deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-49492
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags

In nvme_alloc_admin_tags, the admin_q can be set to an error (typically
-ENOMEM) if the blk_mq_init_queue call fails to set up the queue, which
is checked immediately after the call. However, when we return the error
message up the stack, to nvme_reset_work the error takes us to
nvme_remove_dead_ctrl()
  nvme_dev_disable()
   nvme_suspend_queue(&dev->queues[0]).

Here, we only check that the admin_q is non-NULL, rather than not
an error or NULL, and begin quiescing a queue that never existed, leading
to bad / NULL pointer dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/54a4c1e47d1b2585e[PII_REDACTED]5bd9abbfb2bd7; https://git.kernel.org/stable/c/7a28556082d1fbcbc599baf1c24252dfc73efefc; https://git.kernel.org/stable/c/8321b17789f614414206af07e17ce4751c95dc76
CVE: CVE-2022-49493
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ASoC: rt5645: Fix errorenous cleanup order

There is a logic error when removing rt5645 device as the function
rt5645_i2c_remove() first cancel the &rt5645->jack_detect_work and
delete the &rt5645->btn_check_timer latter. However, since the timer
handler rt5645_btn_check_callback() will re-queue the jack_detect_work,
this cleanup order is buggy.

That is, once the del_timer_sync in rt5645_i2c_remove is concurrently
run with the rt5645_btn_check_callback, the canceled jack_detect_work
will be rescheduled again, leading to possible use-after-free.

This patch fix the issue by placing the del_timer_sync function before
the cancel_delayed_work_sync.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/061a6159cea583f1155f67d1915917a6b9282662; https://git.kernel.org/stable/c/[PII_REDACTED]173d4eaf3fe08ff4b16740e7c3026f; https://git.kernel.org/stable/c/1a5a3dfd9f172dcb115072f0aea5e27d3083c20e
CVE: CVE-2022-49494
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe()

It will cause null-ptr-deref when using 'res', if platform_get_resource()
returns NULL, so move using 'res' after devm_ioremap_resource() that
will check it to avoid null-ptr-deref.
And use devm_platform_get_and_ioremap_resource() to simplify code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/069af5e27c1b0f7677ef76d8d3102e503ca4f80b; https://git.kernel.org/stable/c/0cfee868b89ffa945f3d535ee5c985cb40c5a0f8; https://git.kernel.org/stable/c/13b60d3dc84b47307669edb66b633b18466014b4
CVE: CVE-2022-49495
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm/hdmi: check return value after calling platform_get_resource_byname()

It will cause null-ptr-deref if platform_get_resource_byname() returns NULL,
we need check the return value.

Patchwork: https://patchwork.freedesktop.org/patch/482992/
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/0978fcce91b90b561b8c82e7c492ba9fc8440eef; https://git.kernel.org/stable/c/2b3ed7547b1a052209da6c4ab886ffe0eed88c42; https://git.kernel.org/stable/c/4cd66a8016b872a153bf892fe4258cbc0dacf5b1
CVE: CVE-2022-49496
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

media: mediatek: vcodec: prevent kernel crash when rmmod mtk-vcodec-dec.ko

If the driver support subdev mode, the parameter "dev->pm.dev" will be
NULL in mtk_vcodec_dec_remove. Kernel will crash when try to rmmod
mtk-vcodec-dec.ko.

[ 4380.702726] pc : do_raw_spin_trylock+0x4/0x80
[ 4380.707075] lr : _raw_spin_lock_irq+0x90/0x14c
[ 4380.711509] sp : ffff80000819bc10
[ 4380.714811] x29: ffff80000819bc10 x28: ffff3600c03e4000 x27: [PII_REDACTED]
[ 4380.721934] x26: [PII_REDACTED] x25: [PII_REDACTED] x24: [PII_REDACTED]
[ 4380.729057] x23: ffff3600c0f34930 x22: ffffd5e923549000 x21: [PII_REDACTED]
[ 4380.736179] x20: [PII_REDACTED] x19: ffffd5e9213e8ebc x18: [PII_REDACTED]
[ 4380.743298] x17: [PII_REDACTED] x16: ffffd5e9213e8e90 x15: 696c346f65646976
[ 4380.750420] x14: [PII_REDACTED] x13: [PII_REDACTED] x12: [PII_REDACTED]
[ 4380.757542] x11: [PII_REDACTED] x10: [PII_REDACTED] x9 : [PII_REDACTED]
[ 4380.764664] x8 : [PII_REDACTED] x7 : ffff3600c7273ae8 x6 : ffffd5e9213e8ebc
[ 4380.771786] x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 : [PII_REDACTED]
[ 4380.778908] x2 : [PII_REDACTED] x1 : ffff3600c03e4000 x0 : [PII_REDACTED]
[ 4380.786031] Call trace:
[ 4380.788465]  do_raw_spin_trylock+0x4/0x80
[ 4380.792462]  __pm_runtime_disable+0x2c/0x1b0
[ 4380.796723]  mtk_vcodec_dec_remove+0x5c/0xa0 [mtk_vcodec_dec]
[ 4380.802466]  platform_remove+0x2c/0x60
[ 4380.806204]  __device_release_driver+0x194/0x250
[ 4380.810810]  driver_detach+0xc8/0x15c
[ 4380.814462]  bus_remove_driver+0x5c/0xb0
[ 4380.818375]  driver_unregister+0x34/0x64
[ 4380.822288]  platform_driver_unregister+0x18/0x24
[ 4380.826979]  mtk_vcodec_dec_driver_exit+0x1c/0x888 [mtk_vcodec_dec]
[ 4380.833240]  __arm64_sys_delete_module+0x190/0x224
[ 4380.838020]  invoke_syscall+0x48/0x114
[ 4380.841760]  el0_svc_common.constprop.0+0x60/0x11c
[ 4380.846540]  do_el0_svc+0x28/0x90
[ 4380.849844]  el0_svc+0x4c/0x100
[ 4380.852975]  el0t_64_sync_handler+0xec/0xf0
[ 4380.857148]  el0t_64_sync+0x190/0x194
[ 4380.860801] Code: 94431515 17ffffca d503201f d503245f (b9400004)
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-667, CWE-667
References: https://git.kernel.org/stable/c/1fa37b00dc55a061a3eb82e378849862b4aeca9d; https://git.kernel.org/stable/c/c10c0086db688c95bb4e0e378e523818dff1551d
CVE: CVE-2022-49497
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

net: remove two BUG() from skb_checksum_help()

I have a syzbot report that managed to get a crash in skb_checksum_help()

If syzbot can trigger these BUG(), it makes sense to replace
them with more friendly WARN_ON_ONCE() since skb_checksum_help()
can instead return an error code.

Note that syzbot will still crash there, until real bug is fixed.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/312c43e98ed190bd8fd7a71a0addf9539d5b8ab1; https://git.kernel.org/stable/c/6320ae1b5876c30bf98203b6a5abe8b5c45e6a04; https://git.kernel.org/stable/c/b1320c9a4d30ff54b824a8ad6036e0b5fb4c5e73
CVE: CVE-2022-49498
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Check for null pointer of pointer substream before dereferencing it

Pointer substream is being dereferenced on the assignment of pointer card
before substream is being null checked with the macro PCM_RUNTIME_CHECK.
Although PCM_RUNTIME_CHECK calls BUG_ON, it still is useful to perform the
the pointer check before card is assigned.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/011b559be832194f992f73d6c0d5485f5925a10b; https://git.kernel.org/stable/c/1f2e28857be1e5c7db39bbc221332215fc5467e3; https://git.kernel.org/stable/c/7784d22f81a29df2ec57ca90d54f93a35cbcd1a2
CVE: CVE-2022-49499
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm: Fix null pointer dereferences without iommu

Check if 'aspace' is set before using it as it will stay null without
IOMMU, such as on msm8974.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/36a1d1bda77e1851bddfa9cf4e8ada94476dbaff; https://git.kernel.org/stable/c/f09937e80f9bc792965476c9a528f26c8fdc9179
CVE: CVE-2022-49500
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

wl1251: dynamically allocate memory used for DMA

With introduction of vmap'ed stacks, stack parameters can no
longer be used for DMA and now leads to kernel panic.

It happens at several places for the wl1251 (e.g. when
accessed through SDIO) making it unuseable on e.g. the
OpenPandora.

We solve this by allocating temporary buffers or use wl1251_read32().

Tested on v5.18-rc5 with OpenPandora.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/454744754cbf2c21b3fc7344e46e10bee2768094; https://git.kernel.org/stable/c/da03bbfbf5acd1ab0b074617e865ad1e8a5779ef
CVE: CVE-2022-49501
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

usbnet: Run unregister_netdev() before unbind() again

Commit 2c9d6c2b871d ("usbnet: run unbind() before unregister_netdev()")
sought to fix a use-after-free on disconnect of USB Ethernet adapters.

It turns out that a different fix is necessary to address the issue:
https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c[PII_REDACTED].git.lukas@wunner.de/

So the commit was not necessary.

The commit made binding and unbinding of USB Ethernet asymmetrical:
Before, usbnet_probe() first invoked the ->bind() callback and then
register_netdev().  usbnet_disconnect() mirrored that by first invoking
unregister_netdev() and then ->unbind().

Since the commit, the order in usbnet_disconnect() is reversed and no
longer mirrors usbnet_probe().

One consequence is that a PHY disconnected (and stopped) in ->unbind()
is afterwards stopped once more by unregister_netdev() as it closes the
netdev before unregistering.  That necessitates a contortion in ->stop()
because the PHY may only be stopped if it hasn't already been
disconnected.

Reverting the commit allows making the call to phy_stop() unconditional
in ->stop().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/6d5deb242874d924beccf7eb3cef04c1c3b0da79; https://git.kernel.org/stable/c/969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509; https://git.kernel.org/stable/c/d1408f6b4dd78fb1b9e26bcf64477984e5f85409
CVE: CVE-2022-49502
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

media: rga: fix possible memory leak in rga_probe

rga->m2m_dev needs to be freed when rga_probe fails.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/1cdc768468c25d6b10ab83ec1efd4a8554532d69; https://git.kernel.org/stable/c/8ddc89437ccefa18279918c19a61fd81527f40b9; https://git.kernel.org/stable/c/a71eb[PII_REDACTED]e646040cd76ccacb5bd48a1b5
CVE: CVE-2022-49503
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix

The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to
ensure that it is within the bitmap.

drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept()
error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()'
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/0bcb528402cd5e1a6e1833e956fd58a12d509e8e; https://git.kernel.org/stable/c/2326d398ccd41ba6d93b8346532dfa432ab00fee; https://git.kernel.org/stable/c/2dc509305cf[PII_REDACTED]92cb8dceef2b1504765
CVE: CVE-2022-49504
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Inhibit aborts if external loopback plug is inserted

After running a short external loopback test, when the external loopback is
removed and a normal cable inserted that is directly connected to a target
device, the system oops in the llpfc_set_rrq_active() routine.

When the loopback was inserted an FLOGI was transmit. As we're looped back,
we receive the FLOGI request. The FLOGI is ABTS'd as we recognize the same
wppn thus understand it's a loopback. However, as the ABTS sends address
information the port is not set to (fffffe), the ABTS is dropped on the
wire. A short 1 frame loopback test is run and completes before the ABTS
times out. The looback is unplugged and the new cable plugged in, and the
an FLOGI to the new device occurs and completes. Due to a mixup in ref
counting the completion of the new FLOGI releases the fabric ndlp. Then the
original ABTS completes and references the released ndlp generating the
oops.

Correct by no-op'ing the ABTS when in loopback mode (it will be dropped
anyway). Added a flag to track the mode to recognize when it should be
no-op'd.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/a1516930cb605caee3bc7b4f3b7994b88c0b8505; https://git.kernel.org/stable/c/ead76d4c09b89f4c8d632648026a476a5a34fde8
CVE: CVE-2022-49506
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: Add vblank register/unregister callback functions

We encountered a kernel panic issue that callback data will be NULL when
it's using in ovl irq handler. There is a timing issue between
mtk_disp_ovl_irq_handler() and mtk_ovl_disable_vblank().

To resolve this issue, we use the flow to register/unregister vblank cb:
- Register callback function and callback data when crtc creates.
- Unregister callback function and callback data when crtc destroies.

With this solution, we can assure callback data will not be NULL when
vblank is disable.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3a4027b5971fe2a94e32754f007d9d3c12c68ad1; https://git.kernel.org/stable/c/8a265d9838bc3c63579002d55c2b2c655c4f8f26; https://git.kernel.org/stable/c/8a2dbdeccef6de47565638abdf3c25f41cdffc37
CVE: CVE-2022-49507
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

regulator: da9121: Fix uninit-value in da9121_assign_chip_model()

KASAN report slab-out-of-bounds in __regmap_init as follows:

BUG: KASAN: slab-out-of-bounds in __regmap_init drivers/base/regmap/regmap.c:841
Read of size 1 at addr ffff88803678cdf1 by task xrun/9137

CPU: 0 PID: 9137 Comm: xrun Tainted: G        W         5.18.0-rc2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x15a lib/dump_stack.c:88
 print_report.cold+0xcd/0x69b mm/kasan/report.c:313
 kasan_report+0x8e/0xc0 mm/kasan/report.c:491
 __regmap_init+0x4540/0x4ba0 drivers/base/regmap/regmap.c:841
 __devm_regmap_init+0x7a/0x100 drivers/base/regmap/regmap.c:1266
 __devm_regmap_init_i2c+0x65/0x80 drivers/base/regmap/regmap-i2c.c:394
 da9121_i2c_probe+0x386/0x6d1 drivers/regulator/da9121-regulator.c:1039
 i2c_device_probe+0x959/0xac0 drivers/i2c/i2c-core-base.c:563

This happend when da9121 device is probe by da9121_i2c_id, but with
invalid dts. Thus, chip->subvariant_id is set to -EINVAL, and later
da9121_assign_chip_model() will access 'regmap' without init it.

Fix it by return -EINVAL from da9121_assign_chip_model() if
'chip->subvariant_id' is invalid.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-908
References: https://git.kernel.org/stable/c/60f21eda69f1b5727a97d2077da766eb27fcc21f; https://git.kernel.org/stable/c/7da64c7c82c9b29b628a62c88a8c2fb06990563d; https://git.kernel.org/stable/c/bab76514aca36bc513224525d5598da676938218
CVE: CVE-2022-49508
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: elan: Fix potential double free in elan_input_configured

'input' is a managed resource allocated with devm_input_allocate_device(),
so there is no need to call input_free_device() explicitly or
there will be a double free.

According to the doc of devm_input_allocate_device():
 * Managed input devices do not need to be explicitly unregistered or
 * freed as it will be done automatically when owner device unbinds from
 * its driver (or binding fails).
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-415
References: https://git.kernel.org/stable/c/1af20714fedad[PII_REDACTED]20be0bd690ded05b6; https://git.kernel.org/stable/c/24f9dfdaece9bd75bb8dbfdba83eddeefdf7dc47; https://git.kernel.org/stable/c/[PII_REDACTED]feeb66fd4bf0826710f482f3b1ab38
CVE: CVE-2022-49509
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

media: i2c: max9286: fix kernel oops when removing module

When removing the max9286 module we get a kernel oops:

Unable to handle kernel paging request at virtual address 000000aa00000094
Mem abort info:
  ESR = 0x96000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=[PII_REDACTED]d85000
[000000aa00000094] pgd=[PII_REDACTED], p4d=[PII_REDACTED]
Internal error: Oops: 96000004 [#1] PREEMPT SMP
Modules linked in: fsl_jr_uio caam_jr rng_core libdes caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine max9271 authenc crct10dif_ce mxc_jpeg_encdec
CPU: 2 PID: 713 Comm: rmmod Tainted: G         C        5.15.5-00057-gaebcd29c8ed7-dirty #5
Hardware name: Freescale i.MX8QXP MEK (DT)
pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : i2c_mux_del_adapters+0x24/0xf0
lr : max9286_remove+0x28/0xd0 [max9286]
sp : ffff800013a9bbf0
x29: ffff800013a9bbf0 x28: ffff00080b6da940 x27: [PII_REDACTED]
x26: [PII_REDACTED] x25: [PII_REDACTED] x24: [PII_REDACTED]
x23: ffff000801a5b970 x22: ffff0008048b0890 x21: ffff[PII_REDACTED]00
x20: ffff0008048b0f70 x19: 000000aa00000064 x18: [PII_REDACTED]
x17: [PII_REDACTED] x16: [PII_REDACTED] x15: [PII_REDACTED]
x14: [PII_REDACTED] x13: [PII_REDACTED] x12: ffff000802da49e8
x11: ffff[PII_REDACTED]18 x10: ffff000802da4920 x9 : ffff[PII_REDACTED]98
x8 : [PII_REDACTED] x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d
x5 : [PII_REDACTED] x4 : [PII_REDACTED] x3 : [PII_REDACTED]
x2 : ffffffffffffffff x1 : ffff00080b6da940 x0 : [PII_REDACTED]
Call trace:
 i2c_mux_del_adapters+0x24/0xf0
 max9286_remove+0x28/0xd0 [max9286]
 i2c_device_remove+0x40/0x110
 __device_release_driver+0x188/0x234
 driver_detach+0xc4/0x150
 bus_remove_driver+0x60/0xe0
 driver_unregister+0x34/0x64
 i2c_del_driver+0x58/0xa0
 max9286_i2c_driver_exit+0x1c/0x490 [max9286]
 __arm64_sys_delete_module+0x194/0x260
 invoke_syscall+0x48/0x114
 el0_svc_common.constprop.0+0xd4/0xfc
 do_el0_svc+0x2c/0x94
 el0_svc+0x28/0x80
 el0t_64_sync_handler+0xa8/0x130
 el0t_64_sync+0x1a0/0x1a4

The Oops happens because the I2C client data does not point to
max9286_priv anymore but to v4l2_subdev. The change happened in
max9286_init() which calls v4l2_i2c_subdev_init() later on...

Besides fixing the max9286_remove() function, remove the call to
i2c_set_clientdata() in max9286_probe(), to avoid confusion, and make
the necessary changes to max9286_init() so that it doesn't have to use
i2c_get_clientdata() in order to fetch the pointer to priv.
CVSS Score: 7.1 (HIGH)
CWE: CWE-668
References: https://git.kernel.org/stable/c/365ab7ebc24eebb42b9e020aeb440d51af8960cd; https://git.kernel.org/stable/c/579c77595dbbdfe4f2edf335899f86ac51eca4e9; https://git.kernel.org/stable/c/9dd783274c89c21a038d967b52a858a297e767f8
CVE: CVE-2022-49510
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/omap: fix NULL but dereferenced coccicheck error

Fix the following coccicheck warning:
./drivers/gpu/drm/omapdrm/omap_overlay.c:89:22-25: ERROR: r_ovl is NULL
but dereferenced.

Here should be ovl->idx rather than r_ovl->idx.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/08d9a75eab594ca508a440db7c73064498d26687; https://git.kernel.org/stable/c/8f2a3970c969d0d8d7289a4c65edcedafc16fd92; https://git.kernel.org/stable/c/d2507be660310bb9bcca918f81f49b8bba07e462
CVE: CVE-2022-49511
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

fbdev: defio: fix the pagelist corruption

Easily hit the below list corruption:
==
list_add corruption. prev->next should be next (ffffffffc0ceb090), but
was ffffec604507edc8. (prev=ffffec604507edc8).
WARNING: CPU: 65 PID: 3959 at lib/list_debug.c:26
__list_add_valid+0x53/0x80
CPU: 65 PID: 3959 Comm: fbdev Tainted: G     U
RIP: 0010:__list_add_valid+0x53/0x80
Call Trace:
 <TASK>
 fb_deferred_io_mkwrite+0xea/0x150
 do_page_mkwrite+0x57/0xc0
 do_wp_page+0x278/0x2f0
 __handle_mm_fault+0xdc2/0x1590
 handle_mm_fault+0xdd/0x2c0
 do_user_addr_fault+0x1d3/0x650
 exc_page_fault+0x77/0x180
 ? asm_exc_page_fault+0x8/0x30
 asm_exc_page_fault+0x1e/0x30
RIP: 0033:0x7fd98fc8fad1
==

Figure out the race happens when one process is adding &page->lru into
the pagelist tail in fb_deferred_io_mkwrite(), another process is
re-initializing the same &page->lru in fb_deferred_io_fault(), which is
not protected by the lock.

This fix is to init all the page lists one time during initialization,
it not only fixes the list corruption, but also avoids INIT_LIST_HEAD()
redundantly.

V2: change "int i" to "unsigned int i" (Geert Uytterhoeven)
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6a9ae2fe887042f76fd3d334349e64e8ab3c55a2; https://git.kernel.org/stable/c/856082f021a28221db2c32bd0531614a8382be67; https://git.kernel.org/stable/c/e79b2b2aadeffe1db54a6b569b9b621575c3eb07
CVE: CVE-2022-49512
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: rawnand: denali: Use managed device resources

All of the resources used by this driver has managed interfaces, so use
them. Otherwise we will get the following splat:

[    4.472703] denali-nand-pci 0000:00:05.0: timeout while waiting for irq 0x1000
[    4.474071] denali-nand-pci: probe of 0000:00:05.0 failed with error -5
[    4.473538] nand: No NAND device found
[    4.474068] BUG: unable to handle page fault for address: ffffc[PII_REDACTED]0
[    4.475169] #PF: supervisor write access in kernel mode
[    4.475579] #PF: error_code(0x0002) - not-present page
[    4.478362] RIP: 0010:iowrite32+0x9/0x50
[    4.486068] Call Trace:
[    4.486269]  <IRQ>
[    4.486443]  denali_isr+0x15b/0x300 [denali]
[    4.486788]  ? denali_direct_write+0x50/0x50 [denali]
[    4.487189]  __handle_irq_event_percpu+0x161/0x3b0
[    4.487571]  handle_irq_event+0x7d/0x1b0
[    4.487884]  handle_fasteoi_irq+0x2b0/0x770
[    4.488219]  __common_interrupt+0xc8/0x1b0
[    4.488549]  common_interrupt+0x9a/0xc0
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3830dbdfb9a4aec680e43ed80b9f23db7a88eac9; https://git.kernel.org/stable/c/3a745b51cddafade99aaea1b93aad31e9614e230; https://git.kernel.org/stable/c/3c68daf4a368cd9e63ae5a2145c9e4a6f838c166