deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50274
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

media: dvbdev: adopts refcnt to avoid UAF

dvb_unregister_device() is known that prone to use-after-free.
That is, the cleanup from dvb_unregister_device() releases the dvb_device
even if there are pointers stored in file->private_data still refer to it.

This patch adds a reference counter into struct dvb_device and delays its
deallocation until no pointer refers to the object.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0fc044b2b5e2d05a1fa1fb0d7f270367a7855d79; https://git.kernel.org/stable/c/219b44bf94203bd433aa91b7796475bf656348e5; https://git.kernel.org/stable/c/2abd[PII_REDACTED]4bccdf1432a0980e4ec5273c2a
CVE: CVE-2022-50275
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: Add the missed acpi_put_table() to fix memory leak

When the radeon driver reads the bios information from ACPI
table in radeon_acpi_vfct_bios(), it misses to call acpi_put_table()
to release the ACPI memory after the init, so add acpi_put_table()
properly to fix the memory leak.

v2: fix text formatting (Alex)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/10276a20be1115e1f76c189330da2992df980eee; https://git.kernel.org/stable/c/4539e3211a9bd2418e76797718a4e60a7ae34fcf; https://git.kernel.org/stable/c/4760fa67aff6bd8ef0b14c1fa04c295e734c7309
CVE: CVE-2022-50276
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

power: supply: fix null pointer dereferencing in power_supply_get_battery_info

when kmalloc() fail to allocate memory in kasprintf(), propname
will be NULL, strcmp() called by of_get_property() will cause
null pointer dereference.

So return ENOMEM if kasprintf() return NULL pointer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/104bb8a663451404a26331263ce5b96c34504049; https://git.kernel.org/stable/c/279af90e65cbdb3e5c4519b0043324d7876bc5ec; https://git.kernel.org/stable/c/5beadb55f4e36fafe5d6df5dcd5f85d803f3f134
CVE: CVE-2022-50277
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: don't allow journal inode to have encrypt flag

Mounting a filesystem whose journal inode has the encrypt flag causes a
NULL dereference in fscrypt_limit_io_blocks() when the 'inlinecrypt'
mount option is used.

The problem is that when jbd2_journal_init_inode() calls bmap(), it
eventually finds its way into ext4_iomap_begin(), which calls
fscrypt_limit_io_blocks().  fscrypt_limit_io_blocks() requires that if
the inode is encrypted, then its encryption key must already be set up.
That's not the case here, since the journal inode is never "opened" like
a normal file would be.  Hence the crash.

A reproducer is:

    mkfs.ext4 -F /dev/vdb
    debugfs -w /dev/vdb -R "set_inode_field <8> flags 0x80808"
    mount /dev/vdb /mnt -o inlinecrypt

To fix this, make ext4 consider journal inodes with the encrypt flag to
be invalid.  (Note, maybe other flags should be rejected on the journal
inode too.  For now, this is just the minimal fix for the above issue.)

I've marked this as fixing the commit that introduced the call to
fscrypt_limit_io_blocks(), since that's what made an actual crash start
being possible.  But this fix could be applied to any version of ext4
that supports the encrypt feature.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/105c78e12468413e426625831faa7db4284e1fec; https://git.kernel.org/stable/c/1f7a6626f611aa06d7907aa45b484708dd5ac8bc; https://git.kernel.org/stable/c/bcc5057e1781a3ee889225480d995c3b5cbde555
CVE: CVE-2022-50278
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

PNP: fix name memory leak in pnp_alloc_dev()

After commit 1fa5ae857bb1 ("driver core: get rid of struct device's
bus_id string array"), the name of device is allocated dynamically,
move dev_set_name() after pnp_add_id() to avoid memory leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/110d7b0325c55ff3620073ba4201845f59e22ebf; https://git.kernel.org/stable/c/1f50c7497a5f89de0c31f2edf086af41ff834320; https://git.kernel.org/stable/c/290dd73b943c95c006df973257076ff163adf4d0
CVE: CVE-2022-50279
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

There is a global-out-of-bounds reported by KASAN:

  BUG: KASAN: global-out-of-bounds in
  _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]
  Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411

  CPU: 6 PID: 411 Comm: NetworkManager Tainted: G      D
  6.1.0-rc8+ #144 e[PII_REDACTED]267d37
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
  Call Trace:
   <TASK>
   ...
   kasan_report+0xbb/0x1c0
   _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]
   rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]
   rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]
   ...
   </TASK>

The root cause of the problem is that the comparison order of
"prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The
_rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two
strings from tail to head, which causes the problem. In the
_rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet
this requirement by carefully designing the comparison order.
For example, "pregulation" and "pbandwidth" are compared in order of
length from small to large, first is 3 and last is 4. However, the
comparison order of "prate_section" dose not obey such order requirement,
therefore when "prate_section" is "HT", when comparing from tail to head,
it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As
mentioned above, the _rtl8812ae_eq_n_byte() has the same function as
strcmp(), so just strcmp() is enough.

Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely.
Although it can be fixed by adjusting the comparison order of
"prate_section", this may cause the value of "rate_section" to not be
from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver
from staging to regular tree, but also added setting txpower limit
function during the driver config phase, so the problem was introduced
by this commit.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/057b52461dc005ecd85a3e4998913b1492ec0f72; https://git.kernel.org/stable/c/0c962dcd6bf64b78eaffc09e497a2beb4e48bc32; https://git.kernel.org/stable/c/117dbeda22ec5ea0918254d03b540ef8b8a64d53
CVE: CVE-2022-50281
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()

In error case in bridge_platform_create after calling
platform_device_add()/platform_device_add_data()/
platform_device_add_resources(), release the failed
'pdev' or it will be leak, call platform_device_put()
to fix this problem.

Besides, 'pdev' is divided into 'pdev_wd' and 'pdev_bd',
use platform_device_unregister() to release sgi_w1
resources when xtalk-bridge registration fails.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/11bec9cba4de06b3c0e9e4041453c2caaa1cbec1; https://git.kernel.org/stable/c/48025893b3e31b917ad654d28d23fff66681cac4; https://git.kernel.org/stable/c/93296e7ab774230b7c36541dead10b6da39b650f
CVE: CVE-2022-50282
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

chardev: fix error handling in cdev_device_add()

While doing fault injection test, I got the following report:

------------[ cut here ]------------
kobject: '(null)' ([PII_REDACTED]): is not initialized, yet kobject_put() is being called.
WARNING: CPU: 3 PID: 6306 at kobject_put+0x23d/0x4e0
CPU: 3 PID: 6306 Comm: 283 Tainted: G        W          6.1.0-rc2-00005-g307c1086d7c9 #1253
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:kobject_put+0x23d/0x4e0
Call Trace:
 <TASK>
 cdev_device_add+0x15e/0x1b0
 __iio_device_register+0x13b4/0x1af0 [industrialio]
 __devm_iio_device_register+0x22/0x90 [industrialio]
 max517_probe+0x3d8/0x6b4 [max517]
 i2c_device_probe+0xa81/0xc00

When device_add() is injected fault and returns error, if dev->devt is not set,
cdev_add() is not called, cdev_del() is not needed. Fix this by checking dev->devt
in error path.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/11fa7fefe3d8fac7da56bc9aa3dd5fb3081ca797; https://git.kernel.org/stable/c/28dc61cc49c6e995121c6d86bef4b73df78dda80; https://git.kernel.org/stable/c/34d17b39bceef25e4cf9805cd59250ae05d0a139
CVE: CVE-2022-50284
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

ipc: fix memory leak in init_mqueue_fs()

When setup_mq_sysctls() failed in init_mqueue_fs(), mqueue_inode_cachep is
not released.  In order to fix this issue, the release path is reordered.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/12b677f2c697d61e5ddbcb6c1650050a39392f54; https://git.kernel.org/stable/c/28dad915abe46d38c5799a0c8130e9a2a1540385; https://git.kernel.org/stable/c/86273624a68d07f129dc182b8394f487ed4de484
CVE: CVE-2022-50285
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages

The h->*_huge_pages counters are protected by the hugetlb_lock, but
alloc_huge_page has a corner case where it can decrement the counter
outside of the lock.

This could lead to a corrupted value of h->resv_huge_pages, which we have
observed on our systems.

Take the hugetlb_lock before decrementing h->resv_huge_pages to avoid a
potential race.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/112a005d1ded04a4b41b6d01833cc0bda90625cc; https://git.kernel.org/stable/c/11993652d0b49e27272db0a37aa828d8a3a4b92b; https://git.kernel.org/stable/c/12df140f0bdfae5dcfc81800970dd7f6f632e00c
CVE: CVE-2022-50286
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline

When converting files with inline data to extents, delayed allocations
made on a file system created with both the bigalloc and inline options
can result in invalid extent status cache content, incorrect reserved
cluster counts, kernel memory leaks, and potential kernel panics.

With bigalloc, the code that determines whether a block must be
delayed allocated searches the extent tree to see if that block maps
to a previously allocated cluster.  If not, the block is delayed
allocated, and otherwise, it isn't.  However, if the inline option is
also used, and if the file containing the block is marked as able to
store data inline, there isn't a valid extent tree associated with
the file.  The current code in ext4_clu_mapped() calls
ext4_find_extent() to search the non-existent tree for a previously
allocated cluster anyway, which typically finds nothing, as desired.
However, a side effect of the search can be to cache invalid content
from the non-existent tree (garbage) in the extent status tree,
including bogus entries in the pending reservation tree.

To fix this, avoid searching the extent tree when allocating blocks
for bigalloc + inline files that are being converted from inline to
extent mapped.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/131294c35ed6f777bd4e79d42af13b5c41bf2775; https://git.kernel.org/stable/c/6f4200ec76a0d31200c308ec5a71c68df5417004; https://git.kernel.org/stable/c/81b915181c630ee1cffa052e52874fe4e1ba91ac
CVE: CVE-2022-50287
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs

When (size != 0 || ptrs->lvds_ entries != 3), the program tries to
free() the ptrs. However, the ptrs is not created by calling kzmalloc(),
but is obtained by pointer offset operation.
This may lead to memory leaks or undefined behavior.

Fix this by replacing the arguments of kfree() with ptrs_block.

(cherry picked from commit 7674cd0b7d28b952151c3df26bbfa7e07eb2b4ec)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/1382901f75a5a7dc8eac05059fd0c7816def4eae; https://git.kernel.org/stable/c/4758d04014cfe6cdb6e9b4738d1d6728487bbb3a; https://git.kernel.org/stable/c/7c852e8f93f04e57c1e3883caa72542469c6c4c4
CVE: CVE-2022-50288
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure

adapter->dcb would get silently freed inside qlcnic_dcb_enable() in
case qlcnic_dcb_attach() would return an error, which always happens
under OOM conditions. This would lead to use-after-free because both
of the existing callers invoke qlcnic_dcb_get_info() on the obtained
pointer, which is potentially freed at that point.

Propagate errors from qlcnic_dcb_enable(), and instead free the dcb
pointer at callsite using qlcnic_dcb_free(). This also removes the now
unused qlcnic_clear_dcb_ops() helper, which was a simple wrapper around
kfree() also causing memory leaks for partially initialized dcb.

Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/13a7c8964afcd8ca43c0b6001ebb0127baa95362; https://git.kernel.org/stable/c/36999236f0b12d5de21a6f40e93b570727b9ceb2; https://git.kernel.org/stable/c/513787ff9a331b461115e8a145a983d650a84fcb
CVE: CVE-2022-50289
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix memory leak in ocfs2_stack_glue_init()

ocfs2_table_header should be free in ocfs2_stack_glue_init() if
ocfs2_sysfs_init() failed, otherwise kmemleak will report memleak.

BUG: memory leak
unreferenced object 0xffff88810eeb5800 (size 128):
  comm "modprobe", pid 4507, jiffies[PII_REDACTED] (age 55.888s)
  hex dump (first 32 bytes):
    c0 40 14 a0 ff ff ff ff 00 00 00 00 01 00 00 00  .@..............
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000001e59e1cd>] __register_sysctl_table+0xca/0xef0
    [<00000000c04f70f7>] 0xffffffffa0050037
    [<000000001bd12912>] do_one_initcall+0xdb/0x480
    [<[PII_REDACTED]f766c9>] do_init_module+0x1cf/0x680
    [<000000002ba52db0>] load_module+0x6441/0x6f20
    [<[PII_REDACTED]72580d>] __do_sys_finit_module+0x12f/0x1c0
    [<[PII_REDACTED]0c1f22>] do_syscall_64+0x3f/0x90
    [<000000004cf473bc>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0000281f019111526f7abccc61f2746d2eb626ca; https://git.kernel.org/stable/c/0b2128b70849f2728949babfc1c760096ef72f5d; https://git.kernel.org/stable/c/13b6269dd022aaa69ca8d1df374ab327504121cf
CVE: CVE-2022-50290
Published: 2025-09-15
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50291
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

kcm: annotate data-races around kcm->rx_psock

kcm->rx_psock can be read locklessly in kcm_rfree().
Annotate the read and writes accordingly.

We do the same for kcm->rx_wait in the following patch.

syzbot reported:
BUG: KCSAN: data-race in kcm_rfree / unreserve_rx_kcm

write to 0xffff888123d827b8 of 8 bytes by task 2758 on cpu 1:
unreserve_rx_kcm+0x72/0x1f0 net/kcm/kcmsock.c:313
kcm_rcv_strparser+0x2b5/0x3a0 net/kcm/kcmsock.c:373
__strp_recv+0x64c/0xd20 net/strparser/strparser.c:301
strp_recv+0x6d/0x80 net/strparser/strparser.c:335
tcp_read_sock+0x13e/0x5a0 net/ipv4/tcp.c:1703
strp_read_sock net/strparser/strparser.c:358 [inline]
do_strp_work net/strparser/strparser.c:406 [inline]
strp_work+0xe8/0x180 net/strparser/strparser.c:415
process_one_work+0x3d3/0x720 kernel/workqueue.c:2289
worker_thread+0x618/0xa70 kernel/workqueue.c:2436
kthread+0x1a9/0x1e0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

read to 0xffff888123d827b8 of 8 bytes by task 5859 on cpu 0:
kcm_rfree+0x14c/0x220 net/kcm/kcmsock.c:181
skb_release_head_state+0x8e/0x160 net/core/skbuff.c:841
skb_release_all net/core/skbuff.c:852 [inline]
__kfree_skb net/core/skbuff.c:868 [inline]
kfree_skb_reason+0x5c/0x260 net/core/skbuff.c:891
kfree_skb include/linux/skbuff.h:1216 [inline]
kcm_recvmsg+0x226/0x2b0 net/kcm/kcmsock.c:1161
____sys_recvmsg+0x16c/0x2e0
___sys_recvmsg net/socket.c:2743 [inline]
do_recvmmsg+0x2f1/0x710 net/socket.c:2837
__sys_recvmmsg net/socket.c:2916 [inline]
__do_sys_recvmmsg net/socket.c:2939 [inline]
__se_sys_recvmmsg net/socket.c:2932 [inline]
__x64_sys_recvmmsg+0xde/0x160 net/socket.c:2932
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0xffff88812971ce00 -> 0x[PII_REDACTED]000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 5859 Comm: syz-executor.3 Not tainted 6.0.0-syzkaller-12189-g19d17ab7c68b-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/12a0eb340c9a22e0f8c00d2c0c1a60695ead926a; https://git.kernel.org/stable/c/13dba69e18d04c8eec7596369f2a0596b0260275; https://git.kernel.org/stable/c/15e4dabda11b0fa31d510a915d1a580f47dfc92e
CVE: CVE-2022-50292
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/dp: fix bridge lifetime

Device-managed resources allocated post component bind must be tied to
the lifetime of the aggregate DRM device or they will not necessarily be
released when binding of the aggregate device is deferred.

This can lead resource leaks or failure to bind the aggregate device
when binding is later retried and a second attempt to allocate the
resources is made.

For the DP bridges, previously allocated bridges will leak on probe
deferral.

Fix this by amending the DP parser interface and tying the lifetime of
the bridge device to the DRM device rather than DP platform device.

Patchwork: https://patchwork.freedesktop.org/patch/502667/
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/16194958f888d63839042d1190f7001e5ddec47b; https://git.kernel.org/stable/c/7eda6977e8058dd45607a5bbc6517a0f42ccd6c9
CVE: CVE-2022-50293
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: do not BUG_ON() on ENOMEM when dropping extent items for a range

If we get -ENOMEM while dropping file extent items in a given range, at
btrfs_drop_extents(), due to failure to allocate memory when attempting to
increment the reference count for an extent or drop the reference count,
we handle it with a BUG_ON(). This is excessive, instead we can simply
abort the transaction and return the error to the caller. In fact most
callers of btrfs_drop_extents(), directly or indirectly, already abort
the transaction if btrfs_drop_extents() returns any error.

Also, we already have error paths at btrfs_drop_extents() that may return
-ENOMEM and in those cases we abort the transaction, like for example
anything that changes the b+tree may return -ENOMEM due to a failure to
allocate a new extent buffer when COWing an existing extent buffer, such
as a call to btrfs_duplicate_item() for example.

So replace the BUG_ON() calls with proper logic to abort the transaction
and return the error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/162d053e15fe985f754ef495a96eb3db970c43ed; https://git.kernel.org/stable/c/1baf3370e2dc5e6bd[PII_REDACTED]89457dab2a27; https://git.kernel.org/stable/c/50f993da945074b2a069da099a0331b23a0c89a0
CVE: CVE-2022-50294
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas: fix memory leak in lbs_init_adapter()

When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not
released. Add free memory to processing error path.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/037f84c0bfae5c436c651d0e804264e2648010ec; https://git.kernel.org/stable/c/16a03958618fb91bb1bc7077cf[PII_REDACTED]cc2f; https://git.kernel.org/stable/c/23b34e08de5c2380414c9d3c33e8235094bcccae
CVE: CVE-2022-50295
Published: 2025-09-15
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring/msg_ring: Fix NULL pointer dereference in io_msg_send_fd()

Syzkaller produced the below call trace:

 BUG: KASAN: null-ptr-deref in io_msg_ring+0x3cb/0x9f0
 Write of size 8 at addr [PII_REDACTED] by task repro/16399

 CPU: 0 PID: 16399 Comm: repro Not tainted 6.1.0-rc1 #28
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7
 Call Trace:
  <TASK>
  dump_stack_lvl+0xcd/0x134
  ? io_msg_ring+0x3cb/0x9f0
  kasan_report+0xbc/0xf0
  ? io_msg_ring+0x3cb/0x9f0
  kasan_check_range+0x140/0x190
  io_msg_ring+0x3cb/0x9f0
  ? io_msg_ring_prep+0x300/0x300
  io_issue_sqe+0x698/0xca0
  io_submit_sqes+0x92f/0x1c30
  __do_sys_io_uring_enter+0xae4/0x24b0
....
 RIP: 0033:0x7f2eaf8f8289
 RSP: 002b:00007fff40939718 EFLAGS: 00000246 ORIG_RAX:[PII_REDACTED]0001aa
 RAX: ffffffffffffffda RBX: [PII_REDACTED] RCX: 00007f2eaf8f8289
 RDX: [PII_REDACTED] RSI:[PII_REDACTED]006f71 RDI: [PII_REDACTED]
 RBP: 00007fff409397a0 R08: [PII_REDACTED] R09: [PII_REDACTED]
 R10: [PII_REDACTED] R11: [PII_REDACTED] R12:[PII_REDACTED]4006d0
 R13: 00007fff40939880 R14: [PII_REDACTED] R15: [PII_REDACTED]
  </TASK>
 Kernel panic - not syncing: panic_on_warn set ...

We don't have a NULL check on file_ptr in io_msg_send_fd() function,
so when file_ptr is NUL src_file is also NULL and get_file()
dereferences a NULL pointer and leads to above crash.

Add a NULL check to fix this issue.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0163e04ea64cc3dfaa12390286e5f2f481c3b2e3; https://git.kernel.org/stable/c/16bbdfe5fb0e78e0acb13e45fc127e9a296913f2