deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-42272
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

sched: act_ct: take care of padding in struct zones_ht_key

Blamed commit increased lookup key size from 2 bytes to 16 bytes,
because zones_ht_key got a struct net pointer.

Make sure rhashtable_lookup() is not using the padding bytes
which are not initialized.

 BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
 BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline]
 BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
 BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
 BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
  rht_ptr_rcu include/linux/rhashtable.h:376 [inline]
  __rhashtable_lookup include/linux/rhashtable.h:607 [inline]
  rhashtable_lookup include/linux/rhashtable.h:646 [inline]
  rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline]
  tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329
  tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
  tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425
  tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488
  tcf_action_add net/sched/act_api.c:2061 [inline]
  tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118
  rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647
  netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550
  rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665
  netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
  netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357
  netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901
  sock_sendmsg_nosec net/socket.c:730 [inline]
  __sock_sendmsg+0x30f/0x380 net/socket.c:745
  ____sys_sendmsg+0x877/0xb60 net/socket.c:2597
  ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651
  __sys_sendmsg net/socket.c:2680 [inline]
  __do_sys_sendmsg net/socket.c:2689 [inline]
  __se_sys_sendmsg net/socket.c:2687 [inline]
  __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687
  x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47
  do_syscall_x64 arch/x86/entry/common.c:52 [inline]
  do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Local variable key created at:
  tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324
  tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/2191a54f63225b548fd8346be3611c3219a24738; https://git.kernel.org/stable/c/3a5b68869dbe14f1157c6a24ac71923db060eeab; https://git.kernel.org/stable/c/3ddefcb8f75e312535e2e7d5fef9932019ba60f2
CVE: CVE-2024-42273
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: assign CURSEG_ALL_DATA_ATGC if blkaddr is valid

mkdir /mnt/test/comp
f2fs_io setflags compression /mnt/test/comp
dd if=/dev/zero of=/mnt/test/comp/testfile bs=16k count=1
truncate --size 13 /mnt/test/comp/testfile

In the above scenario, we can get a BUG_ON.
 kernel BUG at fs/f2fs/segment.c:3589!
 Call Trace:
  do_write_page+0x78/0x390 [f2fs]
  f2fs_outplace_write_data+0x62/0xb0 [f2fs]
  f2fs_do_write_data_page+0x275/0x740 [f2fs]
  f2fs_write_single_data_page+0x1dc/0x8f0 [f2fs]
  f2fs_write_multi_pages+0x1e5/0xae0 [f2fs]
  f2fs_write_cache_pages+0xab1/0xc60 [f2fs]
  f2fs_write_data_pages+0x2d8/0x330 [f2fs]
  do_writepages+0xcf/0x270
  __writeback_single_inode+0x44/0x350
  writeback_sb_inodes+0x242/0x530
  __writeback_inodes_wb+0x54/0xf0
  wb_writeback+0x192/0x310
  wb_workfn+0x30d/0x400

The reason is we gave CURSEG_ALL_DATA_ATGC to COMPR_ADDR where the
page was set the gcing flag by set_cluster_dirty().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0cd[PII_REDACTED]6d6f1ca17ef192c6759bb60791; https://git.kernel.org/stable/c/4239571c5db46a42f723b8fa[PII_REDACTED]c34439; https://git.kernel.org/stable/c/5fd057160ab240dd816ae09b625395d54c297de1
CVE: CVE-2024-42274
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

Revert "ALSA: firewire-lib: operate for period elapse event in process context"

Commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event
in process context") removed the process context workqueue from
amdtp_domain_stream_pcm_pointer() and update_pcm_pointers() to remove
its overhead.

With RME Fireface 800, this lead to a regression since
Kernels 5.14.0, causing an AB/BA deadlock competition for the
substream lock with eventual system freeze under ALSA operation:

thread 0:
    * (lock A) acquire substream lock by
	snd_pcm_stream_lock_irq() in
	snd_pcm_status64()
    * (lock B) wait for tasklet to finish by calling
    	tasklet_unlock_spin_wait() in
	tasklet_disable_in_atomic() in
	ohci_flush_iso_completions() of ohci.c

thread 1:
    * (lock B) enter tasklet
    * (lock A) attempt to acquire substream lock,
    	waiting for it to be released:
	snd_pcm_stream_lock_irqsave() in
    	snd_pcm_period_elapsed() in
	update_pcm_pointers() in
	process_ctx_payloads() in
	process_rx_packets() of amdtp-stream.c

? tasklet_unlock_spin_wait
 </NMI>
 <TASK>
ohci_flush_iso_completions firewire_ohci
amdtp_domain_stream_pcm_pointer snd_firewire_lib
snd_pcm_update_hw_ptr0 snd_pcm
snd_pcm_status64 snd_pcm

? native_queued_spin_lock_slowpath
 </NMI>
 <IRQ>
_raw_spin_lock_irqsave
snd_pcm_period_elapsed snd_pcm
process_rx_packets snd_firewire_lib
irq_target_callback snd_firewire_lib
handle_it_packet firewire_ohci
context_tasklet firewire_ohci

Restore the process context work queue to prevent deadlock
AB/BA deadlock competition for ALSA substream lock of
snd_pcm_stream_lock_irq() in snd_pcm_status64()
and snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed().

revert commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period
elapse event in process context")

Replace inline description to prevent future deadlock.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667
References: https://git.kernel.org/stable/c/36c255db5a25edd42d1aca48e38b8e95ee5fd9ef; https://git.kernel.org/stable/c/3dab73ab925a51ab05543b491bf17463a48ca323; https://git.kernel.org/stable/c/7c07220cf634002f93a87ca2252a32766850f2d1
CVE: CVE-2024-42275
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/client: Fix error code in drm_client_buffer_vmap_local()

This function accidentally returns zero/success on the failure path.
It leads to locking issues and an uninitialized *map_copy in the
caller.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-824
References: https://git.kernel.org/stable/c/b5fbf924f125ba3638cfdc21c0515eb7e76264ca; https://git.kernel.org/stable/c/c0f[PII_REDACTED]37f52e2f16ee8747fb330bcf074
CVE: CVE-2024-42276
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: add missing condition check for existence of mapped data

nvme_map_data() is called when request has physical segments, hence
the nvme_unmap_data() should have same condition to avoid dereference.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3f8ec1d6b0ebd8268307d52be8301973fa5a01ec; https://git.kernel.org/stable/c/70100fe721840bf6d8e5abd25b8bffe4d2e049b7; https://git.kernel.org/stable/c/77848b379e9f85a08048a2c8b3b4a7e8396f5f83
CVE: CVE-2024-42277
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en

In sprd_iommu_cleanup() before calling function sprd_iommu_hw_en()
dom->sdev is equal to NULL, which leads to null dereference.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/630482ee0653decf9e2482ac6181897eb6cde5b8; https://git.kernel.org/stable/c/8c79ceb4ecf823e6ec10fee6febb0fca3de79922; https://git.kernel.org/stable/c/b62841e49a2b7938f6fdeaaf93fb57e4eb880bdb
CVE: CVE-2024-42278
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: TAS2781: Fix tasdev_load_calibrated_data()

This function has a reversed if statement so it's either a no-op or it
leads to a NULL dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/51be301d29d674ff328dfcf23705851f326f35b3; https://git.kernel.org/stable/c/6d98741dbd1309a6f2d7cffbb10a8f036ec3ca06; https://git.kernel.org/stable/c/92c78222168e9035a9bfb8841c2e56ce23e51f73
CVE: CVE-2024-42279
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: microchip-core: ensure TX and RX FIFOs are empty at start of a transfer

While transmitting with rx_len == 0, the RX FIFO is not going to be
emptied in the interrupt handler. A subsequent transfer could then
read crap from the previous transfer out of the RX FIFO into the
start RX buffer. The core provides a register that will empty the RX and
TX FIFOs, so do that before each transfer.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3feda3677e8bbe833c3a62a4091377a08f015b80; https://git.kernel.org/stable/c/45e03d35229b680b79dfea1103a1f2f07d0b5d75; https://git.kernel.org/stable/c/9cf71eb0faef4bff01df4264841b8465382d7927
CVE: CVE-2024-42280
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

mISDN: Fix a use after free in hfcmulti_tx()

Don't dereference *sp after calling dev_kfree_skb(*sp).
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/4d8b642985ae24f4b3656438eb8489834a17bb80; https://git.kernel.org/stable/c/61ab751451f5ebd0b98e02276a44e23a10110402; https://git.kernel.org/stable/c/70db2c84631f50e02e6b32b543700699dd395803
CVE: CVE-2024-42281
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix a segment issue when downgrading gso_size

Linearize the skb when downgrading gso_size because it may trigger a
BUG_ON() later when the skb is segmented as described in [1,2].
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/11ec79f5c7f[PII_REDACTED]4039bc1551023edd6b2; https://git.kernel.org/stable/c/a689f5eb13a90f892a088865478b3cd39f53d5dc; https://git.kernel.org/stable/c/c3496314c53e7e82ddb544c825defc3e8c0e45cf
CVE: CVE-2024-42282
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling

Move the freeing of the dummy net_device from mtk_free_dev() to
mtk_remove().

Previously, if alloc_netdev_dummy() failed in mtk_probe(),
eth->dummy_dev would be NULL. The error path would then call
mtk_free_dev(), which in turn called free_netdev() assuming dummy_dev
was allocated (but it was not), potentially causing a NULL pointer
dereference.

By moving free_netdev() to mtk_remove(), we ensure it's only called when
mtk_probe() has succeeded and dummy_dev is fully allocated. This
addresses a potential NULL pointer dereference detected by Smatch[1].
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/16f3a28cf5f876a7f3550d8f4c870a7b41bcfaef; https://git.kernel.org/stable/c/af6bd5c9901b13a26eaf4d57d97a[PII_REDACTED]96
CVE: CVE-2024-42283
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

net: nexthop: Initialize all fields in dumped nexthops

struct nexthop_grp contains two reserved fields that are not initialized by
nla_put_nh_group(), and carry garbage. This can be observed e.g. with
strace (edited for clarity):

    # ip nexthop add id 1 dev lo
    # ip nexthop add id 101 group 1
    # strace -e recvmsg ip nexthop get id 101
    ...
    recvmsg(... [{nla_len=12, nla_type=NHA_GROUP},
                 [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52

The fields are reserved and therefore not currently used. But as they are, they
leak kernel memory, and the fact they are not just zero complicates repurposing
of the fields for new ends. Initialize the full structure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://git.kernel.org/stable/c/1377de719652d868f5317ba8398b7e74c5f0430b; https://git.kernel.org/stable/c/5cc4d71dda2dd4f1520f40e634a527022e48ccd8; https://git.kernel.org/stable/c/6d745cd0e9720282cd291d36b9db528aea18add2
CVE: CVE-2024-42284
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

tipc: Return non-zero value from tipc_udp_addr2str() on error

tipc_udp_addr2str() should return non-zero value if the UDP media
address is invalid. Otherwise, a buffer overflow access can occur in
tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP
media address.
CVSS Score: 7.8 (HIGH)
CWE: CWE-754
References: https://git.kernel.org/stable/c/253405541be2f15ffebdeac2f4cf4b7e9144d12f; https://git.kernel.org/stable/c/2abe350db1aa599eeebc6892237d0bce0f1de62a; https://git.kernel.org/stable/c/5eea[PII_REDACTED]3680c8170358bcba43227bd69
CVE: CVE-2024-42285
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/iwcm: Fix a use-after-free related to destroying CM IDs

iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with
an existing struct iw_cm_id (cm_id) as follows:

        conn_id->cm_id.iw = cm_id;
        cm_id->context = conn_id;
        cm_id->cm_handler = cma_iw_handler;

rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make
sure that cm_work_handler() does not trigger a use-after-free by only
freeing of the struct rdma_id_private after all pending work has finished.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/557d035fe88d78dd51664f4dc0e1896c04c97cf6; https://git.kernel.org/stable/c/7f25f296fc9bd0435be14e89bf657cd615a23574; https://git.kernel.org/stable/c/94ee7ff99b87435ec63211f632918dc7f44dac79
CVE: CVE-2024-42286
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: validate nvme_local_port correctly

The driver load failed with error message,

qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef

and with a kernel crash,

	BUG: unable to handle kernel NULL pointer dereference at [PII_REDACTED]
	Workqueue: events_unbound qla_register_fcport_fn [qla2xxx]
	RIP: 0010:nvme_fc_register_remoteport+0x16/0x430 [nvme_fc]
	RSP: 0018:ffffaaa040eb3d98 EFLAGS: 00010282
	RAX: [PII_REDACTED] RBX: ffff9dfb46b78c00 RCX: [PII_REDACTED]
	RDX: ffff9dfb46b78da8 RSI: ffffaaa040eb3e08 RDI: [PII_REDACTED]
	RBP: ffff9dfb612a0a58 R08: ffffffffaf1d6270 R09: 3a34303a30303030
	R10: 34303a303030305b R11:[PII_REDACTED]616c71 R12: ffff9dfb46b78dd4
	R13: ffff9dfb46b78c24 R14: ffff9dfb41525300 R15: ffff9dfb46b78da8
	FS:  [PII_REDACTED](0000) GS:ffff9dfc67c00000(0000) knlGS:[PII_REDACTED]
	CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
	CR2: [PII_REDACTED] CR3: 000000018da10004 CR4:[PII_REDACTED]0206f0
	Call Trace:
	qla_nvme_register_remote+0xeb/0x1f0 [qla2xxx]
	? qla2x00_dfs_create_rport+0x231/0x270 [qla2xxx]
	qla2x00_update_fcport+0x2a1/0x3c0 [qla2xxx]
	qla_register_fcport_fn+0x54/0xc0 [qla2xxx]

Exit the qla_nvme_register_remote() function when qla_nvme_register_hba()
fails and correctly validate nvme_local_port.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/3eac973eb5cb2b874b3918f924798afc5affd46b; https://git.kernel.org/stable/c/549aac9655320c9b245a24271b204668c5d40430; https://git.kernel.org/stable/c/7cec2c3bfe84539c415f5e16f989228eba1d2f1e
CVE: CVE-2024-42287
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Complete command early within lock

A crash was observed while performing NPIV and FW reset,

 BUG: kernel NULL pointer dereference, address:[PII_REDACTED]00001c
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: 0000 1 PREEMPT_RT SMP NOPTI
 RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0
 RSP: 0018:ffffc90026f47b88 EFLAGS: 00010246
 RAX: [PII_REDACTED] RBX: [PII_REDACTED] RCX: [PII_REDACTED]
 RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: ffff[PII_REDACTED]d0
 RBP: ffff[PII_REDACTED]d0 R08: [PII_REDACTED] R09: [PII_REDACTED]
 R10: ffffc90026f47c48 R11: [PII_REDACTED] R12: [PII_REDACTED]
 R13: [PII_REDACTED] R14: ffff8881565e4a20 R15: [PII_REDACTED]
 FS: 00007f4c69ed3d00(0000) GS:ffff889faac80000(0000) knlGS:[PII_REDACTED]
 CS: 0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
 CR2:[PII_REDACTED]00001c CR3:[PII_REDACTED]a50002 CR4:[PII_REDACTED]7706e0
 DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
 DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
 PKRU: 55555554
 Call Trace:
 <TASK>
 ? __die_body+0x1a/0x60
 ? page_fault_oops+0x16f/0x4a0
 ? do_user_addr_fault+0x174/0x7f0
 ? exc_page_fault+0x69/0x1a0
 ? asm_exc_page_fault+0x22/0x30
 ? dma_direct_unmap_sg+0x51/0x1e0
 ? preempt_count_sub+0x96/0xe0
 qla2xxx_qpair_sp_free_dma+0x29f/0x3b0 [qla2xxx]
 qla2xxx_qpair_sp_compl+0x60/0x80 [qla2xxx]
 __qla2x00_abort_all_cmds+0xa2/0x450 [qla2xxx]

The command completion was done early while aborting the commands in driver
unload path but outside lock to avoid the WARN_ON condition of performing
dma_free_attr within the lock. However this caused race condition while
command completion via multiple paths causing system crash.

Hence complete the command early in unload path but within the lock to
avoid race condition.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/314efe3f87949a568f512f05df20bf47b81cf232; https://git.kernel.org/stable/c/36fdc5319c4d0ec8b8938ec[PII_REDACTED]a246bfb; https://git.kernel.org/stable/c/4475afa2646d3fec176fc4d011d3879b26cb26e3
CVE: CVE-2024-42288
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix for possible memory corruption

Init Control Block is dereferenced incorrectly.  Correctly dereference ICB
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://git.kernel.org/stable/c/2a15b59a2c5afac89696e44acf5bbfc0599c6c5e; https://git.kernel.org/stable/c/571d7f2a08836698c2fb0d[PII_REDACTED]75b9829b; https://git.kernel.org/stable/c/8192c533e89d9fb69b[PII_REDACTED]236b78cda79b
CVE: CVE-2024-42289
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: During vport delete send async logout explicitly

During vport delete, it is observed that during unload we hit a crash
because of stale entries in outstanding command array.  For all these stale
I/O entries, eh_abort was issued and aborted (fast_fail_io = 2009h) but
I/Os could not complete while vport delete is in process of deleting.

  BUG: kernel NULL pointer dereference, address:[PII_REDACTED]00001c
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 0 P4D 0
  Oops: 0000 [#1] PREEMPT SMP NOPTI
  Workqueue: qla2xxx_wq qla_do_work [qla2xxx]
  RIP: 0010:dma_direct_unmap_sg+0x51/0x1e0
  RSP: 0018:ffffa1e1e150fc68 EFLAGS: 00010046
  RAX: [PII_REDACTED] RBX: [PII_REDACTED] RCX: [PII_REDACTED]
  RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: ffff8ce208a7a0d0
  RBP: ffff8ce208a7a0d0 R08: [PII_REDACTED] R09: ffff8ce378aac9c8
  R10: ffff8ce378aac8a0 R11: ffffa1e1e150f9d8 R12: [PII_REDACTED]
  R13: [PII_REDACTED] R14: ffff8ce378aac9c8 R15: [PII_REDACTED]
  FS:  [PII_REDACTED](0000) GS:ffff8d217f000000(0000) knlGS:[PII_REDACTED]
  CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
  CR2:[PII_REDACTED]00001c CR3:[PII_REDACTED]acc000 CR4:[PII_REDACTED]350ee0
  Call Trace:
  <TASK>
  qla2xxx_qpair_sp_free_dma+0x417/0x4e0
  ? qla2xxx_qpair_sp_compl+0x10d/0x1a0
  ? qla2x00_status_entry+0x768/0x2830
  ? newidle_balance+0x2f0/0x430
  ? dequeue_entity+0x100/0x3c0
  ? qla24xx_process_response_queue+0x6a1/0x19e0
  ? __schedule+0x2d5/0x1140
  ? qla_do_work+0x47/0x60
  ? process_one_work+0x267/0x440
  ? process_one_work+0x440/0x440
  ? worker_thread+0x2d/0x3d0
  ? process_one_work+0x440/0x440
  ? kthread+0x156/0x180
  ? set_kthread_struct+0x50/0x50
  ? ret_from_fork+0x22/0x30
  </TASK>

Send out async logout explicitly for all the ports during vport delete.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/[PII_REDACTED]96eb774654a5410e86381c346356fe; https://git.kernel.org/stable/c/171ac4b495f9473bc134356a00095b47e6409e52; https://git.kernel.org/stable/c/76f480d7c717368f29a3870f7d64471ce0ff8fb2
CVE: CVE-2024-42290
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

irqchip/imx-irqsteer: Handle runtime power management correctly

The power domain is automatically activated from clk_prepare(). However, on
certain platforms like i.MX8QM and i.MX8QXP, the power-on handling invokes
sleeping functions, which triggers the 'scheduling while atomic' bug in the
context switch path during device probing:

 BUG: scheduling while atomic: kworker/u13:1/48/0x00000002
 Call trace:
  __schedule_bug+0x54/0x6c
  __schedule+0x7f0/0xa94
  schedule+0x5c/0xc4
  schedule_preempt_disabled+0x24/0x40
  __mutex_lock.constprop.0+0x2c0/0x540
  __mutex_lock_slowpath+0x14/0x20
  mutex_lock+0x48/0x54
  clk_prepare_lock+0x44/0xa0
  clk_prepare+0x20/0x44
  imx_irqsteer_resume+0x28/0xe0
  pm_generic_runtime_resume+0x2c/0x44
  __genpd_runtime_resume+0x30/0x80
  genpd_runtime_resume+0xc8/0x2c0
  __rpm_callback+0x48/0x1d8
  rpm_callback+0x6c/0x78
  rpm_resume+0x490/0x6b4
  __pm_runtime_resume+0x50/0x94
  irq_chip_pm_get+0x2c/0xa0
  __irq_do_set_handler+0x178/0x24c
  irq_set_chained_handler_and_data+0x60/0xa4
  mxc_gpio_probe+0x160/0x4b0

Cure this by implementing the irq_bus_lock/sync_unlock() interrupt chip
callbacks and handle power management in them as they are invoked from
non-atomic context.

[ tglx: Rewrote change log, added Fixes tag ]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/21bd3f9e7f924cd2fc892a484e7a50c7e1847565; https://git.kernel.org/stable/c/33b1c47d1fc0b5f06a393bb915db85baacba18ea; https://git.kernel.org/stable/c/3a2884a44e5cda192df1b28e9925661f79f599a1
CVE: CVE-2024-42291
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

ice: Add a per-VF limit on number of FDIR filters

While the iavf driver adds a s/w limit (128) on the number of FDIR
filters that the VF can request, a malicious VF driver can request more
than that and exhaust the resources for other VFs.

Add a similar limit in ice.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/292081c4e7f575a79017d5cbe1a0ec042783976f; https://git.kernel.org/stable/c/6ebbe97a488179f5dc85f2f1e0c89b486e99ee97; https://git.kernel.org/stable/c/8e02cd98a6e24389d476e28436d41e620ed8e559
CVE: CVE-2024-42292
Published: 2024-08-17
Description: In the Linux kernel, the following vulnerability has been resolved:

kobject_uevent: Fix OOB access within zap_modalias_env()

zap_modalias_env() wrongly calculates size of memory block to move, so
will cause OOB memory access issue if variable MODALIAS is not the last
one within its @env parameter, fixed by correcting size to memmove.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/57fe01d3d04276875c7e3a6dc763517fc05b8762; https://git.kernel.org/stable/c/648d5490460d38436640da0812bf7f6351c150d2; https://git.kernel.org/stable/c/68d63ace80b76395e7935687ecdb86421adc2168