deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-49446
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

nvdimm: Fix firmware activation deadlock scenarios

Lockdep reports the following deadlock scenarios for CXL root device
power-management, device_prepare(), operations, and device_shutdown()
operations for 'nd_region' devices:

 Chain exists of:
   &nvdimm_region_key --> &nvdimm_bus->reconfig_mutex --> system_transition_mutex

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(system_transition_mutex);
                                lock(&nvdimm_bus->reconfig_mutex);
                                lock(system_transition_mutex);
   lock(&nvdimm_region_key);

 Chain exists of:
   &cxl_nvdimm_bridge_key --> acpi_scan_lock --> &cxl_root_key

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(&cxl_root_key);
                                lock(acpi_scan_lock);
                                lock(&cxl_root_key);
   lock(&cxl_nvdimm_bridge_key);

These stem from holding nvdimm_bus_lock() over hibernate_quiet_exec()
which walks the entire system device topology taking device_lock() along
the way. The nvdimm_bus_lock() is protecting against unregistration,
multiple simultaneous ops callers, and preventing activate_show() from
racing activate_store(). For the first 2, the lock is redundant.
Unregistration already flushes all ops users, and sysfs already prevents
multiple threads to be active in an ops handler at the same time. For
the last userspace should already be waiting for its last
activate_store() to complete, and does not need activate_show() to flush
the write side, so this lock usage can be deleted in these attributes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/2f97ebc58d5fc83ca1528cd553fa725472ab3ca8; https://git.kernel.org/stable/c/2fd853fdb40afc052de338693df1372f2ead7be7; https://git.kernel.org/stable/c/641649f31e20df630310f5c22f26c071acc676d4
CVE: CVE-2022-49447
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: hisi: Add missing of_node_put after of_find_compatible_node

of_find_compatible_node  will increment the refcount of the returned
device_node. Calling of_node_put() to avoid the refcount leak
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/21a3effe446dd6dc5eed7fe897c2f9b88c9a5d6d; https://git.kernel.org/stable/c/45d211668d33c49d73f5213e8c2b[PII_REDACTED]7c; https://git.kernel.org/stable/c/46cb7868811d025c3d29c10d18b3422db1cf20d5
CVE: CVE-2022-49448
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

soc: bcm: Check for NULL return of devm_kzalloc()

As the potential failure of allocation, devm_kzalloc() may return NULL.  Then
the 'pd->pmb' and the follow lines of code may bring null pointer dereference.

Therefore, it is better to check the return value of devm_kzalloc() to avoid
this confusion.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/36339ea7bae4943be01c8e9545e46e334591fecd; https://git.kernel.org/stable/c/5650e103bfc[PII_REDACTED]5861fb8aafb3947da6e; https://git.kernel.org/stable/c/b48b98743b568bb219152ba2e15af6ef0d3d8a9b
CVE: CVE-2022-49449
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources()

It will cause null-ptr-deref when using 'res', if platform_get_resource()
returns NULL, so move using 'res' after devm_ioremap_resource() that
will check it to avoid null-ptr-deref.
And use devm_platform_get_and_ioremap_resource() to simplify code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/01f9e02e0f13df3fd291676dc80054e977be1601; https://git.kernel.org/stable/c/2f661477c2bb8068194dbba9738d05219f111c6e; https://git.kernel.org/stable/c/34c719b8fdfbd0c7c54cae56e6b0f16e9f8bf03e
CVE: CVE-2022-49450
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Fix listen() setting the bar too high for the prealloc rings

AF_RXRPC's listen() handler lets you set the backlog up to 32 (if you bump
up the sysctl), but whilst the preallocation circular buffers have 32 slots
in them, one of them has to be a dead slot because we're using CIRC_CNT().

This means that listen(rxrpc_sock, 32) will cause an oops when the socket
is closed because rxrpc_service_prealloc_one() allocated one too many calls
and rxrpc_discard_prealloc() won't then be able to get rid of them because
it'll think the ring is empty.  rxrpc_release_calls_on_socket() then tries
to abort them, but oopses because call->peer isn't yet set.

Fix this by setting the maximum backlog to RXRPC_BACKLOG_MAX - 1 to match
the ring capacity.

 BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 ...
 RIP: 0010:rxrpc_send_abort_packet+0x73/0x240 [rxrpc]
 Call Trace:
  <TASK>
  ? __wake_up_common_lock+0x7a/0x90
  ? rxrpc_notify_socket+0x8e/0x140 [rxrpc]
  ? rxrpc_abort_call+0x4c/0x60 [rxrpc]
  rxrpc_release_calls_on_socket+0x107/0x1a0 [rxrpc]
  rxrpc_release+0xc9/0x1c0 [rxrpc]
  __sock_release+0x37/0xa0
  sock_close+0x11/0x20
  __fput+0x89/0x240
  task_work_run+0x59/0x90
  do_exit+0x319/0xaa0
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/369de57492c4f1a42563c5a3bd365822ca3bfc79; https://git.kernel.org/stable/c/4a3a78b7918bdd723d8c7c9786522ca969bffcc4; https://git.kernel.org/stable/c/5b4826657d36c218e9f08e8d3223b0edce3de88f
CVE: CVE-2022-49451
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scmi: Fix list protocols enumeration in the base protocol

While enumerating protocols implemented by the SCMI platform using
BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is
currently validated in an improper way since the check employs a sum
between unsigned integers that could overflow and cause the check itself
to be silently bypassed if the returned value 'loop_num_ret' is big
enough.

Fix the validation avoiding the addition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://git.kernel.org/stable/c/1052f22e127d0c34c3387bb389424ba1c61491ff; https://git.kernel.org/stable/c/2ccfcd7a09c826516edcfe464b05071961aada3f; https://git.kernel.org/stable/c/444a2d27fe9867d0da4b28fc45b793f32e099ab8
CVE: CVE-2022-49452
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

dpaa2-eth: retrieve the virtual address before dma_unmap

The TSO header was DMA unmapped before the virtual address was retrieved
and then used to free the buffer. This meant that we were actually
removing the DMA map and then trying to search for it to help in
retrieving the virtual address. This lead to a invalid virtual address
being used in the kfree call.

Fix this by calling dpaa2_iova_to_virt() prior to the dma_unmap call.

[  487.231819] Unable to handle kernel paging request at virtual address fffffd[PII_REDACTED]

(...)

[  487.354061] Hardware name: SolidRun LX2160A Honeycomb (DT)
[  487.359535] pstate: a0400005 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  487.366485] pc : kfree+0xac/0x304
[  487.369799] lr : kfree+0x204/0x304
[  487.373191] sp : ffff80000c4eb120
[  487.376493] x29: ffff80000c4eb120 x28: ffff662240c46400 x27: [PII_REDACTED]
[  487.383621] x26: [PII_REDACTED] x25: ffff662246da0cc0 x24: ffff66224af78000
[  487.390748] x23: ffffad184f4ce008 x22: ffffad[PII_REDACTED] x21: ffffad1838d13cec
[  487.397874] x20: ffff6601c0000000 x19: fffffd[PII_REDACTED] x18: [PII_REDACTED]
[  487.405000] x17: ffffb910cdc49000 x16: ffffad184d7d9080 x15: [PII_REDACTED]
[  487.412126] x14: [PII_REDACTED] x13:[PII_REDACTED]00ffff x12: [PII_REDACTED]
[  487.419252] x11: [PII_REDACTED] x10: [PII_REDACTED] x9 : ffffad184d7d927c
[  487.426379] x8 : [PII_REDACTED] x7 : 0000000ffffffd1d x6 : ffff662240a94900
[  487.433505] x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 : ffffad184f4ce008
[  487.440632] x2 : ffff662243eec000 x1 : [PII_REDACTED] x0 : fffffc[PII_REDACTED]
[  487.447758] Call trace:
[  487.450194]  kfree+0xac/0x304
[  487.453151]  dpaa2_eth_free_tx_fd.isra.0+0x33c/0x3e0 [fsl_dpaa2_eth]
[  487.459507]  dpaa2_eth_tx_conf+0x100/0x2e0 [fsl_dpaa2_eth]
[  487.464989]  dpaa2_eth_poll+0xdc/0x380 [fsl_dpaa2_eth]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/06d129946a71f3159b3b40ee95549183edf2c79d; https://git.kernel.org/stable/c/ba5fe3dd4833bbc03609c5c0c2dd2cea5fa5addf
CVE: CVE-2022-49453
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc

The allocation funciton devm_kcalloc may fail and return a null pointer,
which would cause a null-pointer dereference later.
It might be better to check it and directly return -ENOMEM just like the
usage of devm_kcalloc in previous code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/01ba41a359622ab256ce4d4f8b94c67165ae3daf; https://git.kernel.org/stable/c/05efc4591f80582b6fe53366b70b6a35a42fd255; https://git.kernel.org/stable/c/7cef9274fa1b8506949d74bc45aef072b890824a
CVE: CVE-2022-49454
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup()

The of_find_compatible_node() function returns a node pointer with
refcount incremented, We should use of_node_put() on it when done
Add the missing of_node_put() to release the refcount.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/09b2d906d78ddf5042b1f3e0091835fc6997e8a4; https://git.kernel.org/stable/c/214e0d8fe4a813ae6ffd62bc2dfe7544c20914f4; https://git.kernel.org/stable/c/4cef4237d6c37257cb6ddc397723e9c0dded0efe
CVE: CVE-2022-49455
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

misc: ocxl: fix possible double free in ocxl_file_register_afu

info_release() will be called in device_unregister() when info->dev's
reference count is 0. So there is no need to call ocxl_afu_put() and
kfree() again.

Fix this by adding free_minor() and return to err_unregister error path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://git.kernel.org/stable/c/252768d32e92c1214aeebb5fec0844ca479bcf5c; https://git.kernel.org/stable/c/8fb674216835e1f0c143762696d645facebb4685; https://git.kernel.org/stable/c/950cf957fe34d40d63dfa3bf[PII_REDACTED]b6491e
CVE: CVE-2022-49456
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

bonding: fix missed rcu protection

When removing the rcu_read_lock in bond_ethtool_get_ts_info() as
discussed [1], I didn't notice it could be called via setsockopt,
which doesn't hold rcu lock, as syzbot pointed:

  stack backtrace:
  CPU: 0 PID: 3599 Comm: syz-executor317 Not tainted 5.18.0-rc5-syzkaller-01392-g01f4685797a5 #0
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
  Call Trace:
   <TASK>
   __dump_stack lib/dump_stack.c:88 [inline]
   dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
   bond_option_active_slave_get_rcu include/net/bonding.h:353 [inline]
   bond_ethtool_get_ts_info+0x32c/0x3a0 drivers/net/bonding/bond_main.c:5595
   __ethtool_get_ts_info+0x173/0x240 net/ethtool/common.c:554
   ethtool_get_phc_vclocks+0x99/0x110 net/ethtool/common.c:568
   sock_timestamping_bind_phc net/core/sock.c:869 [inline]
   sock_set_timestamping+0x3a3/0x7e0 net/core/sock.c:916
   sock_setsockopt+0x543/0x2ec0 net/core/sock.c:1221
   __sys_setsockopt+0x55e/0x6a0 net/socket.c:2223
   __do_sys_setsockopt net/socket.c:2238 [inline]
   __se_sys_setsockopt net/socket.c:2235 [inline]
   __x64_sys_setsockopt+0xba/0x150 net/socket.c:2235
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x44/0xae
  RIP: 0033:0x7f8902c8eb39

Fix it by adding rcu_read_lock and take a ref on the real_dev.
Since dev_hold() and dev_put() can take NULL these days, we can
skip checking if real_dev exist.

[1] https://lore.kernel.org/netdev/27[PII_REDACTED]439@famine/
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1b66a533c47d29b38af8e05fbb53b609a5ba3a4e; https://git.kernel.org/stable/c/85eed460681da71b359ed906bce4d800081db854; https://git.kernel.org/stable/c/9b80ccda233fa6c59de411bf889cc4d0e028f2c7
CVE: CVE-2022-49457
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: versatile: Add missing of_node_put in dcscb_init

The device_node pointer is returned by of_find_compatible_node
with refcount incremented. We should use of_node_put() to avoid
the refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/23b44f9c649bbef10b45fa33080cd8b4166800ae; https://git.kernel.org/stable/c/2d7b23db35254b7d46e852967090c64cdccf24da; https://git.kernel.org/stable/c/3c6006faed9aba5144b33176d061031a9be66954
CVE: CVE-2022-49459
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe

platform_get_resource() may return NULL, add proper check to
avoid potential NULL dereferencing.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/61621e042c22b47d1eadee617bdd26835294b425; https://git.kernel.org/stable/c/79098339ac2065f4b4352ef[PII_REDACTED]b6f47e6; https://git.kernel.org/stable/c/b3461ccaa5d2588568d865faee285512ad448049
CVE: CVE-2022-49460
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

PM / devfreq: rk3399_dmc: Disable edev on remove()

Otherwise we hit an unablanced enable-count when unbinding the DFI
device:

[ 1279.659119] ------------[ cut here ]------------
[ 1279.659179] WARNING: CPU: 2 PID: 5638 at drivers/devfreq/devfreq-event.c:360 devfreq_event_remove_edev+0x84/0x8c
...
[ 1279.659352] Hardware name: Google Kevin (DT)
[ 1279.659363] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
[ 1279.659371] pc : devfreq_event_remove_edev+0x84/0x8c
[ 1279.659380] lr : devm_devfreq_event_release+0x1c/0x28
...
[ 1279.659571] Call trace:
[ 1279.659582]  devfreq_event_remove_edev+0x84/0x8c
[ 1279.659590]  devm_devfreq_event_release+0x1c/0x28
[ 1279.659602]  release_nodes+0x1cc/0x244
[ 1279.659611]  devres_release_all+0x44/0x60
[ 1279.659621]  device_release_driver_internal+0x11c/0x1ac
[ 1279.659629]  device_driver_detach+0x20/0x2c
[ 1279.659641]  unbind_store+0x7c/0xb0
[ 1279.659650]  drv_attr_store+0x2c/0x40
[ 1279.659663]  sysfs_kf_write+0x44/0x58
[ 1279.659672]  kernfs_fop_write_iter+0xf4/0x190
[ 1279.659684]  vfs_write+0x2b0/0x2e4
[ 1279.659693]  ksys_write+0x80/0xec
[ 1279.659701]  __arm64_sys_write+0x24/0x30
[ 1279.659714]  el0_svc_common+0xf0/0x1d8
[ 1279.659724]  do_el0_svc_compat+0x28/0x3c
[ 1279.659738]  el0_svc_compat+0x10/0x1c
[ 1279.659746]  el0_sync_compat_handler+0xa8/0xcc
[ 1279.659758]  el0_sync_compat+0x188/0x1c0
[ 1279.659768] ---[ end trace cec200e5094155b4 ]---
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804; https://git.kernel.org/stable/c/664736e2cc09e504ce58ec61164d029d1f2651bb; https://git.kernel.org/stable/c/86b091b6894c449d2734de7aa7d79ccb33ffd97d
CVE: CVE-2022-49461
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

amt: fix memory leak for advertisement message

When a gateway receives an advertisement message, it extracts relay
information and then it should be freed.
But the advertisement handler doesn't free it.
So, memory leak would occur.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/19bb2d57eac86a368839a92117d8a10ab7183623; https://git.kernel.org/stable/c/e7322da399fb86a2072f008b56f7160afa1b2051; https://git.kernel.org/stable/c/fe29794c3585d039fefebaa2b5a4932a627ad4fd
CVE: CVE-2022-49462
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.

a6xx_gmu_init() passes the node to of_find_device_by_node()
and of_dma_configure(), of_find_device_by_node() will takes its
reference, of_dma_configure() doesn't need the node after usage.

Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/06907a374f1b74f8f2fb30720dc6df81331e4fb5; https://git.kernel.org/stable/c/48e82ce8cdb19c20a5020fa446b286d6a147450c; https://git.kernel.org/stable/c/65ddbc0d26824e2a5d6154d01d8cf[PII_REDACTED]3
CVE: CVE-2022-49463
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe

of_find_node_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/09700c504d8e63faffd2a2235074e8c5d130cb8f; https://git.kernel.org/stable/c/0ec10303c10833c1bcba7a1bde2f297e494d5464; https://git.kernel.org/stable/c/3ade442ea5d3512a3c67984489ab4d8a6fb3b29f
CVE: CVE-2022-49464
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

erofs: fix buffer copy overflow of ztailpacking feature

I got some KASAN report as below:

[   46.959738] ==================================================================
[   46.960430] BUG: KASAN: use-after-free in z_erofs_shifted_transform+0x2bd/0x370
[   46.960430] Read of size 4074 at addr ffff8880300c2f8e by task fssum/188
...
[   46.960430] Call Trace:
[   46.960430]  <TASK>
[   46.960430]  dump_stack_lvl+0x41/0x5e
[   46.960430]  print_report.cold+0xb2/0x6b7
[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370
[   46.960430]  kasan_report+0x8a/0x140
[   46.960430]  ? z_erofs_shifted_transform+0x2bd/0x370
[   46.960430]  kasan_check_range+0x14d/0x1d0
[   46.960430]  memcpy+0x20/0x60
[   46.960430]  z_erofs_shifted_transform+0x2bd/0x370
[   46.960430]  z_erofs_decompress_pcluster+0xaae/0x1080

The root cause is that the tail pcluster won't be a complete filesystem
block anymore. So if ztailpacking is used, the second part of an
uncompressed tail pcluster may not be ``rq->pageofs_out``.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/4d53a625f29074e7b8236c2c0e0922edb7608df9; https://git.kernel.org/stable/c/6b59e1907f58cf877c563dcf013159eb9f994b64; https://git.kernel.org/stable/c/dcbe6803fffd387f72b48c2373b5f5ed12a5804b
CVE: CVE-2022-49465
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

blk-throttle: Set BIO_THROTTLED when bio has been throttled

1.In current process, all bio will set the BIO_THROTTLED flag
after __blk_throtl_bio().

2.If bio needs to be throttled, it will start the timer and
stop submit bio directly. Bio will submit in
blk_throtl_dispatch_work_fn() when the timer expires.But in
the current process, if bio is throttled. The BIO_THROTTLED
will be set to bio after timer start. If the bio has been
completed, it may cause use-after-free blow.

BUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70
Read of size 2 at addr ffff88801b8902d4 by task fio/26380

 dump_stack+0x9b/0xce
 print_address_description.constprop.6+0x3e/0x60
 kasan_report.cold.9+0x22/0x3a
 blk_throtl_bio+0x12f0/0x2c70
 submit_bio_checks+0x701/0x1550
 submit_bio_noacct+0x83/0xc80
 submit_bio+0xa7/0x330
 mpage_readahead+0x380/0x500
 read_pages+0x1c1/0xbf0
 page_cache_ra_unbounded+0x471/0x6f0
 do_page_cache_ra+0xda/0x110
 ondemand_readahead+0x442/0xae0
 page_cache_async_ra+0x210/0x300
 generic_file_buffered_read+0x4d9/0x2130
 generic_file_read_iter+0x315/0x490
 blkdev_read_iter+0x113/0x1b0
 aio_read+0x2ad/0x450
 io_submit_one+0xc8e/0x1d60
 __se_sys_io_submit+0x125/0x350
 do_syscall_64+0x2d/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Allocated by task 26380:
 kasan_save_stack+0x19/0x40
 __kasan_kmalloc.constprop.2+0xc1/0xd0
 kmem_cache_alloc+0x146/0x440
 mempool_alloc+0x125/0x2f0
 bio_alloc_bioset+0x353/0x590
 mpage_alloc+0x3b/0x240
 do_mpage_readpage+0xddf/0x1ef0
 mpage_readahead+0x264/0x500
 read_pages+0x1c1/0xbf0
 page_cache_ra_unbounded+0x471/0x6f0
 do_page_cache_ra+0xda/0x110
 ondemand_readahead+0x442/0xae0
 page_cache_async_ra+0x210/0x300
 generic_file_buffered_read+0x4d9/0x2130
 generic_file_read_iter+0x315/0x490
 blkdev_read_iter+0x113/0x1b0
 aio_read+0x2ad/0x450
 io_submit_one+0xc8e/0x1d60
 __se_sys_io_submit+0x125/0x350
 do_syscall_64+0x2d/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 0:
 kasan_save_stack+0x19/0x40
 kasan_set_track+0x1c/0x30
 kasan_set_free_info+0x1b/0x30
 __kasan_slab_free+0x111/0x160
 kmem_cache_free+0x94/0x460
 mempool_free+0xd6/0x320
 bio_free+0xe0/0x130
 bio_put+0xab/0xe0
 bio_endio+0x3a6/0x5d0
 blk_update_request+0x590/0x1370
 scsi_end_request+0x7d/0x400
 scsi_io_completion+0x1aa/0xe50
 scsi_softirq_done+0x11b/0x240
 blk_mq_complete_request+0xd4/0x120
 scsi_mq_done+0xf0/0x200
 virtscsi_vq_done+0xbc/0x150
 vring_interrupt+0x179/0x390
 __handle_irq_event_percpu+0xf7/0x490
 handle_irq_event_percpu+0x7b/0x160
 handle_irq_event+0xcc/0x170
 handle_edge_irq+0x215/0xb20
 common_interrupt+0x60/0x120
 asm_common_interrupt+0x1e/0x40

Fix this by move BIO_THROTTLED set into the queue_lock.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/047ea38d41d90d748bca812a43339632f52ba715; https://git.kernel.org/stable/c/0cfc8a0fb07cde61915e4a77c4794c47de3114a4; https://git.kernel.org/stable/c/24ba80efaf6e772f6132465fad08e20fb4767da7
CVE: CVE-2022-49466
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

regulator: scmi: Fix refcount leak in scmi_regulator_probe

of_find_node_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/299a002161c7bfb72e99ba45e5b660aecc344ea0; https://git.kernel.org/stable/c/4a59c763ef9b68c711dc2fd2ef4a6648da5480ee; https://git.kernel.org/stable/c/68d6c8476fd4f448e70e0ab31ff972838ac41dae
CVE: CVE-2022-49467
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()

drm_gem_object_lookup will call drm_gem_object_get inside. So cursor_bo
needs to be put when msm_gem_get_and_pin_iova fails.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/33546183c16c7b9650682dc610bedd732d9c6919; https://git.kernel.org/stable/c/449374565f349d4233beec811d4286fdfe5de44b; https://git.kernel.org/stable/c/656aa3c51fc662064f17179b38ec3ce43af53bca