deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-43830
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

leds: trigger: Unregister sysfs attributes before calling deactivate()

Triggers which have trigger specific sysfs attributes typically store
related data in trigger-data allocated by the activate() callback and
freed by the deactivate() callback.

Calling device_remove_groups() after calling deactivate() leaves a window
where the sysfs attributes show/store functions could be called after
deactivation and then operate on the just freed trigger-data.

Move the device_remove_groups() call to before deactivate() to close
this race window.

This also makes the deactivation path properly do things in reverse order
of the activation path which calls the activate() callback before calling
device_add_groups().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0788a6f3523d3686a9eed5ea1e6fcce6841277b2; https://git.kernel.org/stable/c/09c1583f0e10c918855d6e7540a79461a353e5d6; https://git.kernel.org/stable/c/3fb6a9d67cfd812a547ac73ec02e1077c26c640d
CVE: CVE-2024-43831
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: Handle invalid decoder vsi

Handle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi
is valid for future use.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1c109f23b271a02b9bb195c173fab41e3285a8db; https://git.kernel.org/stable/c/59d438f8e02ca641c58d77e1feffa000ff809e9f; https://git.kernel.org/stable/c/cdf05ae76198c513836bde4eb55f099c44773280
CVE: CVE-2024-43832
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/uv: Don't call folio_wait_writeback() without a folio reference

folio_wait_writeback() requires that no spinlocks are held and that
a folio reference is held, as documented. After we dropped the PTL, the
folio could get freed concurrently. So grab a temporary reference.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1a1eb2f3fc453dcd52726d13e[PII_REDACTED]89cb7; https://git.kernel.org/stable/c/3f29f6537f54d74e64bac0a390fb2e26da25800d; https://git.kernel.org/stable/c/8736604ef53359a718c246087cd21dcec232d2fb
CVE: CVE-2024-43833
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

media: v4l: async: Fix NULL pointer dereference in adding ancillary links

In v4l2_async_create_ancillary_links(), ancillary links are created for
lens and flash sub-devices. These are sub-device to sub-device links and
if the async notifier is related to a V4L2 device, the source sub-device
of the ancillary link is NULL, leading to a NULL pointer dereference.
Check the notifier's sd field is non-NULL in
v4l2_async_create_ancillary_links().

[Sakari Ailus: Reword the subject and commit messages slightly.]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/249212ceb4187783af3801c57b92a5a25d410621; https://git.kernel.org/stable/c/9b4667ea67854f0b116fe22ad11ef5628c5b5b5f; https://git.kernel.org/stable/c/b87e28050d9b0959de24574d587825cfab2f13fb
CVE: CVE-2024-43835
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

virtio_net: Fix napi_skb_cache_put warning

After the commit bdacf3e34945 ("net: Use nested-BH locking for
napi_alloc_cache.") was merged, the following warning began to appear:

	 WARNING: CPU: 5 PID: 1 at net/core/skbuff.c:1451 napi_skb_cache_put+0x82/0x4b0

	  __warn+0x12f/0x340
	  napi_skb_cache_put+0x82/0x4b0
	  napi_skb_cache_put+0x82/0x4b0
	  report_bug+0x165/0x370
	  handle_bug+0x3d/0x80
	  exc_invalid_op+0x1a/0x50
	  asm_exc_invalid_op+0x1a/0x20
	  __free_old_xmit+0x1c8/0x510
	  napi_skb_cache_put+0x82/0x4b0
	  __free_old_xmit+0x1c8/0x510
	  __free_old_xmit+0x1c8/0x510
	  __pfx___free_old_xmit+0x10/0x10

The issue arises because virtio is assuming it's running in NAPI context
even when it's not, such as in the netpoll case.

To resolve this, modify virtnet_poll_tx() to only set NAPI when budget
is available. Same for virtnet_poll_cleantx(), which always assumed that
it was in a NAPI context.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/468a729b78895893d0e580ceea49bed8ada2a2bd; https://git.kernel.org/stable/c/6b5325f2457521bbece29499970c0117a648c620; https://git.kernel.org/stable/c/842a97b5e44f0c8a9fc356fe976e0e13ddcf7783
CVE: CVE-2024-43836
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ethtool: pse-pd: Fix possible null-deref

Fix a possible null dereference when a PSE supports both c33 and PoDL, but
only one of the netlink attributes is specified. The c33 or PoDL PSE
capabilities are already validated in the ethnl_set_pse_validate() call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4cddb0f15ea9c62f81b4889ea69a99368cc63a86; https://git.kernel.org/stable/c/e187690b125a297499eadeec53c32c5ed6d7436a
CVE: CVE-2024-43838
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: fix overflow check in adjust_jmp_off()

adjust_jmp_off() incorrectly used the insn->imm field for all overflow check,
which is incorrect as that should only be done or the BPF_JMP32 | BPF_JA case,
not the general jump instruction case. Fix it by using insn->off for overflow
check in the general case.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://git.kernel.org/stable/c/345652866a8869825a2a582ee5a28d75141f184a; https://git.kernel.org/stable/c/4a04b4f0de59dd5c621e78f15803ee0b0544eeb8
CVE: CVE-2024-43839
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

bna: adjust 'name' buf size of bna_tcb and bna_ccb structures

To have enough space to write all possible sprintf() args. Currently
'name' size is 16, but the first '%s' specifier may already need at
least 16 characters, since 'bnad->netdev->name' is used there.

For '%d' specifiers, assume that they require:
 * 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8
 * 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX
   is 16

And replace sprintf with snprintf.

Detected using the static analysis tool - Svace.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/6ce46045f9b90d952602e2c0b8886cfadf860bf1; https://git.kernel.org/stable/c/6d20c4044ab4d0e6a99aa35853e66f0aed5589e3; https://git.kernel.org/stable/c/ab748dd10d8742561f2980fea08ffb4f0cacfdef
CVE: CVE-2024-43840
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf, arm64: Fix trampoline for BPF_TRAMP_F_CALL_ORIG

When BPF_TRAMP_F_CALL_ORIG is set, the trampoline calls
__bpf_tramp_enter() and __bpf_tramp_exit() functions, passing them
the struct bpf_tramp_image *im pointer as an argument in R0.

The trampoline generation code uses emit_addr_mov_i64() to emit
instructions for moving the bpf_tramp_image address into R0, but
emit_addr_mov_i64() assumes the address to be in the vmalloc() space
and uses only 48 bits. Because bpf_tramp_image is allocated using
kzalloc(), its address can use more than 48-bits, in this case the
trampoline will pass an invalid address to __bpf_tramp_enter/exit()
causing a kernel crash.

Fix this by using emit_a64_mov_i64() in place of emit_addr_mov_i64()
as it can work with addresses that are greater than 48-bits.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/[PII_REDACTED]97b2f00ff4fd9da2c892defa6418d8; https://git.kernel.org/stable/c/19d3c179a37730caf600a97fed3794feac2b197b; https://git.kernel.org/stable/c/6d218fcc707d6b2c3616b6cd24b948fd4825cfec
CVE: CVE-2024-43841
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: virt_wifi: avoid reporting connection success with wrong SSID

When user issues a connection with a different SSID than the one
virt_wifi has advertised, the __cfg80211_connect_result() will
trigger the warning: WARN_ON(bss_not_found).

The issue is because the connection code in virt_wifi does not
check the SSID from user space (it only checks the BSSID), and
virt_wifi will call cfg80211_connect_result() with WLAN_STATUS_SUCCESS
even if the SSID is different from the one virt_wifi has advertised.
Eventually cfg80211 won't be able to find the cfg80211_bss and generate
the warning.

Fixed it by checking the SSID (from user space) in the connection code.
CVSS Score: 3.3 (LOW)
References: https://git.kernel.org/stable/c/05c4488a0e446c6ccde9f22b573950665e1cd414; https://git.kernel.org/stable/c/36e92b5edc8e0daa18e[PII_REDACTED]802ce3fbc29; https://git.kernel.org/stable/c/416d3c1538df005195721a200b0371d39636e05d
CVE: CVE-2024-43842
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter()

In rtw89_sta_info_get_iter() 'status->he_gi' is compared to array size.
But then 'rate->he_gi' is used as array index instead of 'status->he_gi'.
This can lead to go beyond array boundaries in case of 'rate->he_gi' is
not equal to 'status->he_gi' and is bigger than array size. Looks like
"copy-paste" mistake.

Fix this mistake by replacing 'rate->he_gi' with 'status->he_gi'.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://git.kernel.org/stable/c/7a0edc3d83aff3a48813d78c9cad9daf38decc74; https://git.kernel.org/stable/c/85099c7ce4f9e64c66aa397cd9a37473637ab891; https://git.kernel.org/stable/c/96ae4de5bc4c8ba39fd072369398f59495b73f58
CVE: CVE-2024-43843
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv, bpf: Fix out-of-bounds issue when preparing trampoline image

We get the size of the trampoline image during the dry run phase and
allocate memory based on that size. The allocated image will then be
populated with instructions during the real patch phase. But after
commit 26ef208c209a ("bpf: Use arch_bpf_trampoline_size"), the `im`
argument is inconsistent in the dry run and real patch phase. This may
cause emit_imm in RV64 to generate a different number of instructions
when generating the 'im' address, potentially causing out-of-bounds
issues. Let's emit the maximum number of instructions for the "im"
address during dry run to fix this problem.
CVSS Score: 7.8 (HIGH)
CWE: CWE-131
References: https://git.kernel.org/stable/c/3e6a1b1b179abb643ec3560c02bc3082bc92285f; https://git.kernel.org/stable/c/9f1e16fb1fc9826001c69e0551d51fbbcd2d74e9
CVE: CVE-2024-43845
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

udf: Fix bogus checksum computation in udf_rename()

Syzbot reports uninitialized memory access in udf_rename() when updating
checksum of '..' directory entry of a moved directory. This is indeed
true as we pass on-stack diriter.fi to the udf_update_tag() and because
that has only struct fileIdentDesc included in it and not the impUse or
name fields, the checksumming function is going to checksum random stack
contents beyond the end of the structure. This is actually harmless
because the following udf_fiiter_write_fi() will recompute the checksum
from on-disk buffers where everything is properly included. So all that
is needed is just removing the bogus calculation.
CVSS Score: 3.3 (LOW)
CWE: CWE-908
References: https://git.kernel.org/stable/c/27ab33854873e6fb958cb074681a0107cc2ecc4c; https://git.kernel.org/stable/c/40d7b3ed52449d36143bab8d3e70926aa61a60f4; https://git.kernel.org/stable/c/9c439311c13fc6faab[PII_REDACTED]c9b8b500c83b
CVE: CVE-2024-43846
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

lib: objagg: Fix general protection fault

The library supports aggregation of objects into other objects only if
the parent object does not have a parent itself. That is, nesting is not
supported.

Aggregation happens in two cases: Without and with hints, where hints
are a pre-computed recommendation on how to aggregate the provided
objects.

Nesting is not possible in the first case due to a check that prevents
it, but in the second case there is no check because the assumption is
that nesting cannot happen when creating objects based on hints. The
violation of this assumption leads to various warnings and eventually to
a general protection fault [1].

Before fixing the root cause, error out when nesting happens and warn.

[1]
general protection fault, probably for non-canonical address 0xdead000000000d90: 0000 [#1] PREEMPT SMP PTI
CPU: 1 PID: 1083 Comm: kworker/1:9 Tainted: G        W          6.9.0-rc6-custom-gd9b4f1cca7fb #7
Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019
Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work
RIP: 0010:mlxsw_sp_acl_erp_bf_insert+0x25/0x80
[...]
Call Trace:
 <TASK>
 mlxsw_sp_acl_atcam_entry_add+0x256/0x3c0
 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0
 mlxsw_sp_acl_tcam_vchunk_migrate_one+0x16b/0x270
 mlxsw_sp_acl_tcam_vregion_rehash_work+0xbe/0x510
 process_one_work+0x151/0x370
 worker_thread+0x2cb/0x3e0
 kthread+0xd0/0x100
 ret_from_fork+0x34/0x50
 ret_from_fork_asm+0x1a/0x30
 </TASK>
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1936fa05a180834c3b52e0439a6bddc07814d3eb; https://git.kernel.org/stable/c/22ae17a267f4812861f0c644186c3421ff97dbfc; https://git.kernel.org/stable/c/499f742fed42e74f1321f4b12ca196a66a2b49fc
CVE: CVE-2024-43847
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix invalid memory access while processing fragmented packets

The monitor ring and the reo reinject ring share the same ring mask index.
When the driver receives an interrupt for the reo reinject ring, the
monitor ring is also processed, leading to invalid memory access. Since
monitor support is not yet enabled in ath12k, the ring mask for the monitor
ring should be removed.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.1.1-00209-QCAHKSWPL_SILICONZ-1
CVSS Score: 8.8 (HIGH)
References: https://git.kernel.org/stable/c/073f9f249eecd64ab9d59c91c4a23cfdcc02afe4; https://git.kernel.org/stable/c/36fc66a7d9ca3e5c6eac25362cac63f83df8bed6; https://git.kernel.org/stable/c/8126f82dab7bd8b2e04799342b19fff0a1fd8575
CVE: CVE-2024-43848
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix TTLM teardown work

The worker calculates the wrong sdata pointer, so if it ever
runs, it'll crash. Fix that.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2fe0a605d083b884490ee4de02be071b5b4291b1; https://git.kernel.org/stable/c/[PII_REDACTED]c8478ef043c42029f4f6144c096eac
CVE: CVE-2024-43849
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: pdr: protect locator_addr with the main mutex

If the service locator server is restarted fast enough, the PDR can
rewrite locator_addr fields concurrently. Protect them by placing
modification of those fields under the main pdr->lock.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/107924c14e3ddd85119ca43c26a4ee1056fa9b84; https://git.kernel.org/stable/c/3e815626d73e05152a8142f6e44aecc4133e6e08; https://git.kernel.org/stable/c/475a77fb3f0e1d527f56c60b79f5879661df5b80
CVE: CVE-2024-43850
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: icc-bwmon: Fix refcount imbalance seen during bwmon_remove

The following warning is seen during bwmon_remove due to refcount
imbalance, fix this by releasing the OPPs after use.

Logs:
WARNING: at drivers/opp/core.c:1640 _opp_table_kref_release+0x150/0x158
Hardware name: Qualcomm Technologies, Inc. X1E80100 CRD (DT)
...
Call trace:
_opp_table_kref_release+0x150/0x158
dev_pm_opp_remove_table+0x100/0x1b4
devm_pm_opp_of_table_release+0x10/0x1c
devm_action_release+0x14/0x20
devres_release_all+0xa4/0x104
device_unbind_cleanup+0x18/0x60
device_release_driver_internal+0x1ec/0x228
driver_detach+0x50/0x98
bus_remove_driver+0x6c/0xbc
driver_unregister+0x30/0x60
platform_driver_unregister+0x14/0x20
bwmon_driver_exit+0x18/0x524 [icc_bwmon]
__arm64_sys_delete_module+0x184/0x264
invoke_syscall+0x48/0x118
el0_svc_common.constprop.0+0xc8/0xe8
do_el0_svc+0x20/0x2c
el0_svc+0x34/0xdc
el0t_64_sync_handler+0x13c/0x158
el0t_64_sync+0x190/0x194
--[ end trace [PII_REDACTED] ]---
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/24086640ab39396eb1a92d1cb1cd2f31b2677c52; https://git.kernel.org/stable/c/4100d4d019f8e140be1d4d3a9d8d93c1285f5d1c; https://git.kernel.org/stable/c/aad41f4c169bcb800ae88123799bdf8cdec3d366
CVE: CVE-2024-43851
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

soc: xilinx: rename cpu_number1 to dummy_cpu_number

The per cpu variable cpu_number1 is passed to xlnx_event_handler as
argument "dev_id", but it is not used in this function. So drop the
initialization of this variable and rename it to dummy_cpu_number.
This patch is to fix the following call trace when the kernel option
CONFIG_DEBUG_ATOMIC_SLEEP is enabled:

BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274
    in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0
    preempt_count: 1, expected: 0
    CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0 #53
    Hardware name: Xilinx Versal vmk180 Eval board rev1.1 (QSPI) (DT)
    Call trace:
     dump_backtrace+0xd0/0xe0
     show_stack+0x18/0x40
     dump_stack_lvl+0x7c/0xa0
     dump_stack+0x18/0x34
     __might_resched+0x10c/0x140
     __might_sleep+0x4c/0xa0
     __kmem_cache_alloc_node+0xf4/0x168
     kmalloc_trace+0x28/0x38
     __request_percpu_irq+0x74/0x138
     xlnx_event_manager_probe+0xf8/0x298
     platform_probe+0x68/0xd8
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4a95449dd975e2ea6629a034f3e74b46c9634916; https://git.kernel.org/stable/c/a5e507fadab76393cbc12344ebd65a417a09aa46; https://git.kernel.org/stable/c/a96e60a6ea6818fd37b1853283a512c49af38cf5
CVE: CVE-2024-43852
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

hwmon: (ltc2991) re-order conditions to fix off by one bug

LTC2991_T_INT_CH_NR is 4.  The st->temp_en[] array has LTC2991_MAX_CHANNEL
(4) elements.  Thus if "channel" is equal to LTC2991_T_INT_CH_NR then we
have read one element beyond the end of the array.  Flip the conditions
around so that we check if "channel" is valid before using it as an array
index.
CVSS Score: 7.8 (HIGH)
CWE: CWE-193
References: https://git.kernel.org/stable/c/99bf7c2eccff82760fa23ce967cc67c8c219c6a6; https://git.kernel.org/stable/c/c180311c0a520692e2d0e9ca44dcd6c2ff1b41c4
CVE: CVE-2024-43853
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Prevent UAF in proc_cpuset_show()

An UAF can happen when /proc/cpuset is read as reported in [1].

This can be reproduced by the following methods:
1.add an mdelay(1000) before acquiring the cgroup_lock In the
 cgroup_path_ns function.
2.$cat /proc/<pid>/cpuset   repeatly.
3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/
$umount /sys/fs/cgroup/cpuset/   repeatly.

The race that cause this bug can be shown as below:

(umount)		|	(cat /proc/<pid>/cpuset)
css_release		|	proc_cpuset_show
css_release_work_fn	|	css = task_get_css(tsk, cpuset_cgrp_id);
css_free_rwork_fn	|	cgroup_path_ns(css->cgroup, ...);
cgroup_destroy_root	|	mutex_lock(&cgroup_mutex);
rebind_subsystems	|
cgroup_free_root 	|
			|	// cgrp was freed, UAF
			|	cgroup_path_ns_locked(cgrp,..);

When the cpuset is initialized, the root node top_cpuset.css.cgrp
will point to &cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will
allocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated
&cgroup_root.cgrp. When the umount operation is executed,
top_cpuset.css.cgrp will be rebound to &cgrp_dfl_root.cgrp.

The problem is that when rebinding to cgrp_dfl_root, there are cases
where the cgroup_root allocated by setting up the root for cgroup v1
is cached. This could lead to a Use-After-Free (UAF) if it is
subsequently freed. The descendant cgroups of cgroup v1 can only be
freed after the css is released. However, the css of the root will never
be released, yet the cgroup_root should be freed when it is unmounted.
This means that obtaining a reference to the css of the root does
not guarantee that css.cgrp->root will not be freed.

Fix this problem by using rcu_read_lock in proc_cpuset_show().
As cgroup_root is kfree_rcu after commit d23b5c577715
("cgroup: Make operations on the cgroup root_list RCU safe"),
css->cgroup won't be freed during the critical section.
To call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to
replace task_get_css with task_css.

[1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/10aeaa47e4aa2432f29b3e5376df96d7dac5537a; https://git.kernel.org/stable/c/1be59c97c83ccd67a519d8a49486b3a8a73ca28a; https://git.kernel.org/stable/c/27d6dbdc6485d68075a0ebf8544d6425c1ed84bb
CVE: CVE-2024-43854
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

block: initialize integrity buffer to zero before writing it to media

Metadata added by bio_integrity_prep is using plain kmalloc, which leads
to random kernel memory being written media.  For PI metadata this is
limited to the app tag that isn't used by kernel generated metadata,
but for non-PI metadata the entire buffer leaks kernel memory.

Fix this by adding the __GFP_ZERO flag to allocations for writes.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/129f95948a96105c1fad8e612c9097763e88ac5f; https://git.kernel.org/stable/c/23a19655fb56f241e592041156dfb1c6d04da644; https://git.kernel.org/stable/c/3fd11fe4f20756b4c0847f755a64cd96f8c6a005