REDACTED] ]---
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/0ba08c21c6a92e6512e[PII_REDACTED]0427c9a49d4; https://git.kernel.org/stable/c/17af2b39daf12870cac61ffc360e62bc35798afb; https://git.kernel.org/stable/c/bc3889a39baf783c64c6d628bbb74d76ce164bb1
CVE: CVE-2024-56578
Published: 2024-12-27
Description: In the Linux kernel, the following vulnerability has been resolved:

media: imx-jpeg: Set video drvdata before register video device

The video drvdata should be set before the video device is registered,
otherwise video_drvdata() may return NULL in the open() file ops, and led
to oops.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/5ade59d28eade49194eb09765afdeb0ba717c39a; https://git.kernel.org/stable/c/68efeff2f7fccdfedc55f92e92be32997127d16e; https://git.kernel.org/stable/c/b88556e82dc18cb708744d062770853a2d5095b2