deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-52678
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c

Before using list_first_entry, make sure to check that list is not
empty, if list is empty return -ENODATA.

Fixes the below:
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1347 kfd_create_indirect_link_prop() warn: can 'gpu_link' even be NULL?
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1428 kfd_add_peer_prop() warn: can 'iolink1' even be NULL?
drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1433 kfd_add_peer_prop() warn: can 'iolink2' even be NULL?
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754
References: https://git.kernel.org/stable/c/4525525cb7161d08f95d0e47025323dd10214313; https://git.kernel.org/stable/c/499839eca34ad62d43025ec0b46b80e77065f6d8; https://git.kernel.org/stable/c/4ac4e023ed7ab1c7c67d2d12b7b6198fcd099e5c
CVE: CVE-2023-52679
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

of: Fix double free in of_parse_phandle_with_args_map

In of_parse_phandle_with_args_map() the inner loop that
iterates through the map entries calls of_node_put(new)
to free the reference acquired by the previous iteration
of the inner loop. This assumes that the value of "new" is
NULL on the first iteration of the inner loop.

Make sure that this is true in all iterations of the outer
loop by setting "new" to NULL after its value is assigned to "cur".

Extend the unittest to detect the double free and add an additional
test case that actually triggers this path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/26b4d702c44f9e5cf3c5c001ae619a4a001889db; https://git.kernel.org/stable/c/[PII_REDACTED]527ce9e95a818ebbc4e6b293ffca21; https://git.kernel.org/stable/c/4dde83569832f9377362e50f[PII_REDACTED]c5db6b
CVE: CVE-2023-52680
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: scarlett2: Add missing error checks to *_ctl_get()

The *_ctl_get() functions which call scarlett2_update_*() were not
checking the return value. Fix to check the return value and pass to
the caller.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-252
References: https://git.kernel.org/stable/c/3a09488f4f67f7ade59b8ac62a6c7fb29439cf51; https://git.kernel.org/stable/c/50603a67daef161c78c814580d57f7f0be57167e; https://git.kernel.org/stable/c/773e38f73461ef2134a0d33a08f1668edde9b7c3
CVE: CVE-2023-52681
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

efivarfs: Free s_fs_info on unmount

Now that we allocate a s_fs_info struct on fs context creation, we
should ensure that we free it again when the superblock goes away.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/547713d502f7b4b8efccd409cff84d731a23853b; https://git.kernel.org/stable/c/92be3095c6ca1cdc46237839c6087555be9160e3; https://git.kernel.org/stable/c/48be1364dd387e375e1274b76af986cb8747be2c
CVE: CVE-2023-52682
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to wait on block writeback for post_read case

If inode is compressed, but not encrypted, it missed to call
f2fs_wait_on_block_writeback() to wait for GCed page writeback
in IPU write path.

Thread A				GC-Thread
					- f2fs_gc
					 - do_garbage_collect
					  - gc_data_segment
					   - move_data_block
					    - f2fs_submit_page_write
					     migrate normal cluster's block via
					     meta_inode's page cache
- f2fs_write_single_data_page
 - f2fs_do_write_data_page
  - f2fs_inplace_write_data
   - f2fs_submit_page_bio

IRQ
- f2fs_read_end_io
					IRQ
					old data overrides new data due to
					out-of-order GC and common IO.
					- f2fs_read_end_io
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/4535be[PII_REDACTED]3505e74e1b1ad4836a189bc2; https://git.kernel.org/stable/c/55fdc1c24a1d6229fe0ecf31335fb9a2eceaaa00; https://git.kernel.org/stable/c/9bfd5ea71521d0e522ba581c6ccc5db93759c0c3
CVE: CVE-2023-52683
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ACPI: LPIT: Avoid u32 multiplication overflow

In lpit_update_residency() there is a possibility of overflow
in multiplication, if tsc_khz is large enough (> UINT_MAX/1000).

Change multiplication to mul_u32_u32().

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/56d2eeda[PII_REDACTED]0836ee4dbd13b002311782; https://git.kernel.org/stable/c/647d1d50c31e60ef9ccb9756a8fdf863329f7aee; https://git.kernel.org/stable/c/6c38e791bde07d6ca2a0a619ff9b6837e0d5f9ad
CVE: CVE-2023-52684
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

firmware: qcom: qseecom: fix memory leaks in error paths

Fix instances of returning error codes directly instead of jumping to
the relevant labels where memory allocated for the SCM calls would be
freed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/6c57d7b593c4a4e60db65d5ce0fe1d9f79ccbe9b; https://git.kernel.org/stable/c/85fdbf6840455be64eac16bdfe0df3368ee3d0f0; https://git.kernel.org/stable/c/6c57d7b593c4a4e60db65d5ce0fe1d9f79ccbe9b
CVE: CVE-2023-52685
Published: 2024-05-17
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-52686
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/powernv: Add a null pointer check in opal_event_init()

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/8422d179cf46889c15ceff9ede48c5bfa4e7f0b4; https://git.kernel.org/stable/c/8649829a1dd25199bbf557b2621cedb4bf9b3050; https://git.kernel.org/stable/c/9a523e1da6d88c2034f946adfa4f74b236c95ca9
CVE: CVE-2023-52687
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

crypto: safexcel - Add error handling for dma_map_sg() calls

Macro dma_map_sg() may return 0 on error. This patch enables
checks in case of the macro failure and ensures unmapping of
previously mapped buffers with dma_unmap_sg().

Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-252
References: https://git.kernel.org/stable/c/4c0ac81a172a69a[PII_REDACTED]276672787e904ec; https://git.kernel.org/stable/c/8084b788c2fb1260f7d44c032d5124680b20d2b2; https://git.kernel.org/stable/c/87e02063d07708cac5bfe9fd3a6a242898758ac8
CVE: CVE-2023-52688
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix the error handler of rfkill config

When the core rfkill config throws error, it should free the
allocated resources. Currently it is not freeing the core pdev
create resources. Avoid this issue by calling the core pdev
destroy in the error handler of core rfkill config.

Found this issue in the code review and it is compile tested only.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/898d8b3e1414cd900492ee6a0b582f8095ba4a1a; https://git.kernel.org/stable/c/b4e593a7a22fa3c7d0550ef51c90b5c21f790aa8; https://git.kernel.org/stable/c/898d8b3e1414cd900492ee6a0b582f8095ba4a1a
CVE: CVE-2023-52689
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: scarlett2: Add missing mutex lock around get meter levels

As scarlett2_meter_ctl_get() uses meter_level_map[], the data_mutex
should be locked while accessing it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/74e3de7cdcc31ce75ab42350ae0946eff62a2da2; https://git.kernel.org/stable/c/993f7b42fa066b055e3a19b7f76ad8157c0927a0; https://git.kernel.org/stable/c/74e3de7cdcc31ce75ab42350ae0946eff62a2da2
CVE: CVE-2023-52690
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/powernv: Add a null pointer check to scom_debug_init_one()

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
Add a null pointer check, and release 'ent' to avoid memory leaks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1eefa93faf69188540b08b024794fa90b1d82e8b; https://git.kernel.org/stable/c/2a82c4439b903639e0a1f21990cd399fb0a49c19; https://git.kernel.org/stable/c/9a260f2dd827bbc82cc60eb4f4d8c22707d80742
CVE: CVE-2023-52691
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/pm: fix a double-free in si_dpm_init

When the allocation of
adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails,
amdgpu_free_extended_power_table is called to free some fields of adev.
However, when the control flow returns to si_dpm_sw_init, it goes to
label dpm_failed and calls si_dpm_fini, which calls
amdgpu_free_extended_power_table again and free those fields again. Thus
a double-free is triggered.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/06d95c99d5a4f5accdb79464076efe62e668c706; https://git.kernel.org/stable/c/2bf47c89bbaca2bae16581ef1b28aaec0ade0334; https://git.kernel.org/stable/c/ac16667237a82e2597e329eb9bc520d1cf9dff30
CVE: CVE-2023-52692
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config()

scarlett2_usb_set_config() calls scarlett2_usb_get() but was not
checking the result. Return the error if it fails rather than
continuing with an invalid value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-252
References: https://git.kernel.org/stable/c/145c5aa[PII_REDACTED]5ab47f35cff34bff8d0cea3; https://git.kernel.org/stable/c/51d5697e1c0380d482c3eab002bfc8d0be177e99; https://git.kernel.org/stable/c/996fde492ad9b9563ee483b363af40d7696a8467
CVE: CVE-2023-52693
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ACPI: video: check for error while searching for backlight device parent

If acpi_get_parent() called in acpi_video_dev_register_backlight()
fails, for example, because acpi_ut_acquire_mutex() fails inside
acpi_get_parent), this can lead to incorrect (uninitialized)
acpi_parent handle being passed to acpi_get_pci_dev() for detecting
the parent pci device.

Check acpi_get_parent() result and set parent device only in case of success.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1e3a2b9b4039bb4d136dca59fb31e06465e056f3; https://git.kernel.org/stable/c/2124c5bc22948fc4d09a23db4a8acdccc7d21e95; https://git.kernel.org/stable/c/39af144b6d01d9b40f52e5d773e653957e6c379c
CVE: CVE-2023-52694
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function

With tpd12s015_remove() marked with __exit this function is discarded
when the driver is compiled as a built-in. The result is that when the
driver unbinds there is no cleanup done which results in resource
leakage or worse.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/08ccff6ece35f08e8107e975903c370d849089e5; https://git.kernel.org/stable/c/53926e2a39629702f7f809d614b3ca89c2478205; https://git.kernel.org/stable/c/81f1bd85960b7a089a91e679ff7cd2524390bbf1
CVE: CVE-2023-52695
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Check writeback connectors in create_validate_stream_for_sink

[WHY & HOW]
This is to check connector type to avoid
unhandled null pointer for writeback connectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0fe85301b95077ac4fa4a91909d38b7341e81187; https://git.kernel.org/stable/c/dbf5d3d02987faa0eec3710dd687cd912362d7b5; https://git.kernel.org/stable/c/0fe85301b95077ac4fa4a91909d38b7341e81187
CVE: CVE-2023-52696
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/powernv: Add a null pointer check in opal_powercap_init()

kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://git.kernel.org/stable/c/69f95c5e9220f77ce7c540686b056c2b49e9a664; https://git.kernel.org/stable/c/6b58d16037217d0c64a2a09b655f370403ec7219; https://git.kernel.org/stable/c/9da4a56dd[PII_REDACTED]ca58aa8832b052ae910dc
CVE: CVE-2023-52697
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL

sof_sdw_rt_sdca_jack_exit() are used by different codecs, and some of
them use the same dai name.
For example, rt712 and rt713 both use "rt712-sdca-aif1" and
sof_sdw_rt_sdca_jack_exit().
As a result, sof_sdw_rt_sdca_jack_exit() will be called twice by
mc_dailink_exit_loop(). Set ctx->headset_codec_dev = NULL; after
put_device(ctx->headset_codec_dev); to avoid ctx->headset_codec_dev
being put twice.
CVSS Score: 7.1 (HIGH)
References: https://git.kernel.org/stable/c/582231a8c4f73ac153493687ecc1bed853e9c9ef; https://git.kernel.org/stable/c/a410d58117d6da4b7d41f3c91365f191d006bc3d; https://git.kernel.org/stable/c/e38e252dbceeef7d2f848017132efd68e9ae1416
CVE: CVE-2023-52698
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

calipso: fix memory leak in netlbl_calipso_add_pass()

If IPv6 support is disabled at boot (ipv6.disable=1),
the calipso_init() -> netlbl_calipso_ops_register() function isn't called,
and the netlbl_calipso_ops_get() function always returns NULL.
In this case, the netlbl_calipso_add_pass() function allocates memory
for the doi_def variable but doesn't free it with the calipso_doi_free().

BUG: memory leak
unreferenced object 0xffff888011d68180 (size 64):
  comm "syz-executor.1", pid 10746, jiffies[PII_REDACTED] (age 17.928s)
  hex dump (first 32 bytes):
    00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<...>] kmalloc include/linux/slab.h:552 [inline]
    [<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline]
    [<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111
    [<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739
    [<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
    [<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800
    [<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515
    [<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811
    [<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
    [<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339
    [<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934
    [<...>] sock_sendmsg_nosec net/socket.c:651 [inline]
    [<...>] sock_sendmsg+0x157/0x190 net/socket.c:671
    [<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342
    [<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396
    [<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429
    [<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
    [<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with Syzkaller

[PM: merged via the LSM tree at Jakub Kicinski request]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/321b3a5592c8a9d6b654c7c64833ea67dbb33149; https://git.kernel.org/stable/c/36e19f84634aaa94f543fedc0a[PII_REDACTED]8d53; https://git.kernel.org/stable/c/408bbd1e1746fe33e51f4c81c2febd7d3841d031
CVE: CVE-2024-35839
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: replace physindev with physinif in nf_bridge_info

An skb can be added to a neigh->arp_queue while waiting for an arp
reply. Where original skb's skb->dev can be different to neigh's
neigh->dev. For instance in case of bridging dnated skb from one veth to
another, the skb would be added to a neigh->arp_queue of the bridge.

As skb->dev can be reset back to nf_bridge->physindev and used, and as
there is no explicit mechanism that prevents this physindev from been
freed under us (for instance neigh_flush_dev doesn't cleanup skbs from
different device's neigh queue) we can crash on e.g. this stack:

arp_process
  neigh_update
    skb = __skb_dequeue(&neigh->arp_queue)
      neigh_resolve_output(..., skb)
        ...
          br_nf_dev_xmit
            br_nf_pre_routing_finish_bridge_slow
              skb->dev = nf_bridge->physindev
              br_handle_frame_finish

Let's use plain ifindex instead of net_device link. To peek into the
original net_device we will use dev_get_by_index_rcu(). Thus either we
get device and are safe to use it or we don't get it and drop skb.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/544add1f1cfb78c3dfa3e6edcf4668f6be5e730c; https://git.kernel.org/stable/c/7ae19ee81ca56b13c50a78de6c47d5b8fdc9d97b; https://git.kernel.org/stable/c/9325e3188a9cf3f69fc6f32af59844bbc5b90547
CVE: CVE-2024-35840
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()

subflow_finish_connect() uses four fields (backup, join_id, thmac, none)
that may contain garbage unless OPTION_MPTCP_MPJ_SYNACK has been set
in mptcp_parse_option()
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/413b[PII_REDACTED]72135d2977975dbff8b7f2c453; https://git.kernel.org/stable/c/51e4cb032d49ce094605f27e45eabebc0408893c; https://git.kernel.org/stable/c/76e8de7273a22a00d27e9b8b7d4d043d6433416a
CVE: CVE-2024-35841
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

net: tls, fix WARNIING in __sk_msg_free

A splice with MSG_SPLICE_PAGES will cause tls code to use the
tls_sw_sendmsg_splice path in the TLS sendmsg code to move the user
provided pages from the msg into the msg_pl. This will loop over the
msg until msg_pl is full, checked by sk_msg_full(msg_pl). The user
can also set the MORE flag to hint stack to delay sending until receiving
more pages and ideally a full buffer.

If the user adds more pages to the msg than can fit in the msg_pl
scatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send
the buffer anyways.

What actually happens though is we abort the msg to msg_pl scatterlist
setup and then because we forget to set 'full record' indicating we
can no longer consume data without a send we fallthrough to the 'continue'
path which will check if msg_data_left(msg) has more bytes to send and
then attempts to fit them in the already full msg_pl. Then next
iteration of sender doing send will encounter a full msg_pl and throw
the warning in the syzbot report.

To fix simply check if we have a full_record in splice code path and
if not send the msg regardless of MORE flag.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/02e368eb1444a4af649b73cbe2edd51780511d86; https://git.kernel.org/stable/c/294e7ea85f34748f04e5f3f9dba6f6b911d31aa8; https://git.kernel.org/stable/c/dc9dfc8dc629e42f2234e3327b75324ffc752bc9
CVE: CVE-2024-35842
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: mediatek: sof-common: Add NULL check for normal_link string

It's not granted that all entries of struct sof_conn_stream declare
a `normal_link` (a non-SOF, direct link) string, and this is the case
for SoCs that support only SOF paths (hence do not support both direct
and SOF usecases).

For example, in the case of MT8188 there is no normal_link string in
any of the sof_conn_stream entries and there will be more drivers
doing that in the future.

To avoid possible NULL pointer KPs, add a NULL check for `normal_link`.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/b1d3db6740d0997ffc6e5a0d96ef7cbd62b35fdd; https://git.kernel.org/stable/c/cad471227a37c0c7c080bfc9ed01b53750e82afe; https://git.kernel.org/stable/c/cde6ca5872bf67744dffa875a7cb521ab007b7ef
CVE: CVE-2024-35843
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/vt-d: Use device rbtree in iopf reporting path

The existing I/O page fault handler currently locates the PCI device by
calling pci_get_domain_bus_and_slot(). This function searches the list
of all PCI devices until the desired device is found. To improve lookup
efficiency, replace it with device_rbtree_find() to search the device
within the probed device rbtree.

The I/O page fault is initiated by the device, which does not have any
synchronization mechanism with the software to ensure that the device
stays in the probed device tree. Theoretically, a device could be released
by the IOMMU subsystem after device_rbtree_find() and before
iopf_get_dev_fault_param(), which would cause a use-after-free problem.

Add a mutex to synchronize the I/O page fault reporting path and the IOMMU
release device path. This lock doesn't introduce any performance overhead,
as the conflict between I/O page fault reporting and device releasing is
very rare.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15; https://git.kernel.org/stable/c/def054b01a867822254e1dda13d587f5c7a99e2a; https://git.kernel.org/stable/c/3d39238991e745c5df85785604f037f35d9d1b15
CVE: CVE-2024-35844
Published: 2024-05-17
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: compress: fix reserve_cblocks counting error when out of space

When a file only needs one direct_node, performing the following
operations will cause the file to be unrepairable:

unisoc # ./f2fs_io compress test.apk
unisoc #df -h | grep dm-48
/dev/block/dm-48 112G 112G 1.2M 100% /data

unisoc # ./f2fs_io release_cblocks test.apk
924
unisoc # df -h | grep dm-48
/dev/block/dm-48 112G 112G 4.8M 100% /data

unisoc # dd if=/dev/random of=file4 bs=1M count=3
3145728 bytes (3.0 M) copied, 0.025 s, 120 M/s
unisoc # df -h | grep dm-48
/dev/block/dm-48 112G 112G 1.8M 100% /data

unisoc # ./f2fs_io reserve_cblocks test.apk
F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device

adb reboot
unisoc # df -h  | grep dm-48
/dev/block/dm-48             112G 112G   11M 100% /data
unisoc # ./f2fs_io reserve_cblocks test.apk
0

This is because the file has only one direct_node. After returning
to -ENOSPC, reserved_blocks += ret will not be executed. As a result,
the reserved_blocks at this time is still 0, which is not the real
number of reserved blocks. Therefore, fsck cannot be set to repair
the file.

After this patch, the fsck flag will be set to fix this problem.

unisoc # df -h | grep dm-48
/dev/block/dm-48             112G 112G  1.8M 100% /data
unisoc # ./f2fs_io reserve_cblocks test.apk
F2FS_IOC_RESERVE_COMPRESS_BLOCKS failed: No space left on device

adb reboot then fsck will be executed
unisoc # df -h  | grep dm-48
/dev/block/dm-48             112G 112G   11M 100% /data
unisoc # ./f2fs_io reserve_cblocks test.apk
924
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2f6d721e14b69d6e1251f69fa238b48e8374e25f; https://git.kernel.org/stable/c/569c198c9e2093fd29cc071856a4e548fda506bc; https://git.kernel.org/stable/c/889846dfc8ee2cf31148a44bfd2faeb2faadc685