deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50583
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

md/raid0, raid10: Don't set discard sectors for request queue

It should use disk_stack_limits to get a proper max_discard_sectors
rather than setting a value by stack drivers.

And there is a bug. If all member disks are rotational devices,
raid0/raid10 set max_discard_sectors. So the member devices are
not ssd/nvme, but raid0/raid10 export the wrong value. It reports
warning messages in function __blkdev_issue_discard when mkfs.xfs
like this:

[ 4616.022599] ------------[ cut here ]------------
[ 4616.027779] WARNING: CPU: 4 PID: 99634 at block/blk-lib.c:50 __blkdev_issue_discard+0x16a/0x1a0
[ 4616.140663] RIP: 0010:__blkdev_issue_discard+0x16a/0x1a0
[ 4616.146601] Code: 24 4c 89 20 31 c0 e9 fe fe ff ff c1 e8 09 8d 48 ff 4c 89 f0 4c 09 e8 48 85 c1 0f 84 55 ff ff ff b8 ea ff ff ff e9 df fe ff ff <0f> 0b 48 8d 74 24 08 e8 ea d6 00 00 48 c7 c6 20 1e 89 ab 48 c7 c7
[ 4616.167567] RSP: 0018:ffffaab88cbffca8 EFLAGS: 00010246
[ 4616.173406] RAX: ffff9ba1f9e44678 RBX: [PII_REDACTED] RCX: ffff9ba1c9792080
[ 4616.181376] RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: ffff9ba1c9792080
[ 4616.189345] RBP:[PII_REDACTED]000cc0 R08: ffffaab88cbffd10 R09: [PII_REDACTED]
[ 4616.197317] R10: [PII_REDACTED] R11: [PII_REDACTED] R12: [PII_REDACTED]
[ 4616.205288] R13: [PII_REDACTED] R14:[PII_REDACTED]000cc0 R15: ffff9ba1c9792080
[ 4616.213259] FS:  00007f9a5534e980(0000) GS:ffff9ba1b7c80000(0000) knlGS:[PII_REDACTED]
[ 4616.222298] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[ 4616.228719] CR2: 000055a390a4c518 CR3:[PII_REDACTED]e40006 CR4:[PII_REDACTED]1706e0
[ 4616.236689] Call Trace:
[ 4616.239428]  blkdev_issue_discard+0x52/0xb0
[ 4616.244108]  blkdev_common_ioctl+0x43c/0xa00
[ 4616.248883]  blkdev_ioctl+0x116/0x280
[ 4616.252977]  __x64_sys_ioctl+0x8a/0xc0
[ 4616.257163]  do_syscall_64+0x5c/0x90
[ 4616.261164]  ? handle_mm_fault+0xc5/0x2a0
[ 4616.265652]  ? do_user_addr_fault+0x1d8/0x690
[ 4616.270527]  ? do_syscall_64+0x69/0x90
[ 4616.274717]  ? exc_page_fault+0x62/0x150
[ 4616.279097]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 4616.284748] RIP: 0033:0x7f9a55398c6b
References: https://git.kernel.org/stable/c/27e5d61a8e6919b5c0c6f473703ffea2acba862a; https://git.kernel.org/stable/c/8e1a2279ca2b0485cc379a153d02a9793f74a48f; https://git.kernel.org/stable/c/e80bef070699d2e791badefccb1ddabd6998d468
CVE: CVE-2022-50614
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic

The dma_map_single() doesn't permit zero length mapping. It causes a follow
panic.

A panic was reported on arm64:

[   60.137988] ------------[ cut here ]------------
[   60.142630] kernel BUG at kernel/dma/swiotlb.c:624!
[   60.147508] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[   60.152992] Modules linked in: dw_hdmi_cec crct10dif_ce simple_bridge rcar_fdp1 vsp1 rcar_vin videobuf2_vmalloc rcar_csi2 v4l
2_mem2mem videobuf2_dma_contig videobuf2_memops pci_endpoint_test videobuf2_v4l2 videobuf2_common rcar_fcp v4l2_fwnode v4l2_asyn
c videodev mc gpio_bd9571mwv max9611 pwm_rcar ccree at24 authenc libdes phy_rcar_gen3_usb3 usb_dmac display_connector pwm_bl
[   60.186252] CPU: 0 PID: 508 Comm: pcitest Not tainted 6.0.0-rc1rpci-dev+ #237
[   60.193387] Hardware name: Renesas Salvator-X 2nd version board based on r8a77951 (DT)
[   60.201302] pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   60.208263] pc : swiotlb_tbl_map_single+0x2c0/0x590
[   60.213149] lr : swiotlb_map+0x88/0x1f0
[   60.216982] sp : ffff80000a883bc0
[   60.220292] x29: ffff80000a883bc0 x28: [PII_REDACTED] x27: [PII_REDACTED]
[   60.227430] x26: [PII_REDACTED] x25: ffff0004c0da20d0 x24: ffff80000a1f77c0
[   60.234567] x23: [PII_REDACTED] x22: [PII_REDACTED] x21: 000000007a000000
[   60.241703] x20: [PII_REDACTED] x19: [PII_REDACTED] x18: [PII_REDACTED]
[   60.248840] x17: [PII_REDACTED] x16: [PII_REDACTED] x15: ffff0006ff7b9180
[   60.255977] x14: ffff0006ff7b9180 x13: [PII_REDACTED] x12: [PII_REDACTED]
[   60.263113] x11: [PII_REDACTED] x10: [PII_REDACTED] x9 : [PII_REDACTED]
[   60.270249] x8 : [PII_REDACTED] x7 : ffff0004c6754b20 x6 : [PII_REDACTED]
[   60.277385] x5 : ffff0004c0da2090 x4 : [PII_REDACTED] x3 : [PII_REDACTED]
[   60.284521] x2 : [PII_REDACTED] x1 : [PII_REDACTED] x0 : [PII_REDACTED]
[   60.291658] Call trace:
[   60.294100]  swiotlb_tbl_map_single+0x2c0/0x590
[   60.298629]  swiotlb_map+0x88/0x1f0
[   60.302115]  dma_map_page_attrs+0x188/0x230
[   60.306299]  pci_endpoint_test_ioctl+0x5e4/0xd90 [pci_endpoint_test]
[   60.312660]  __arm64_sys_ioctl+0xa8/0xf0
[   60.316583]  invoke_syscall+0x44/0x108
[   60.320334]  el0_svc_common.constprop.0+0xcc/0xf0
[   60.325038]  do_el0_svc+0x2c/0xb8
[   60.328351]  el0_svc+0x2c/0x88
[   60.331406]  el0t_64_sync_handler+0xb8/0xc0
[   60.335587]  el0t_64_sync+0x18c/0x190
[   60.339251] Code: 52800013 d2e00414 35fff45c d503201f (d4210000)
[   60.345344] ---[ end trace [PII_REDACTED] ]---

To fix it, this patch adds a checking the payload length if it is zero.
References: https://git.kernel.org/stable/c/0df206bdc6204b758585bbe159a55e23e7917b13; https://git.kernel.org/stable/c/279116cb0bc5cd8af65d6a00ffe074bd09842f88; https://git.kernel.org/stable/c/6c01739c2aba19553beb20491b05515af9246f0f
CVE: CVE-2022-50615
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()

pci_get_device() will increase the reference count for the returned
pci_dev, so snr_uncore_get_mc_dev() will return a pci_dev with its
reference count increased. We need to call pci_dev_put() to decrease the
reference count. Let's add the missing pci_dev_put().
References: https://git.kernel.org/stable/c/433bd587dca5c3f7157fef2fe571290cd392cbf6; https://git.kernel.org/stable/c/8ebd16c11c346751b3944d708e6c181ed4746c39; https://git.kernel.org/stable/c/a67146437b6428069b71a7e5e740a2a8e1c40ac9
CVE: CVE-2022-50616
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

regulator: core: Use different devices for resource allocation and DT lookup

Following by the below discussion, there's the potential UAF issue
between regulator and mfd.
https://lore.kernel.org/all/[PII_REDACTED]3[PII_REDACTED]-1-yangyingliang@huawei.com/

From the analysis of Yingliang

CPU A				|CPU B
mt6370_probe()			|
  devm_mfd_add_devices()	|
				|mt6370_regulator_probe()
				|  regulator_register()
				|    //allocate init_data and add it to devres
				|    regulator_of_get_init_data()
i2c_unregister_device()		|
  device_del()			|
    devres_release_all()	|
      // init_data is freed	|
      release_nodes()		|
				|  // using init_data causes UAF
				|  regulator_register()

It's common to use mfd core to create child device for the regulator.
In order to do the DT lookup for init data, the child that registered
the regulator would pass its parent as the parameter. And this causes
init data resource allocated to its parent, not itself. The issue happen
when parent device is going to release and regulator core is still doing
some operation of init data constraint for the regulator of child device.

To fix it, this patch expand 'regulator_register' API to use the
different devices for init data allocation and DT lookup.
References: https://git.kernel.org/stable/c/8f3cbcd6b440032ebc7f7d48a1689dcc70a4eb98; https://git.kernel.org/stable/c/b0f25ca1ff9be7abd1679ae7e59a8f25dbffe67a; https://git.kernel.org/stable/c/cb29811d989bcb7ea81ca111c4b13878b344e086
CVE: CVE-2022-50617
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/powerplay/psm: Fix memory leak in power state init

Commit 902bc65de0b3 ("drm/amdgpu/powerplay/psm: return an error in power
state init") made the power state init function return early in case of
failure to get an entry from the powerplay table, but it missed to clean up
the allocated memory for the current power state before returning.
References: https://git.kernel.org/stable/c/1c65f8f98148709e08bd6157a807c443ba91f0ac; https://git.kernel.org/stable/c/1caed03305b560bafea8eaa57f[PII_REDACTED]b3ff; https://git.kernel.org/stable/c/7cb[PII_REDACTED]bee992dc898a36ffe155fdc1bfa
CVE: CVE-2022-50618
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

mmc: meson-gx: fix return value check of mmc_add_host()

mmc_add_host() may return error, if we ignore its return value,
it will lead two issues:
1. The memory that allocated in mmc_alloc_host() is leaked.
2. In the remove() path, mmc_remove_host() will be called to
   delete device, but it's not added yet, it will lead a kernel
   crash because of null-ptr-deref in device_del().

Fix this by checking the return value and goto error path which
will call mmc_free_host().
References: https://git.kernel.org/stable/c/42343e3c6195e934b9cb4c08b7ff84a3778d77f9; https://git.kernel.org/stable/c/64b2c441171febf075bd9632aca579afda8ab9fb; https://git.kernel.org/stable/c/90935f16f2650ab7416fa2ffbe5c28cb39cf3f1e
CVE: CVE-2022-50619
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()

If the number of pages from the userptr BO differs from the SG BO then the
allocated memory for the SG table doesn't get freed before returning
-EINVAL, which may lead to a memory leak in some error paths. Fix this by
checking the number of pages before allocating memory for the SG table.
References: https://git.kernel.org/stable/c/304a10161696d86300ceab1cbe72b2d74b8cdd94; https://git.kernel.org/stable/c/90bfee142af0f0e9d3bec80e7acd5f49b230acf7; https://git.kernel.org/stable/c/c6dc4c9ba093829ebe1450d5fb101da6fb7a2a58
CVE: CVE-2022-50620
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to invalidate dcc->f2fs_issue_discard in error path

Syzbot reports a NULL pointer dereference issue as below:

 __refcount_add include/linux/refcount.h:193 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 get_task_struct include/linux/sched/task.h:110 [inline]
 kthread_stop+0x34/0x1c0 kernel/kthread.c:703
 f2fs_stop_discard_thread+0x3c/0x5c fs/f2fs/segment.c:1638
 kill_f2fs_super+0x5c/0x194 fs/f2fs/super.c:4522
 deactivate_locked_super+0x70/0xe8 fs/super.c:332
 deactivate_super+0xd0/0xd4 fs/super.c:363
 cleanup_mnt+0x1f8/0x234 fs/namespace.c:1186
 __cleanup_mnt+0x20/0x30 fs/namespace.c:1193
 task_work_run+0xc4/0x14c kernel/task_work.c:177
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0x26c/0xbe0 kernel/exit.c:795
 do_group_exit+0x60/0xe8 kernel/exit.c:925
 __do_sys_exit_group kernel/exit.c:936 [inline]
 __se_sys_exit_group kernel/exit.c:934 [inline]
 __wake_up_parent+0x0/0x40 kernel/exit.c:934
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:636
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:654
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581

The root cause of this issue is in error path of f2fs_start_discard_thread(),
it missed to invalidate dcc->f2fs_issue_discard, later kthread_stop() may
access invalid pointer.
References: https://git.kernel.org/stable/c/865bb7b5a7deeb0e5afbd82381d52d38825dc64d; https://git.kernel.org/stable/c/91586ce0d39a05f88795aa8814fb99b1387236b3; https://git.kernel.org/stable/c/a3e517a6ba695d683ee63615e1ea6e6b4c7d2732
CVE: CVE-2022-50621
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

dm: verity-loadpin: Only trust verity targets with enforcement

Verity targets can be configured to ignore corrupted data blocks.
LoadPin must only trust verity targets that are configured to
perform some kind of enforcement when data corruption is detected,
like returning an error, restarting the system or triggering a
panic.
References: https://git.kernel.org/stable/c/916ef6232cc4b84db7082b4c3d3cf1753d9462ba; https://git.kernel.org/stable/c/cb1f5b76e39d86c98722696bdf632987aa777b83
CVE: CVE-2022-50622
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix potential memory leak in ext4_fc_record_modified_inode()

As krealloc may return NULL, in this case 'state->fc_modified_inodes'
may not be freed by krealloc, but 'state->fc_modified_inodes' already
set NULL. Then will lead to 'state->fc_modified_inodes' memory leak.
References: https://git.kernel.org/stable/c/24d39affc6be1acf6df86a8c3e2413b8a73749c7; https://git.kernel.org/stable/c/9305721a309fa1bd7c194e0d4a2335bf3b29dca4; https://git.kernel.org/stable/c/9b5eb368a86f97eb9831f5b53b8e43ec69bc7cd4
CVE: CVE-2022-50623
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()

The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit
systems leading to memory corruption.  Use array_size() to fix that.
References: https://git.kernel.org/stable/c/1b5a931594f7ffd26d706614c37d4da0f2ffb6e7; https://git.kernel.org/stable/c/939bc5453b8cbdde9f1e5110ce8309aedb1b501a; https://git.kernel.org/stable/c/940253af8b3865b76de8d1b46bcd4a700104852e
CVE: CVE-2022-50624
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

net: netsec: fix error handling in netsec_register_mdio()

If phy_device_register() fails, phy_device_free() need be called to
put refcount, so memory of phy device and device name can be freed
in callback function.

If get_phy_device() fails, mdiobus_unregister() need be called,
or it will cause warning in mdiobus_free() and kobject is leaked.
References: https://git.kernel.org/stable/c/1e0bee973ef6fc3c1e3acb014515eaea37c8fa17; https://git.kernel.org/stable/c/62f0a08e82a6312efd7df7f595c0b11d4ffde610; https://git.kernel.org/stable/c/728884b22d83148a330b23f9472f1e118b589211
CVE: CVE-2022-50625
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

serial: amba-pl011: avoid SBSA UART accessing DMACR register

Chapter "B Generic UART" in "ARM Server Base System Architecture" [1]
documentation describes a generic UART interface. Such generic UART
does not support DMA. In current code, sbsa_uart_pops and
amba_pl011_pops share the same stop_rx operation, which will invoke
pl011_dma_rx_stop, leading to an access of the DMACR register. This
commit adds a using_rx_dma check in pl011_dma_rx_stop to avoid the
access to DMACR register for SBSA UARTs which does not support DMA.

When the kernel enables DMA engine with "CONFIG_DMA_ENGINE=y", Linux
SBSA PL011 driver will access PL011 DMACR register in some functions.
For most real SBSA Pl011 hardware implementations, the DMACR write
behaviour will be ignored. So these DMACR operations will not cause
obvious problems. But for some virtual SBSA PL011 hardware, like Xen
virtual SBSA PL011 (vpl011) device, the behaviour might be different.
Xen vpl011 emulation will inject a data abort to guest, when guest is
accessing an unimplemented UART register. As Xen VPL011 is SBSA
compatible, it will not implement DMACR register. So when Linux SBSA
PL011 driver access DMACR register, it will get an unhandled data abort
fault and the application will get a segmentation fault:
Unhandled fault at 0xffffffc00944d048
Mem abort info:
  ESR = 0x96000000
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x00: ttbr address size fault
Data abort info:
  ISV = 0, ISS = 0x00000000
  CM = 0, WnR = 0
swapper pgtable: 4k pages, 39-bit VAs, pgdp=[PII_REDACTED]e2e000
[ffffffc00944d048] pgd=100000003ffff803, p4d=100000003ffff803, pud=100000003ffff803, pmd=100000003fffa803, pte=006800009c090f13
Internal error: ttbr address size fault: 96000000 [#1] PREEMPT SMP
...
Call trace:
 pl011_stop_rx+0x70/0x80
 tty_port_shutdown+0x7c/0xb4
 tty_port_close+0x60/0xcc
 uart_close+0x34/0x8c
 tty_release+0x144/0x4c0
 __fput+0x78/0x220
 ____fput+0x1c/0x30
 task_work_run+0x88/0xc0
 do_notify_resume+0x8d0/0x123c
 el0_svc+0xa8/0xc0
 el0t_64_sync_handler+0xa4/0x130
 el0t_64_sync+0x1a0/0x1a4
Code: b9000083 b901f001 794038a0 8b000042 (b9000041)
---[ end trace 83dd93df15c3216f ]---
note: bootlogd[132] exited with preempt_count 1
/etc/rcS.d/S07bootlogd: line 47: 132 Segmentation fault start-stop-daemon

This has been discussed in the Xen community, and we think it should fix
this in Linux. See [2] for more information.

[1] https://developer.arm.com/documentation/den0094/c/?lang=en
[2] https://lists.xenproject.org/archives/html/xen-devel/2022-11/msg00543.html
References: https://git.kernel.org/stable/c/1c5f0d3f480abd8c26761b6b1f486822e77faea3; https://git.kernel.org/stable/c/38a10fdd54d17590d45cb1c43b9889da383b6b1a; https://git.kernel.org/stable/c/64bc5dbc3260230e2f022288c71e5c680059384a
CVE: CVE-2022-50627
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix monitor mode bringup crash

When the interface is brought up in monitor mode, it leads
to NULL pointer dereference crash. This crash happens when
the packet type is extracted for a SKB. This extraction
which is present in the received msdu delivery path,is
not needed for the monitor ring packets since they are
all RAW packets. Hence appending the flags with
"RX_FLAG_ONLY_MONITOR" to skip that extraction.

Observed calltrace:

Unable to handle kernel NULL pointer dereference at virtual address
[PII_REDACTED]
Mem abort info:
  ESR = 0x[PII_REDACTED]000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=[PII_REDACTED]
[[PII_REDACTED]] pgd=[PII_REDACTED], p4d=[PII_REDACTED]
Internal error: Oops: [PII_REDACTED] [#1] PREEMPT SMP
Modules linked in: ath11k_pci ath11k qmi_helpers
CPU: 2 PID: 1781 Comm: napi/-271 Not tainted
6.1.0-rc5-wt-ath-656295-gef907406320c-dirty #6
Hardware name: Qualcomm Technologies, Inc. IPQ8074/AP-HK10-C2 (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]
lr : ath11k_hw_qcn9074_rx_desc_get_decap_type+0x5c/0x60 [ath11k]
sp : ffff80000ef5bb10
x29: ffff80000ef5bb10 x28: [PII_REDACTED] x27: ffff000007baafa0
x26: ffff000014a91ed0 x25: [PII_REDACTED] x24: [PII_REDACTED]
x23: ffff800002b77378 x22: ffff000014a91ec0 x21: ffff000006c8d600
x20: [PII_REDACTED] x19: ffff800002b77740 x18: [PII_REDACTED]
x17:[PII_REDACTED]34343a x16: 656e694c20657079 x15: [PII_REDACTED]
x14: 00000000ffffffea x13: ffff80000ef5b8b8 x12: ffff80000ef5b8c8
x11: ffff80000a591d30 x10: ffff80000a579d40 x9 : c0000000ffffefff
x8 : [PII_REDACTED] x7 :[PII_REDACTED]017fe8 x6 : ffff80000a579ce8
x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 : [PII_REDACTED]
x2 : 3a35ec12ed7f8900 x1 : [PII_REDACTED] x0 : [PII_REDACTED]
Call trace:
 ath11k_hw_qcn9074_rx_desc_get_decap_type+0x34/0x60 [ath11k]
 ath11k_dp_rx_deliver_msdu.isra.42+0xa4/0x3d0 [ath11k]
 ath11k_dp_rx_mon_deliver.isra.43+0x2f8/0x458 [ath11k]
 ath11k_dp_rx_process_mon_rings+0x310/0x4c0 [ath11k]
 ath11k_dp_service_srng+0x234/0x338 [ath11k]
 ath11k_pcic_ext_grp_napi_poll+0x30/0xb8 [ath11k]
 __napi_poll+0x5c/0x190
 napi_threaded_poll+0xf0/0x118
 kthread+0xf4/0x110
 ret_from_fork+0x10/0x20

Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
References: https://git.kernel.org/stable/c/9089c3080a98f1452335e08b8014a28003a211ce; https://git.kernel.org/stable/c/950b43f8bd8a4d476d2da6d2a083a89bcd3c90d7; https://git.kernel.org/stable/c/d6ea1ca1d456bb661e5a9d104e69d2c261161115
CVE: CVE-2022-50628
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/gud: Fix UBSAN warning

UBSAN complains about invalid value for bool:

[  101.165172] [drm] Initialized gud 1.0.0 20200422 for 2-3.2:1.0 on minor 1
[  101.213360] gud 2-3.2:1.0: [drm] fb1: guddrmfb frame buffer device
[  101.213426] usbcore: registered new interface driver gud
[  101.989431] ================================================================================
[  101.989441] UBSAN: invalid-load in linux/include/linux/iosys-map.h:253:9
[  101.989447] load of value 121 is not a valid value for type '_Bool'
[  101.989451] CPU: 1 PID: 455 Comm: kworker/1:6 Not tainted 5.18.0-rc5-gud-5.18-rc5 #3
[  101.989456] Hardware name: Hewlett-Packard HP EliteBook 820 G1/1991, BIOS L71 Ver. 01.44 04/12/2018
[  101.989459] Workqueue: events_long gud_flush_work [gud]
[  101.989471] Call Trace:
[  101.989474]  <TASK>
[  101.989479]  dump_stack_lvl+0x49/0x5f
[  101.989488]  dump_stack+0x10/0x12
[  101.989493]  ubsan_epilogue+0x9/0x3b
[  101.989498]  __ubsan_handle_load_invalid_value.cold+0x44/0x49
[  101.989504]  dma_buf_vmap.cold+0x38/0x3d
[  101.989511]  ? find_busiest_group+0x48/0x300
[  101.989520]  drm_gem_shmem_vmap+0x76/0x1b0 [drm_shmem_helper]
[  101.989528]  drm_gem_shmem_object_vmap+0x9/0xb [drm_shmem_helper]
[  101.989535]  drm_gem_vmap+0x26/0x60 [drm]
[  101.989594]  drm_gem_fb_vmap+0x47/0x150 [drm_kms_helper]
[  101.989630]  gud_prep_flush+0xc1/0x710 [gud]
[  101.989639]  ? _raw_spin_lock+0x17/0x40
[  101.989648]  gud_flush_work+0x1e0/0x430 [gud]
[  101.989653]  ? __switch_to+0x11d/0x470
[  101.989664]  process_one_work+0x21f/0x3f0
[  101.989673]  worker_thread+0x200/0x3e0
[  101.989679]  ? rescuer_thread+0x390/0x390
[  101.989684]  kthread+0xfd/0x130
[  101.989690]  ? kthread_complete_and_exit+0x20/0x20
[  101.989696]  ret_from_fork+0x22/0x30
[  101.989706]  </TASK>
[  101.989708] ================================================================================

The source of this warning is in iosys_map_clear() called from
dma_buf_vmap(). It conditionally sets values based on map->is_iomem. The
iosys_map variables are allocated uninitialized on the stack leading to
->is_iomem having all kinds of values and not only 0/1.

Fix this by zeroing the iosys_map variables.
References: https://git.kernel.org/stable/c/832f861a46039d50536dcfda0a9fb334b48d0f8b; https://git.kernel.org/stable/c/951df98024f7272f85df5044eca7374f5b5b24ef; https://git.kernel.org/stable/c/e1078b270d218f8d58efb4d78ea25a4d16ba3490
CVE: CVE-2022-50629
Published: 2025-12-08
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: rsi: Fix memory leak in rsi_coex_attach()

The coex_cb needs to be freed when rsi_create_kthread() failed in
rsi_coex_attach().
References: https://git.kernel.org/stable/c/956fb851a6e19da5ab491e19c1bc323bb2c2cf6f; https://git.kernel.org/stable/c/98259e0b6cf7f021da9fe4e11fbcce6ad6705ffe; https://git.kernel.org/stable/c/ace789b1d465fae104cd37e49f6e1bcd1c8ff417