deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-47235
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: fix potential use-after-free in ec_bhf_remove

static void ec_bhf_remove(struct pci_dev *dev)
{
...
	struct ec_bhf_priv *priv = netdev_priv(net_dev);

	unregister_netdev(net_dev);
	free_netdev(net_dev);

	pci_iounmap(dev, priv->dma_io);
	pci_iounmap(dev, priv->io);
...
}

priv is netdev private data, but it is used
after free_netdev(). It can cause use-after-free when accessing priv
pointer. So, fix it by moving free_netdev() after pci_iounmap()
calls.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/[PII_REDACTED]cc74f3906acf8b6f256693e01530a2; https://git.kernel.org/stable/c/19f88ca68ccf8771276a606765239b167654f84a; https://git.kernel.org/stable/c/1cafc540b7bf1b6a5a77dc000205fe337ef6eba6
CVE: CVE-2021-47236
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: cdc_eem: fix tx fixup skb leak

when usbnet transmit a skb, eem fixup it in eem_tx_fixup(),
if skb_copy_expand() failed, it return NULL,
usbnet_start_xmit() will have no chance to free original skb.

fix it by free orginal skb in eem_tx_fixup() first,
then check skb clone status, if failed, return NULL to usbnet.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/05b2b9f7d24b5663d9b47427fe1555bdafd3ea02; https://git.kernel.org/stable/c/14184ec5c958b589ba934da7363a[PII_REDACTED]df; https://git.kernel.org/stable/c/1bcacd6088d61c0ac6a990d87975600a81f3247e
CVE: CVE-2021-47238
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: fix memory leak in ip_mc_add1_src

BUG: memory leak
unreferenced object 0xffff888101bc4c00 (size 32):
  comm "syz-executor527", pid 360, jiffies[PII_REDACTED] (age 19.329s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    01 00 00 00 00 00 00 00 ac 14 14 bb 00 00 02 00 ................
  backtrace:
    [<00000000f17c5244>] kmalloc include/linux/slab.h:558 [inline]
    [<00000000f17c5244>] kzalloc include/linux/slab.h:688 [inline]
    [<00000000f17c5244>] ip_mc_add1_src net/ipv4/igmp.c:1971 [inline]
    [<00000000f17c5244>] ip_mc_add_src+0x95f/0xdb0 net/ipv4/igmp.c:2095
    [<000000001cb99709>] ip_mc_source+0x84c/0xea0 net/ipv4/igmp.c:2416
    [<[PII_REDACTED]cf19ed>] do_ip_setsockopt net/ipv4/ip_sockglue.c:1294 [inline]
    [<[PII_REDACTED]cf19ed>] ip_setsockopt+0x114b/0x30c0 net/ipv4/ip_sockglue.c:1423
    [<[PII_REDACTED]7edfbc>] raw_setsockopt+0x13d/0x170 net/ipv4/raw.c:857
    [<00000000e75ca9bb>] __sys_setsockopt+0x158/0x270 net/socket.c:2117
    [<00000000bdb993a8>] __do_sys_setsockopt net/socket.c:2128 [inline]
    [<00000000bdb993a8>] __se_sys_setsockopt net/socket.c:2125 [inline]
    [<00000000bdb993a8>] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2125
    [<000000006a1ffdbd>] do_syscall_64+0x40/0x80 arch/x86/entry/common.c:47
    [<00000000b11467c4>] entry_SYSCALL_64_after_hwframe+0x44/0xae

In commit 24803f38a5c0 ("igmp: do not remove igmp souce list info when set
link down"), the ip_mc_clear_src() in ip_mc_destroy_dev() was removed,
because it was also called in igmpv3_clear_delrec().

Rough callgraph:

inetdev_destroy
-> ip_mc_destroy_dev
     -> igmpv3_clear_delrec
        -> ip_mc_clear_src
-> RCU_INIT_POINTER(dev->ip_ptr, NULL)

However, ip_mc_clear_src() called in igmpv3_clear_delrec() doesn't
release in_dev->mc_list->sources. And RCU_INIT_POINTER() assigns the
NULL to dev->ip_ptr. As a result, in_dev cannot be obtained through
inetdev_by_index() and then in_dev->mc_list->sources cannot be released
by ip_mc_del1_src() in the sock_close. Rough call sequence goes like:

sock_close
-> __sock_release
   -> inet_release
      -> ip_mc_drop_socket
         -> inetdev_by_index
         -> ip_mc_leave_src
            -> ip_mc_del_src
               -> ip_mc_del1_src

So we still need to call ip_mc_clear_src() in ip_mc_destroy_dev() to free
in_dev->mc_list->sources.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://git.kernel.org/stable/c/0dc13e75507faa17ac9f7562b4ef7bf8fcd78422; https://git.kernel.org/stable/c/1e28018b5c83d5073f74a6fb72eabe8370b2f501; https://git.kernel.org/stable/c/3dd2aeac2e9624cff9fa634710837e4f2e352758
CVE: CVE-2021-47239
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: usb: fix possible use-after-free in smsc75xx_bind

The commit 46a8b29c6306 ("net: usb: fix memory leak in smsc75xx_bind")
fails to clean up the work scheduled in smsc75xx_reset->
smsc75xx_set_multicast, which leads to use-after-free if the work is
scheduled to start after the deallocation. In addition, this patch
also removes a dangling pointer - dev->data[0].

This patch calls cancel_work_sync to cancel the scheduled work and set
the dangling pointer to NULL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/14616c372a7be01a2fb8c56c9d8debd232b9e43d; https://git.kernel.org/stable/c/2fc8300c9cfa5167fcb5b1a2a07db6f53e82f59b; https://git.kernel.org/stable/c/4252bf6c2b245f[PII_REDACTED]3d405ffad6ad5d5b
CVE: CVE-2021-47240
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: fix OOB Read in qrtr_endpoint_post

Syzbot reported slab-out-of-bounds Read in
qrtr_endpoint_post. The problem was in wrong
_size_ type:

	if (len != ALIGN(size, 4) + hdrlen)
		goto err;

If size from qrtr_hdr is[PII_REDACTED] (0xfffffffd), the result of
ALIGN(size, 4) will be 0. In case of len == hdrlen and size ==[PII_REDACTED]
in header this check won't fail and

	skb_put_data(skb, data + hdrlen, size);

will read out of bound from data, which is hdrlen allocated block.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/19892ab9c9d838e2e5a7744d36e4bb8b7c3292fe; https://git.kernel.org/stable/c/26b8d10703a9be45d6097946b2b4011f7dd2c56f; https://git.kernel.org/stable/c/960b08dd36de1e341e3eb43d1c547513e338f4f8
CVE: CVE-2021-47241
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

ethtool: strset: fix message length calculation

Outer nest for ETHTOOL_A_STRSET_STRINGSETS is not accounted for.
This may result in ETHTOOL_MSG_STRSET_GET producing a warning like:

    calculated message payload length (684) not sufficient
    WARNING: CPU: 0 PID: 30967 at net/ethtool/netlink.c:369 ethnl_default_doit+0x87a/0xa20

and a splat.

As usually with such warnings three conditions must be met for the warning
to trigger:
 - there must be no skb size rounding up (e.g. reply_size of 684);
 - string set must be per-device (so that the header gets populated);
 - the device name must be at least 12 characters long.

all in all with current user space it looks like reading priv flags
is the only place this could potentially happen. Or with syzbot :)
CVSS Score: 7.5 (HIGH)
CWE: CWE-266
References: https://git.kernel.org/stable/c/cfc7f0e70d649e6d2233fba0d9390b525677d971; https://git.kernel.org/stable/c/e175aef902697826d344ce3a[PII_REDACTED]fe898; https://git.kernel.org/stable/c/fb3a948143688e14e2cfd2a[PII_REDACTED]d0e5e92
CVE: CVE-2021-47242
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix soft lookup in subflow_error_report()

Maxim reported a soft lookup in subflow_error_report():

 watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [swapper/0:0]
 RIP: 0010:native_queued_spin_lock_slowpath
 RSP: 0018:ffffa859c0003bc0 EFLAGS: 00000202
 RAX: [PII_REDACTED] RBX: [PII_REDACTED] RCX: [PII_REDACTED]
 RDX: ffff9195c2772d88 RSI: [PII_REDACTED] RDI: ffff9195c2772d88
 RBP: ffff9195c2772d00 R08:[PII_REDACTED]0067b0 R09: c6e31da9eb1e44f4
 R10: ffff9195ef379700 R11: ffff9195edb50710 R12: ffff9195c2772d88
 R13: ffff9195f500e3d0 R14: ffff9195ef379700 R15: ffff9195ef379700
 FS:  [PII_REDACTED](0000) GS:ffff91961f400000(0000) knlGS:[PII_REDACTED]
 CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
 CR2: 000000c000407000 CR3: [PII_REDACTED] CR4:[PII_REDACTED]0006f0
 Call Trace:
  <IRQ>
 _raw_spin_lock_bh
 subflow_error_report
 mptcp_subflow_data_available
 __mptcp_move_skbs_from_subflow
 mptcp_data_ready
 tcp_data_queue
 tcp_rcv_established
 tcp_v4_do_rcv
 tcp_v4_rcv
 ip_protocol_deliver_rcu
 ip_local_deliver_finish
 __netif_receive_skb_one_core
 netif_receive_skb
 rtl8139_poll 8139too
 __napi_poll
 net_rx_action
 __do_softirq
 __irq_exit_rcu
 common_interrupt
  </IRQ>

The calling function - mptcp_subflow_data_available() - can be invoked
from different contexts:
- plain ssk socket lock
- ssk socket lock + mptcp_data_lock
- ssk socket lock + mptcp_data_lock + msk socket lock.

Since subflow_error_report() tries to acquire the mptcp_data_lock, the
latter two call chains will cause soft lookup.

This change addresses the issue moving the error reporting call to
outer functions, where the held locks list is known and the we can
acquire only the needed one.
CVSS Score: 7.8 (HIGH)
CWE: CWE-667
References: https://git.kernel.org/stable/c/27ef25c72373222aaa5fe7b5cd890ae9cfb89a8d; https://git.kernel.org/stable/c/499ada5073361c631f2a3c4a8aed44d53b6f82ec; https://git.kernel.org/stable/c/27ef25c72373222aaa5fe7b5cd890ae9cfb89a8d
CVE: CVE-2021-47243
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

sch_cake: Fix out of bounds when parsing TCP options and header

The TCP option parser in cake qdisc (cake_get_tcpopt and
cake_tcph_may_drop) could read one byte out of bounds. When the length
is 1, the execution flow gets into the loop, reads one byte of the
opcode, and if the opcode is neither TCPOPT_EOL nor TCPOPT_NOP, it reads
one more byte, which exceeds the length of 1.

This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").

v2 changes:

Added doff validation in cake_get_tcphdr to avoid parsing garbage as TCP
header. Although it wasn't strictly an out-of-bounds access (memory was
allocated), garbage values could be read where CAKE expected the TCP
header if doff was smaller than 5.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/3371392c60e2685af30bd4547badd880f5df2b3f; https://git.kernel.org/stable/c/3b491dd593d582ceeb27aa617600712a6bd14246; https://git.kernel.org/stable/c/4cefa061fc63f4d2dff5ab4083f43857cd7a2335
CVE: CVE-2021-47244
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

mptcp: Fix out of bounds when parsing TCP options

The TCP option parser in mptcp (mptcp_get_options) could read one byte
out of bounds. When the length is 1, the execution flow gets into the
loop, reads one byte of the opcode, and if the opcode is neither
TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds the
length of 1.

This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-125
References: https://git.kernel.org/stable/c/07718be265680dcf496347d475ce1a5442f55ad7; https://git.kernel.org/stable/c/73eeba71dc9932970befa009e68272a3d5ec4a58; https://git.kernel.org/stable/c/76e02b8905d0691e89e104a882f3bba7dd0f6037
CVE: CVE-2021-47245
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: synproxy: Fix out of bounds when parsing TCP options

The TCP option parser in synproxy (synproxy_parse_options) could read
one byte out of bounds. When the length is 1, the execution flow gets
into the loop, reads one byte of the opcode, and if the opcode is
neither TCPOPT_EOL nor TCPOPT_NOP, it reads one more byte, which exceeds
the length of 1.

This fix is inspired by commit 9609dad263f8 ("ipv4: tcp_input: fix stack
out of bounds when parsing TCP options.").

v2 changes:

Added an early return when length < 0 to avoid calling
skb_header_pointer with negative length.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/576c1526b4d83c44ad7b673cb841f36cbc6cb6c4; https://git.kernel.org/stable/c/5fc177ab759418c9537433e63301096e733fb915; https://git.kernel.org/stable/c/674b5f0c6a4fc5d3abce877048290cea6091fcb1
CVE: CVE-2021-47248
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

udp: fix race between close() and udp_abort()

Kaustubh reported and diagnosed a panic in udp_lib_lookup().
The root cause is udp_abort() racing with close(). Both
racing functions acquire the socket lock, but udp{v6}_destroy_sock()
release it before performing destructive actions.

We can't easily extend the socket lock scope to avoid the race,
instead use the SOCK_DEAD flag to prevent udp_abort from doing
any action when the critical race happens.

Diagnosed-and-tested-by: Kaustubh Pandey <kapandey@codeaurora.org>
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/2f73448041bd0682d4b552cfd314ace66107f1ad; https://git.kernel.org/stable/c/5a88477c1c85e4baa51e91f2d40f2166235daa56; https://git.kernel.org/stable/c/65310b0aff86980a011c7c7bfa487a333d4ca241
CVE: CVE-2021-47249
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: rds: fix memory leak in rds_recvmsg

Syzbot reported memory leak in rds. The problem
was in unputted refcount in case of error.

int rds_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
		int msg_flags)
{
...

	if (!rds_next_incoming(rs, &inc)) {
		...
	}

After this "if" inc refcount incremented and

	if (rds_cmsg_recv(inc, msg, rs)) {
		ret = -EFAULT;
		goto out;
	}
...
out:
	return ret;
}

in case of rds_cmsg_recv() fail the refcount won't be
decremented. And it's easy to see from ftrace log, that
rds_inc_addref() don't have rds_inc_put() pair in
rds_recvmsg() after rds_cmsg_recv()

 1)               |  rds_recvmsg() {
 1)   3.721 us    |    rds_inc_addref();
 1)   3.853 us    |    rds_message_inc_copy_to_user();
 1) + 10.395 us   |    rds_cmsg_recv();
 1) + 34.260 us   |  }
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/06b7cb0194bd1ede0dd27f3a946e7c0279fba44a; https://git.kernel.org/stable/c/1f79bc8ae81c05eb112a53f981cb2c244ee50d02; https://git.kernel.org/stable/c/2038cd15eacdf7512755c27686822e0052eb9042
CVE: CVE-2021-47250
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: fix memory leak in netlbl_cipsov4_add_std

Reported by syzkaller:
BUG: memory leak
unreferenced object 0xffff888105df7000 (size 64):
comm "syz-executor842", pid 360, jiffies[PII_REDACTED] (age 22.546s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e67ed558>] kmalloc include/linux/slab.h:590 [inline]
[<00000000e67ed558>] kzalloc include/linux/slab.h:720 [inline]
[<00000000e67ed558>] netlbl_cipsov4_add_std net/netlabel/netlabel_cipso_v4.c:145 [inline]
[<00000000e67ed558>] netlbl_cipsov4_add+0x390/0x2340 net/netlabel/netlabel_cipso_v4.c:416
[<[PII_REDACTED]>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 net/netlink/genetlink.c:739
[<[PII_REDACTED]4d7a1c>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
[<[PII_REDACTED]4d7a1c>] genl_rcv_msg+0x2bf/0x4f0 net/netlink/genetlink.c:800
[<00000000c0d6a995>] netlink_rcv_skb+0x134/0x3d0 net/netlink/af_netlink.c:2504
[<00000000d78b9d2c>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
[<[PII_REDACTED]33081b>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
[<[PII_REDACTED]33081b>] netlink_unicast+0x4a0/0x6a0 net/netlink/af_netlink.c:1340
[<00000000d5fd43b8>] netlink_sendmsg+0x789/0xc70 net/netlink/af_netlink.c:1929
[<000000000a2d1e40>] sock_sendmsg_nosec net/socket.c:654 [inline]
[<000000000a2d1e40>] sock_sendmsg+0x139/0x170 net/socket.c:674
[<[PII_REDACTED]1d1969>] ____sys_sendmsg+0x658/0x7d0 net/socket.c:2350
[<[PII_REDACTED]4e16bc>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2404
[<[PII_REDACTED]15e288>] __sys_sendmsg+0xd3/0x190 net/socket.c:2433
[<000000004ee8b6a5>] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:47
[<[PII_REDACTED]1c7cee>] entry_SYSCALL_64_after_hwframe+0x44/0xae

The memory of doi_def->map.std pointing is allocated in
netlbl_cipsov4_add_std, but no place has freed it. It should be
freed in cipso_v4_doi_free which frees the cipso DOI resource.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/086e92b1d68c6338535f715aad173f8cf4bfbc8c; https://git.kernel.org/stable/c/0ffb460be3abac86f884a8c548bb02724ec370f4; https://git.kernel.org/stable/c/[PII_REDACTED]82631994be4f4b3fe15e10a03c1dd4
CVE: CVE-2021-47251
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

mac80211: fix skb length check in ieee80211_scan_rx()

Replace hard-coded compile-time constants for header length check
with dynamic determination based on the frame type. Otherwise, we
hit a validation WARN_ON in cfg80211 later.

[style fixes, reword commit message]
CVSS Score: 7.8 (HIGH)
CWE: CWE-1284
References: https://git.kernel.org/stable/c/5a1cd67a801cf5ef989c4783e07b86a25b143126; https://git.kernel.org/stable/c/d1b949c70206178b12027f66edc088d40375b5cb; https://git.kernel.org/stable/c/e298aa358f0ca658406d524b6639fe389cb6e11e
CVE: CVE-2021-47252
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

batman-adv: Avoid WARN_ON timing related checks

The soft/batadv interface for a queued OGM can be changed during the time
the OGM was queued for transmission and when the OGM is actually
transmitted by the worker.

But WARN_ON must be used to denote kernel bugs and not to print simple
warnings. A warning can simply be printed using pr_warn.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/282baa8104af44e04c4af3e7f933b44267c7f86f; https://git.kernel.org/stable/c/2eb4e0b3631832a4291c8bf4c9db873f60b128c8; https://git.kernel.org/stable/c/45011f2973f6b52cf50db397bb27bf805f5f0e7f
CVE: CVE-2021-47253
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix potential memory leak in DMUB hw_init

[Why]
On resume we perform DMUB hw_init which allocates memory:
dm_resume->dm_dmub_hw_init->dc_dmub_srv_create->kzalloc
That results in memory leak in suspend/resume scenarios.

[How]
Allocate memory for the DC wrapper to DMUB only if it was not
allocated before.
No need to reallocate it on suspend/resume.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/9e8c2af[PII_REDACTED]15fa54a6c17e74988b5259c; https://git.kernel.org/stable/c/aa000f828e60ac15d6340f606ec4a673966f5b0b; https://git.kernel.org/stable/c/c5699e2d863f58221044efdc3fa712dd32d55cde
CVE: CVE-2021-47254
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix use-after-free in gfs2_glock_shrink_scan

The GLF_LRU flag is checked under lru_lock in gfs2_glock_remove_from_lru() to
remove the glock from the lru list in __gfs2_glock_put().

On the shrink scan path, the same flag is cleared under lru_lock but because
of cond_resched_lock(&lru_lock) in gfs2_dispose_glock_lru(), progress on the
put side can be made without deleting the glock from the lru list.

Keep GLF_LRU across the race window opened by cond_resched_lock(&lru_lock) to
ensure correct behavior on both sides - clear GLF_LRU after list_del under
lru_lock.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0364742decb0f02bc183404868b82896f7992595; https://git.kernel.org/stable/c/094bf5670e762afa243d2c41a5c4ab71c7447bf4; https://git.kernel.org/stable/c/1ab19c5de4c537ec0d9b21020395a5b5a6c059b2
CVE: CVE-2021-47255
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

kvm: LAPIC: Restore guard to prevent illegal APIC register access

Per the SDM, "any access that touches bytes 4 through 15 of an APIC
register may cause undefined behavior and must not be executed."
Worse, such an access in kvm_lapic_reg_read can result in a leak of
kernel stack contents. Prior to commit 01402cf81051 ("kvm: LAPIC:
write down valid APIC registers"), such an access was explicitly
disallowed. Restore the guard that was removed in that commit.
CVSS Score: 7.1 (HIGH)
References: https://git.kernel.org/stable/c/018685461a5b9a9a70e664ac77aef0d7415a3fd5; https://git.kernel.org/stable/c/218bf772bddd221489c38dde6ef8e917131161f6; https://git.kernel.org/stable/c/a2aff09807fbe4018c269d3773a629949058b210
CVE: CVE-2021-47256
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

mm/memory-failure: make sure wait for page writeback in memory_failure

Our syzkaller trigger the "BUG_ON(!list_empty(&inode->i_wb_list))" in
clear_inode:

  kernel BUG at fs/inode.c:519!
  Internal error: Oops - BUG: 0 [#1] SMP
  Modules linked in:
  Process syz-executor.0 (pid: 249, stack limit = 0x00000000a12409d7)
  CPU: 1 PID: 249 Comm: syz-executor.0 Not tainted 4.19.95
  Hardware name: linux,dummy-virt (DT)
  pstate: 80000005 (Nzcv daif -PAN -UAO)
  pc : clear_inode+0x280/0x2a8
  lr : clear_inode+0x280/0x2a8
  Call trace:
    clear_inode+0x280/0x2a8
    ext4_clear_inode+0x38/0xe8
    ext4_free_inode+0x130/0xc68
    ext4_evict_inode+0xb20/0xcb8
    evict+0x1a8/0x3c0
    iput+0x344/0x460
    do_unlinkat+0x260/0x410
    __arm64_sys_unlinkat+0x6c/0xc0
    el0_svc_common+0xdc/0x3b0
    el0_svc_handler+0xf8/0x160
    el0_svc+0x10/0x218
  Kernel panic - not syncing: Fatal exception

A crash dump of this problem show that someone called __munlock_pagevec
to clear page LRU without lock_page: do_mmap -> mmap_region -> do_munmap
-> munlock_vma_pages_range -> __munlock_pagevec.

As a result memory_failure will call identify_page_state without
wait_on_page_writeback.  And after truncate_error_page clear the mapping
of this page.  end_page_writeback won't call sb_clear_inode_writeback to
clear inode->i_wb_list.  That will trigger BUG_ON in clear_inode!

Fix it by checking PageWriteback too to help determine should we skip
wait_on_page_writeback.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/28788dc5c70597395b6b451dae4549bbaa8e2c56; https://git.kernel.org/stable/c/566345aaabac853aa866f53a219c4b02a6beb527; https://git.kernel.org/stable/c/6d210d547adc2218ef8b5bcf23518c5f2f1fd872
CVE: CVE-2021-47257
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ieee802154: fix null deref in parse dev addr

Fix a logic error that could result in a null deref if the user sets
the mode incorrectly for the given addr type.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1f95741981c899c[PII_REDACTED]fec5faa3c777185; https://git.kernel.org/stable/c/5f728ec65485625e30f46e5b4917ff023ad29ea0; https://git.kernel.org/stable/c/9fdd04918a452980631ecc499317881c1d120b70
CVE: CVE-2021-47258
Published: 2024-05-21
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Fix error handling of scsi_host_alloc()

After device is initialized via device_initialize(), or its name is set via
dev_set_name(), the device has to be freed via put_device().  Otherwise
device name will be leaked because it is allocated dynamically in
dev_set_name().

Fix the leak by replacing kfree() with put_device(). Since
scsi_host_dev_release() properly handles IDA and kthread removal, remove
special-casing these from the error handling as well.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2dc85045ae65b9302a1d2e2ddd7ce4c030153a6a; https://git.kernel.org/stable/c/45d83db[PII_REDACTED]b237c0c8248987df9d478e7; https://git.kernel.org/stable/c/66a834d092930cf41d809c0e989b13cd6f9ca006