deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-49468
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

thermal/core: Fix memory leak in __thermal_cooling_device_register()

I got memory leak as follows when doing fault injection test:

unreferenced object 0xffff[PII_REDACTED]00 (size 264312):
  comm "182", pid 102533, jiffies[PII_REDACTED] (age 10.100s)
  hex dump (first 32 bytes):
    00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
    ff ff ff ff ff ff ff ff 40 7f 1f b9 ff ff ff ff  ........@.......
  backtrace:
    [<[PII_REDACTED]b2f4fc>] kmalloc_order_trace+0x1d/0x110 mm/slab_common.c:969
    [<00000000ebcb8da5>] __kmalloc+0x373/0x420 include/linux/slab.h:510
    [<[PII_REDACTED]137f13>] thermal_cooling_device_setup_sysfs+0x15d/0x2d0 include/linux/slab.h:586
    [<[PII_REDACTED]2b8755>] __thermal_cooling_device_register+0x332/0xa60 drivers/thermal/thermal_core.c:927
    [<00000000fb9f331b>] devm_thermal_of_cooling_device_register+0x6b/0xf0 drivers/thermal/thermal_core.c:1041
    [<000000009b8012d2>] max6650_probe.cold+0x557/0x6aa drivers/hwmon/max6650.c:211
    [<00000000da0b7e04>] i2c_device_probe+0x472/0xac0 drivers/i2c/i2c-core-base.c:561

If device_register() fails, thermal_cooling_device_destroy_sysfs() need be called
to free the memory allocated in thermal_cooling_device_setup_sysfs().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/18530bedd221160823f63ccc20dd55c7a03edbcf; https://git.kernel.org/stable/c/21ccc58b671aea924f2481cf5c1cf0ebbfd3552d; https://git.kernel.org/stable/c/3802171f0b5b8b831f4ade5c827547cb323a5bb2
CVE: CVE-2022-49469
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix anon_dev leak in create_subvol()

When btrfs_qgroup_inherit(), btrfs_alloc_tree_block, or
btrfs_insert_root() fail in create_subvol(), we return without freeing
anon_dev. Reorganize the error handling in create_subvol() to fix this.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2256e901f5bddc56e24089c96f27b77da932dfcc; https://git.kernel.org/stable/c/7a875ad8706f0903a0e812e0dd701956ee9826ff; https://git.kernel.org/stable/c/d887b3de318834f9aa637ecf79c6bc66cba7c69a
CVE: CVE-2022-49470
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event

We should not access skb buffer data anymore after hci_recv_frame was
called.

[   39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0
[   39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker
[   39.634962] Call trace:
[   39.634974]  dump_backtrace+0x0/0x3b8
[   39.634999]  show_stack+0x20/0x2c
[   39.635016]  dump_stack_lvl+0x60/0x78
[   39.635040]  print_address_description+0x70/0x2f0
[   39.635062]  kasan_report+0x154/0x194
[   39.635079]  __asan_report_load1_noabort+0x44/0x50
[   39.635099]  btmtksdio_recv_event+0x1b0/0x1c4
[   39.635129]  btmtksdio_txrx_work+0x6cc/0xac4
[   39.635157]  process_one_work+0x560/0xc5c
[   39.635177]  worker_thread+0x7ec/0xcc0
[   39.635195]  kthread+0x2d0/0x3d0
[   39.635215]  ret_from_fork+0x10/0x20
[   39.635247] Allocated by task 0:
[   39.635260] (stack is not available)
[   39.635281] Freed by task 2392:
[   39.635295]  kasan_save_stack+0x38/0x68
[   39.635319]  kasan_set_track+0x28/0x3c
[   39.635338]  kasan_set_free_info+0x28/0x4c
[   39.635357]  ____kasan_slab_free+0x104/0x150
[   39.635374]  __kasan_slab_free+0x18/0x28
[   39.635391]  slab_free_freelist_hook+0x114/0x248
[   39.635410]  kfree+0xf8/0x2b4
[   39.635427]  skb_free_head+0x58/0x98
[   39.635447]  skb_release_data+0x2f4/0x410
[   39.635464]  skb_release_all+0x50/0x60
[   39.635481]  kfree_skb+0xc8/0x25c
[   39.635498]  hci_event_packet+0x894/0xca4 [bluetooth]
[   39.635721]  hci_rx_work+0x1c8/0x68c [bluetooth]
[   39.635925]  process_one_work+0x560/0xc5c
[   39.635951]  worker_thread+0x7ec/0xcc0
[   39.635970]  kthread+0x2d0/0x3d0
[   39.635990]  ret_from_fork+0x10/0x20
[   39.636021] The buggy address belongs to the object at ffffff80cf28a600
                which belongs to the cache kmalloc-512 of size 512
[   39.636039] The buggy address is located 13 bytes inside of
                512-byte region [ffffff80cf28a600, ffffff80cf28a800)
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/01c6a899fa6be4f4cbf60c4f44f0f[PII_REDACTED]f; https://git.kernel.org/stable/c/02ba31e09a26e8cd4582ac8e6163d[PII_REDACTED]7; https://git.kernel.org/stable/c/0fab6361c4ba17d1b43a991bef4238a3c1754d35
CVE: CVE-2022-49471
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

rtw89: cfo: check mac_id to avoid out-of-bounds

Somehow, hardware reports incorrect mac_id and pollute memory. Check index
before we access the array.

  UBSAN: array-index-out-of-bounds in rtw89/phy.c:2517:23
  index 188 is out of range for type 's32 [64]'
  CPU: 1 PID: 51550 Comm: irq/35-rtw89_pc Tainted: G           OE
  Call Trace:
   <IRQ>
   show_stack+0x52/0x58
   dump_stack_lvl+0x4c/0x63
   dump_stack+0x10/0x12
   ubsan_epilogue+0x9/0x45
   __ubsan_handle_out_of_bounds.cold+0x44/0x49
   ? __alloc_skb+0x92/0x1d0
   rtw89_phy_cfo_parse+0x44/0x7f [rtw89_core]
   rtw89_core_rx+0x261/0x871 [rtw89_core]
   ? __alloc_skb+0xee/0x1d0
   rtw89_pci_napi_poll+0x3fa/0x4ea [rtw89_pci]
   __napi_poll+0x33/0x1a0
   net_rx_action+0x126/0x260
   ? __queue_work+0x217/0x4c0
   __do_softirq+0xd9/0x315
   ? disable_irq_nosync+0x10/0x10
   do_softirq.part.0+0x6d/0x90
   </IRQ>
   <TASK>
   __local_bh_enable_ip+0x62/0x70
   rtw89_pci_interrupt_threadfn+0x182/0x1a6 [rtw89_pci]
   irq_thread_fn+0x28/0x60
   irq_thread+0xc8/0x190
   ? irq_thread_fn+0x60/0x60
   kthread+0x16b/0x190
   ? irq_thread_check_affinity+0xe0/0xe0
   ? set_kthread_struct+0x50/0x50
   ret_from_fork+0x22/0x30
   </TASK>
CVSS Score: 7.8 (HIGH)
CWE: CWE-129, CWE-129
References: https://git.kernel.org/stable/c/03ed236480aeec8c2fd327a1ea6d711364c495e3; https://git.kernel.org/stable/c/97df85871a5b187609d30fca6d85b912d9e02f29; https://git.kernel.org/stable/c/c32fafe68298bb599e825c298e1d0ba30186f0a5
CVE: CVE-2022-49472
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net: phy: micrel: Allow probing without .driver_data

Currently, if the .probe element is present in the phy_driver structure
and the .driver_data is not, a NULL pointer dereference happens.

Allow passing .probe without .driver_data by inserting NULL checks
for priv->type.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/143878e18001c5a61fcc7ae5c[PII_REDACTED]bb641; https://git.kernel.org/stable/c/1e5fbfc2a6f384e3195446c14bbd3bc298eb88c2; https://git.kernel.org/stable/c/660dfa033ccc9afb032015b6dc76e846bba42cfb
CVE: CVE-2022-49473
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_*

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2a3966b950b37a6f10c5f9caee15b4cdcf5a7413; https://git.kernel.org/stable/c/510e879420b410d88c612aecc6ca15dc6fe77473; https://git.kernel.org/stable/c/554df0f70bff1ace6d2df2fcaddbc9b7bd509de2
CVE: CVE-2022-49474
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout

Connecting the same socket twice consecutively in sco_sock_connect()
could lead to a race condition where two sco_conn objects are created
but only one is associated with the socket. If the socket is closed
before the SCO connection is established, the timer associated with the
dangling sco_conn object won't be canceled. As the sock object is being
freed, the use-after-free problem happens when the timer callback
function sco_sock_timeout() accesses the socket. Here's the call trace:

dump_stack+0x107/0x163
? refcount_inc+0x1c/
print_address_description.constprop.0+0x1c/0x47e
? refcount_inc+0x1c/0x7b
kasan_report+0x13a/0x173
? refcount_inc+0x1c/0x7b
check_memory_region+0x132/0x139
refcount_inc+0x1c/0x7b
sco_sock_timeout+0xb2/0x1ba
process_one_work+0x739/0xbd1
? cancel_delayed_work+0x13f/0x13f
? __raw_spin_lock_init+0xf0/0xf0
? to_kthread+0x59/0x85
worker_thread+0x593/0x70e
kthread+0x346/0x35a
? drain_workqueue+0x31a/0x31a
? kthread_bind+0x4b/0x4b
ret_from_fork+0x1f/0x30
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/36c644c63bfcaee2d3a426f45e89a9cd09799318; https://git.kernel.org/stable/c/390d82733a953c1fabf3de9c9618091a7a9c90a6; https://git.kernel.org/stable/c/537f619dea4e3fa8ed1f8f938abffe3615794bcc
CVE: CVE-2022-49475
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname()

It will cause null-ptr-deref if platform_get_resource_byname() returns NULL,
we need check the return value.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/10f[PII_REDACTED]69498ecb8515e096be213224c24; https://git.kernel.org/stable/c/33dda87d04598ac5d9a849218a373443f7d3de66; https://git.kernel.org/stable/c/560dcbe1c7a78f597f2167371ebdbe2bca3d0735
CVE: CVE-2022-49476
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

mt76: mt7921: fix kernel crash at mt7921_pci_remove

The crash log shown it is possible that mt7921_irq_handler is called while
devm_free_irq is being handled so mt76_free_device need to be postponed
until devm_free_irq is completed to solve the crash we free the mt76 device
too early.

[ 9299.339655] BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
[ 9299.339705] #PF: supervisor read access in kernel mode
[ 9299.339735] #PF: error_code(0x0000) - not-present page
[ 9299.339768] PGD 0 P4D 0
[ 9299.339786] Oops: 0000 [#1] SMP PTI
[ 9299.339812] CPU: 1 PID: 1624 Comm: prepare-suspend Not tainted 5.15.14-1.fc32.qubes.x86_64 #1
[ 9299.339863] Hardware name: Xen HVM domU, BIOS 4.14.3 01/20/2022
[ 9299.339901] RIP: 0010:mt7921_irq_handler+0x1e/0x70 [mt7921e]
[ 9299.340048] RSP: 0018:ffffa81b80c27cb0 EFLAGS: 00010082
[ 9299.340081] RAX: [PII_REDACTED] RBX: ffff98a4cb752020 RCX: ffffffffa96211c5
[ 9299.340123] RDX: [PII_REDACTED] RSI:[PII_REDACTED]0d4204 RDI: ffff98a4cb752020
[ 9299.340165] RBP: ffff98a4c28a62a4 R08: ffff98a4c37a96c0 R09: [PII_REDACTED]
[ 9299.340207] R10: [PII_REDACTED] R11: [PII_REDACTED] R12: ffff98a4c4eaa080
[ 9299.340249] R13: ffff98a4c28a6360 R14: ffff98a4cb752020 R15: ffff98a4c28a6228
[ 9299.340297] FS:[PII_REDACTED]0d3740(0000) GS:ffff98a4ef700000(0000) knlGS:[PII_REDACTED]
[ 9299.340345] CS: 0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[ 9299.340383] CR2: [PII_REDACTED] CR3:[PII_REDACTED]c56001 CR4:[PII_REDACTED]770ee0
[ 9299.340432] PKRU: 55555554
[ 9299.340449] Call Trace:
[ 9299.340467] <TASK>
[ 9299.340485] __free_irq+0x221/0x350
[ 9299.340527] free_irq+0x30/0x70
[ 9299.340553] devm_free_irq+0x55/0x80
[ 9299.340579] mt7921_pci_remove+0x2f/0x40 [mt7921e]
[ 9299.340616] pci_device_remove+0x3b/0xa0
[ 9299.340651] __device_release_driver+0x17a/0x240
[ 9299.340686] device_driver_detach+0x3c/0xa0
[ 9299.340714] unbind_store+0x113/0x130
[ 9299.340740] kernfs_fop_write_iter+0x124/0x1b0
[ 9299.340775] new_sync_write+0x15c/0x1f0
[ 9299.340806] vfs_write+0x1d2/0x270
[ 9299.340831] ksys_write+0x67/0xe0
[ 9299.340857] do_syscall_64+0x3b/0x90
[ 9299.340887] entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/09693f5b636fb3f6dd56fd943226fc1bbc600b51; https://git.kernel.org/stable/c/677e669973bf5460705bc65033445ea9f6615999; https://git.kernel.org/stable/c/ad483ed9dd5193a54293269c852a29051813b7bd
CVE: CVE-2022-49477
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: samsung: Fix refcount leak in aries_audio_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
If extcon_find_edev_by_node() fails, it doesn't call of_node_put()
Calling of_node_put() after extcon_find_edev_by_node() to fix this.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/46d1b310a2d571811c4e08041ce287babb60b86a; https://git.kernel.org/stable/c/70130bde3457d28c02c76b6cacc5d40a72dd6e17; https://git.kernel.org/stable/c/85d899f396622d3034643bf89615a78f9be7c91a
CVE: CVE-2022-49478
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init

Syzbot reported that -1 is used as array index. The problem was in
missing validation check.

hdw->unit_number is initialized with -1 and then if init table walk fails
this value remains unchanged. Since code blindly uses this member for
array indexing adding sanity check is the easiest fix for that.

hdw->workpoll initialization moved upper to prevent warning in
__flush_work.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129, CWE-129
References: https://git.kernel.org/stable/c/1310fc3538dcc375a2f46ef0a438512c2ca32827; https://git.kernel.org/stable/c/24e807541e4a9263ed928e6ae3498de3ad43bd1e; https://git.kernel.org/stable/c/2e004fe914b243db41fa96f9e583385f360ea58e
CVE: CVE-2022-49479
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

mt76: fix tx status related use-after-free race on station removal

There is a small race window where ongoing tx activity can lead to a skb
getting added to the status tracking idr after that idr has already been
cleaned up, which will keep the wcid linked in the status poll list.
Fix this by only adding status skbs if the wcid pointer is still assigned
in dev->wcid, which gets cleared early by mt76_sta_pre_rcu_remove
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/ddd426d72aca4054045a9bd3b80a4ce1d398f11f; https://git.kernel.org/stable/c/ef7f9f894cfd0b2e471206409a529af4a26ddd55; https://git.kernel.org/stable/c/fcfe1b5e162bf473c1d47760962cec8523c00466
CVE: CVE-2022-49480
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe

of_find_device_by_node() takes reference, we should use put_device()
to release it. when devm_kzalloc() fails, it doesn't have a
put_device(), it will cause refcount leak.
Add missing put_device() to fix this.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/81b7edaabd44ba133006ad72056914eb36828d60; https://git.kernel.org/stable/c/8205a0114db10ec41bd2b748cdd[PII_REDACTED]eca; https://git.kernel.org/stable/c/cf760e494ee5fa6bc2dc222f0098c741ad460801
CVE: CVE-2022-49481
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt

of_node_get() returns a node with refcount incremented.
Calling of_node_put() to drop the reference when not needed anymore.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0be5d9da5743b9825a95baec85a67500b2c1d362; https://git.kernel.org/stable/c/49d785baeb[PII_REDACTED]7be356d138e5e59c7ddb; https://git.kernel.org/stable/c/56ab0c01027492cd161c64148e1dc892c56887ad
CVE: CVE-2022-49482
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when done.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/18b907ff0ae4bf20120aae1538f7156b9d08e3a7; https://git.kernel.org/stable/c/[PII_REDACTED]6666bf0dcb9ee10c5575c6ce6a1730; https://git.kernel.org/stable/c/2a0da7641e1f17a744ac7b3f76471388c97b63dc
CVE: CVE-2022-49483
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/disp/dpu1: avoid clearing hw interrupts if hw_intr is null during drm uninit

If edp modeset init is failed due to panel being not ready and
probe defers during drm bind, avoid clearing irqs and dereference
hw_intr when hw_intr is null.

BUG: Unable to handle kernel NULL pointer dereference at virtual address [PII_REDACTED]

Call trace:
 dpu_core_irq_uninstall+0x50/0xb0
 dpu_irq_uninstall+0x18/0x24
 msm_drm_uninit+0xd8/0x16c
 msm_drm_bind+0x580/0x5fc
 try_to_bring_up_master+0x168/0x1c0
 __component_add+0xb4/0x178
 component_add+0x1c/0x28
 dp_display_probe+0x38c/0x400
 platform_probe+0xb0/0xd0
 really_probe+0xcc/0x2c8
 __driver_probe_device+0xbc/0xe8
 driver_probe_device+0x48/0xf0
 __device_attach_driver+0xa0/0xc8
 bus_for_each_drv+0x8c/0xd8
 __device_attach+0xc4/0x150
 device_initial_probe+0x1c/0x28

Changes in V2:
- Update commit message and coreect fixes tag.

Patchwork: https://patchwork.freedesktop.org/patch/484430/
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/01013ba9bbddc62f7d011163cebfd7ed06bb698b; https://git.kernel.org/stable/c/a7ca30c3a8b2e8bda65f2b922d382ac056be8aa4; https://git.kernel.org/stable/c/a[PII_REDACTED]13149afde18d98821554fbfcb3164
CVE: CVE-2022-49484
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

mt76: mt7915: fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector

Fix possible NULL pointer dereference in mt7915_mac_fill_rx_vector
routine if the chip does not support dbdc and the hw reports band_idx
set to 1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/268e8ef187eb8780d021b0e4f5ffa92dee5c4983; https://git.kernel.org/stable/c/62fdc974894eec80d678523458cf99bbdb887e22
CVE: CVE-2022-49485
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/v3d: Fix null pointer dereference of pointer perfmon

In the unlikely event that pointer perfmon is null the WARN_ON return path
occurs after the pointer has already been deferenced. Fix this by only
dereferencing perfmon after it has been null checked.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/1df8f8901babcc8c8eea2c067179e455b5c828fd; https://git.kernel.org/stable/c/3b72deb784a7d4ae8519a5c584cd87c4b57aa6c8; https://git.kernel.org/stable/c/4be045434923e549a50846a066a04b7b6c1d6d33
CVE: CVE-2022-49486
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe

of_find_i2c_device_by_node() takes a reference,
In error paths, we should call put_device() to drop
the reference to aviod refount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/41cd312dfe980af869c3503b4d38e62ed20dd3b7; https://git.kernel.org/stable/c/4bfbbfdb3d761323127a67d7d765abe2f77d7b21; https://git.kernel.org/stable/c/7f75e9f629ef54a0845b43889d8ab9dd6e280dd5
CVE: CVE-2022-49487
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: intel: fix possible null-ptr-deref in ebu_nand_probe()

It will cause null-ptr-deref when using 'res', if platform_get_resource()
returns NULL, so move using 'res' after devm_ioremap_resource() that
will check it to avoid null-ptr-deref.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/daa5166450b447415aeeaac0199e445bae7bd0f2; https://git.kernel.org/stable/c/ddf66aefd685fd46500b9917333e1b1e118276dc; https://git.kernel.org/stable/c/e5b1e419cdb6dd8709eb05ed34039a3ded8e6003
CVE: CVE-2022-49488
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected

There is a possibility for mdp5_get_global_state to return
-EDEADLK when acquiring the modeset lock, but currently global_state in
mdp5_mixer_release doesn't check for if an error is returned.

To avoid a NULL dereference error, let's have mdp5_mixer_release
check if an error is returned and propagate that error.

Patchwork: https://patchwork.freedesktop.org/patch/485181/
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/09bdeedc1fc53e64b8282e1de67752c69e43bdba; https://git.kernel.org/stable/c/1a5d1474026ea4f1a6f931075ca2adb884af39cf; https://git.kernel.org/stable/c/22d8424913b1348c[PII_REDACTED]fadaeea5273f0e
CVE: CVE-2022-49489
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume

BUG: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6be3

Call trace:
  dpu_vbif_init_memtypes+0x40/0xb8
  dpu_runtime_resume+0xcc/0x1c0
  pm_generic_runtime_resume+0x30/0x44
  __genpd_runtime_resume+0x68/0x7c
  genpd_runtime_resume+0x134/0x258
  __rpm_callback+0x98/0x138
  rpm_callback+0x30/0x88
  rpm_resume+0x36c/0x49c
  __pm_runtime_resume+0x80/0xb0
  dpu_core_irq_uninstall+0x30/0xb0
  dpu_irq_uninstall+0x18/0x24
  msm_drm_uninit+0xd8/0x16c

Patchwork: https://patchwork.freedesktop.org/patch/483255/
[DB: fixed Fixes tag]
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/134760263f6441741db0b2970e7face6b34b6d1c; https://git.kernel.org/stable/c/5b0adf5cbf3b74721e4e4c4e0cadc91b8df8bcc2; https://git.kernel.org/stable/c/97ac682b6f7d36be5d934f86c[PII_REDACTED]a68f1
CVE: CVE-2022-49490
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected

mdp5_get_global_state runs the risk of hitting a -EDEADLK when acquiring
the modeset lock, but currently mdp5_pipe_release doesn't check for if
an error is returned. Because of this, there is a possibility of
mdp5_pipe_release hitting a NULL dereference error.

To avoid this, let's have mdp5_pipe_release check if
mdp5_get_global_state returns an error and propogate that error.

Changes since v1:
- Separated declaration and initialization of *new_state to avoid
  compiler warning
- Fixed some spelling mistakes in commit message

Changes since v2:
- Return 0 in case where hwpipe is NULL as this is considered normal
  behavior
- Added 2nd patch in series to fix a similar NULL dereference issue in
  mdp5_mixer_release

Patchwork: https://patchwork.freedesktop.org/patch/485179/
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/04bef5f1ba8ea6d7c1c8f5f65e0395c62db59cb8; https://git.kernel.org/stable/c/19964dfb39bda4d7716a71009488f0668ecbcf52; https://git.kernel.org/stable/c/33dc5aac46e0fad8f5eb193e5906ed0eb6b66ceb
CVE: CVE-2022-49491
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()

It will cause null-ptr-deref in resource_size(), if platform_get_resource()
returns NULL, move calling resource_size() after devm_ioremap_resource() that
will check 'res' to avoid null-ptr-deref.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/[PII_REDACTED]303d54a003c73bd0ae39cebb960bd5; https://git.kernel.org/stable/c/452922955df215a417c80d09dab72bbc667a1861; https://git.kernel.org/stable/c/6ff986e057bf28e2f7690dad410768b2270f9453