deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-49697
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix request_sock leak in sk lookup helpers

A customer reported a request_socket leak in a Calico cloud environment. We
found that a BPF program was doing a socket lookup with takes a refcnt on
the socket and that it was finding the request_socket but returning the parent
LISTEN socket via sk_to_full_sk() without decrementing the child request socket
1st, resulting in request_sock slab object leak. This patch retains the
existing behaviour of returning full socks to the caller but it also decrements
the child request_socket if one is present before doing so to prevent the leak.

Thanks to Curtis Taylor for all the help in diagnosing and testing this. And
thanks to Antoine Tenart for the reproducer and patch input.

v2 of this patch contains, refactor as per Daniel Borkmann's suggestions to
validate RCU flags on the listen socket so that it balances with bpf_sk_release()
and update comments as per Martin KaFai Lau's suggestion. One small change to
Daniels suggestion, put "sk = sk2" under "if (sk2 != sk)" to avoid an extra
instruction.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/3046a827316c0e55fc563b4fb78c93b9ca5c7c37; https://git.kernel.org/stable/c/516760f1d2979903eaad5b437256913c5cd98416; https://git.kernel.org/stable/c/5a62b5ba4c0ce8315b6382cd4ace81b48cd121cd
CVE: CVE-2022-49698
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: use get_random_u32 instead of prandom

bh might occur while updating per-cpu rnd_state from user context,
ie. local_out path.

BUG: using smp_processor_id() in preemptible [00000000] code: nginx/2725
caller is nft_ng_random_eval+0x24/0x54 [nft_numgen]
Call Trace:
 check_preemption_disabled+0xde/0xe0
 nft_ng_random_eval+0x24/0x54 [nft_numgen]

Use the random driver instead, this also avoids need for local prandom
state. Moreover, prandom now uses the random driver since d4150779e60f
("random32: use real rng for non-deterministic randomness").

Based on earlier patch from Pablo Neira.
CVSS Score: 7.8 (HIGH)
References: https://git.kernel.org/stable/c/15cc30ac2a8d7185f8ebf97dd1ddd90a7c79783b; https://git.kernel.org/stable/c/6ce71f83f798be7e1ca68707fec449fbecb38852; https://git.kernel.org/stable/c/b1fd94e704571f98b21027340eecf821b2bdffba
CVE: CVE-2022-49699
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

filemap: Handle sibling entries in filemap_get_read_batch()

If a read races with an invalidation followed by another read, it is
possible for a folio to be replaced with a higher-order folio.  If that
happens, we'll see a sibling entry for the new folio in the next iteration
of the loop.  This manifests as a NULL pointer dereference while holding
the RCU read lock.

Handle this by simply returning.  The next call will find the new folio
and handle it correctly.  The other ways of handling this rare race are
more complex and it's just not worth it.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/a66f131d30e53000f08301776bf85c912ef47aad; https://git.kernel.org/stable/c/cb995f4eeba9d268fd4b56c2423ad6c1d1ea1b82
CVE: CVE-2022-49703
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: ibmvfc: Store vhost pointer during subcrq allocation

Currently the back pointer from a queue to the vhost adapter isn't set
until after subcrq interrupt registration. The value is available when a
queue is first allocated and can/should be also set for primary and async
queues as well as subcrqs.

This fixes a crash observed during kexec/kdump on Power 9 with legacy XICS
interrupt controller where a pending subcrq interrupt from the previous
kernel can be replayed immediately upon IRQ registration resulting in
dereference of a garbage backpointer in ibmvfc_interrupt_scsi().

Kernel attempted to read user page (58) - exploit attempt? (uid: 0)
BUG: Kernel NULL pointer dereference on read at 0x00000058
Faulting instruction address: 0xc[PII_REDACTED]16a08
Oops: Kernel access of bad area, sig: 11 [#1]
...
NIP [c[PII_REDACTED]16a08] ibmvfc_interrupt_scsi+0x40/0xb0 [ibmvfc]
LR [c[PII_REDACTED]079e8] __handle_irq_event_percpu+0x98/0x270
Call Trace:
[c000000047fa3d80] [c[PII_REDACTED]e6180] 0xc[PII_REDACTED]e6180 (unreliable)
[c000000047fa3df0] [c[PII_REDACTED]079e8] __handle_irq_event_percpu+0x98/0x270
[c000000047fa3ea0] [c[PII_REDACTED]07d18] handle_irq_event+0x98/0x188
[c000000047fa3ef0] [c[PII_REDACTED]0f564] handle_fasteoi_irq+0xc4/0x310
[c000000047fa3f40] [c[PII_REDACTED]05c60] generic_handle_irq+0x50/0x80
[c000000047fa3f60] [c[PII_REDACTED]15c40] __do_irq+0x70/0x1a0
[c000000047fa3f90] [c[PII_REDACTED]16d7c] __do_IRQ+0x9c/0x130
[c[PII_REDACTED]22f60] [[PII_REDACTED]] 0x20000000
[c[PII_REDACTED]22ff0] [c[PII_REDACTED]16e50] do_IRQ+0x40/0xa0
[c[PII_REDACTED]23020] [c[PII_REDACTED]17044] replay_soft_interrupts+0x194/0x2f0
[c[PII_REDACTED]23210] [c[PII_REDACTED]172a8] arch_local_irq_restore+0x108/0x170
[c[PII_REDACTED]23240] [c000000008eb1008] _raw_spin_unlock_irqrestore+0x58/0xb0
[c[PII_REDACTED]23270] [c[PII_REDACTED]0b12c] __setup_irq+0x49c/0x9f0
[c[PII_REDACTED]23310] [c[PII_REDACTED]0b7c0] request_threaded_irq+0x140/0x230
[c[PII_REDACTED]23380] [c[PII_REDACTED]12a50] ibmvfc_register_scsi_channel+0x1e8/0x2f0 [ibmvfc]
[c[PII_REDACTED]23450] [c[PII_REDACTED]13d1c] ibmvfc_init_sub_crqs+0xc4/0x1f0 [ibmvfc]
[c[PII_REDACTED]234d0] [c[PII_REDACTED]145a8] ibmvfc_reset_crq+0x150/0x210 [ibmvfc]
[c[PII_REDACTED]23550] [c[PII_REDACTED]147c8] ibmvfc_init_crq+0x160/0x280 [ibmvfc]
[c[PII_REDACTED]235f0] [c[PII_REDACTED]1a9cc] ibmvfc_probe+0x2a4/0x530 [ibmvfc]
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/6d38e3b614ded59da8b95377a98df969a5a5627a; https://git.kernel.org/stable/c/8540f66196ca35b7b5e902932571c18b9fde0cd1; https://git.kernel.org/stable/c/aeaadcde1a60138bceb65de3cdaeec78170b4459
CVE: CVE-2022-49704
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

9p: fix fid refcount leak in v9fs_vfs_get_link

we check for protocol version later than required, after a fid has
been obtained. Just move the version check earlier.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/e5690f263208c5abce7451370b7786eb25b405eb; https://git.kernel.org/stable/c/e7b6d622bd812013eb39c8f4cd65b7ee8ede1e02; https://git.kernel.org/stable/c/f0126bcaee81dabc[PII_REDACTED]aa74caa03a4c6e
CVE: CVE-2022-49705
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl

We need to release directory fid if we fail halfway through open

This fixes fid leaking with xfstests generic 531
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/22832ac3eb5be3f7168816a76b64c1284e12eb3c; https://git.kernel.org/stable/c/8bc5412ba1a45edfd1e451874c483c26a097af2b; https://git.kernel.org/stable/c/beca774fc51a9ba8abbc869cf0c3d965ff17cd24
CVE: CVE-2022-49706
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

zonefs: fix zonefs_iomap_begin() for reads

If a readahead is issued to a sequential zone file with an offset
exactly equal to the current file size, the iomap type is set to
IOMAP_UNWRITTEN, which will prevent an IO, but the iomap length is
calculated as 0. This causes a WARN_ON() in iomap_iter():

[17309.548939] WARNING: CPU: 3 PID: 2137 at fs/iomap/iter.c:34 iomap_iter+0x9cf/0xe80
[...]
[17309.650907] RIP: 0010:iomap_iter+0x9cf/0xe80
[...]
[17309.754560] Call Trace:
[17309.757078]  <TASK>
[17309.759240]  ? lock_is_held_type+0xd8/0x130
[17309.763531]  iomap_readahead+0x1a8/0x870
[17309.767550]  ? iomap_read_folio+0x4c0/0x4c0
[17309.771817]  ? lockdep_hardirqs_on_prepare+0x400/0x400
[17309.778848]  ? lock_release+0x370/0x750
[17309.784462]  ? folio_add_lru+0x217/0x3f0
[17309.790220]  ? reacquire_held_locks+0x4e0/0x4e0
[17309.796543]  read_pages+0x17d/0xb60
[17309.801854]  ? folio_add_lru+0x238/0x3f0
[17309.807573]  ? readahead_expand+0x5f0/0x5f0
[17309.813554]  ? policy_node+0xb5/0x140
[17309.819018]  page_cache_ra_unbounded+0x27d/0x450
[17309.825439]  filemap_get_pages+0x500/0x1450
[17309.831444]  ? filemap_add_folio+0x140/0x140
[17309.837519]  ? lock_is_held_type+0xd8/0x130
[17309.843509]  filemap_read+0x28c/0x9f0
[17309.848953]  ? zonefs_file_read_iter+0x1ea/0x4d0 [zonefs]
[17309.856162]  ? trace_contention_end+0xd6/0x130
[17309.862416]  ? __mutex_lock+0x221/0x1480
[17309.868151]  ? zonefs_file_read_iter+0x166/0x4d0 [zonefs]
[17309.875364]  ? filemap_get_pages+0x1450/0x1450
[17309.881647]  ? __mutex_unlock_slowpath+0x15e/0x620
[17309.888248]  ? wait_for_completion_io_timeout+0x20/0x20
[17309.895231]  ? lock_is_held_type+0xd8/0x130
[17309.901115]  ? lock_is_held_type+0xd8/0x130
[17309.906934]  zonefs_file_read_iter+0x356/0x4d0 [zonefs]
[17309.913750]  new_sync_read+0x2d8/0x520
[17309.919035]  ? __x64_sys_lseek+0x1d0/0x1d0

Furthermore, this causes iomap_readahead() to loop forever as
iomap_readahead_iter() always returns 0, making no progress.

Fix this by treating reads after the file size as access to holes,
setting the iomap type to IOMAP_HOLE, the iomap addr to IOMAP_NULL_ADDR
and using the length argument as is for the iomap length. To simplify
the code with this change, zonefs_iomap_begin() is split into the read
variant, zonefs_read_iomap_begin() and zonefs_read_iomap_ops, and the
write variant, zonefs_write_iomap_begin() and zonefs_write_iomap_ops.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/355be6131164c5bacf2e810763835aecb6e01fcb; https://git.kernel.org/stable/c/3a7f05f104347b407e865c10be2675cd833a4e48; https://git.kernel.org/stable/c/c1c1204c0d0c1dccc1310b9277fb2bd8b663d8fe
CVE: CVE-2022-49707
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: add reserved GDT blocks check

We capture a NULL pointer issue when resizing a corrupt ext4 image which
is freshly clear resize_inode feature (not run e2fsck). It could be
simply reproduced by following steps. The problem is because of the
resize_inode feature was cleared, and it will convert the filesystem to
meta_bg mode in ext4_resize_fs(), but the es->s_reserved_gdt_blocks was
not reduced to zero, so could we mistakenly call reserve_backup_gdb()
and passing an uninitialized resize_inode to it when adding new group
descriptors.

 mkfs.ext4 /dev/sda 3G
 tune2fs -O ^resize_inode /dev/sda #forget to run requested e2fsck
 mount /dev/sda /mnt
 resize2fs /dev/sda 8G

 ========
 BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 CPU: 19 PID: 3243 Comm: resize2fs Not tainted 5.18.0-rc7-00001-gfde086c5ebfd #748
 ...
 RIP: 0010:ext4_flex_group_add+0xe08/0x2570
 ...
 Call Trace:
  <TASK>
  ext4_resize_fs+0xbec/0x1660
  __ext4_ioctl+0x1749/0x24e0
  ext4_ioctl+0x12/0x20
  __x64_sys_ioctl+0xa6/0x110
  do_syscall_64+0x3b/0x90
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7f2dd739617b
 ========

The fix is simple, add a check in ext4_resize_begin() to make sure that
the es->s_reserved_gdt_blocks is zero when the resize_inode feature is
disabled.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://git.kernel.org/stable/c/0dc2fca8e4f9ac4a40e8424a10163369cca0cc06; https://git.kernel.org/stable/c/33b1bba31f4c784d33d2c2517964bdccdc9204cd; https://git.kernel.org/stable/c/7c921328ac760bba780bdace41f4cd045f7f1405
CVE: CVE-2022-49708
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix bug_on ext4_mb_use_inode_pa

Hulk Robot reported a BUG_ON:
==================================================================
kernel BUG at fs/ext4/mballoc.c:3211!
[...]
RIP: 0010:ext4_mb_mark_diskspace_used.cold+0x85/0x136f
[...]
Call Trace:
 ext4_mb_new_blocks+0x9df/0x5d30
 ext4_ext_map_blocks+0x1803/0x4d80
 ext4_map_blocks+0x3a4/0x1a10
 ext4_writepages+0x126d/0x2c30
 do_writepages+0x7f/0x1b0
 __filemap_fdatawrite_range+0x285/0x3b0
 file_write_and_wait_range+0xb1/0x140
 ext4_sync_file+0x1aa/0xca0
 vfs_fsync_range+0xfb/0x260
 do_fsync+0x48/0xa0
[...]
==================================================================

Above issue may happen as follows:
-------------------------------------
do_fsync
 vfs_fsync_range
  ext4_sync_file
   file_write_and_wait_range
    __filemap_fdatawrite_range
     do_writepages
      ext4_writepages
       mpage_map_and_submit_extent
        mpage_map_one_extent
         ext4_map_blocks
          ext4_mb_new_blocks
           ext4_mb_normalize_request
            >>> start + size <= ac->ac_o_ex.fe_logical
           ext4_mb_regular_allocator
            ext4_mb_simple_scan_group
             ext4_mb_use_best_found
              ext4_mb_new_preallocation
               ext4_mb_new_inode_pa
                ext4_mb_use_inode_pa
                 >>> set ac->ac_b_ex.fe_len <= 0
           ext4_mb_mark_diskspace_used
            >>> BUG_ON(ac->ac_b_ex.fe_len <= 0);

we can easily reproduce this problem with the following commands:
	`fallocate -l100M disk`
	`mkfs.ext4 -b 1024 -g 256 disk`
	`mount disk /mnt`
	`fsstress -d /mnt -l 0 -n 1000 -p 1`

The size must be smaller than or equal to EXT4_BLOCKS_PER_GROUP.
Therefore, "start + size <= ac->ac_o_ex.fe_logical" may occur
when the size is truncated. So start should be the start position of
the group where ac_o_ex.fe_logical is located after alignment.
In addition, when the value of fe_logical or EXT4_BLOCKS_PER_GROUP
is very large, the value calculated by start_off is more accurate.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/5707d721d1819db57dba57b1d4623034fcb32047; https://git.kernel.org/stable/c/6880fb2e64331b9fdc85d3f32b1d7e81ad8703f1; https://git.kernel.org/stable/c/6fdaf31ad5f3d3afab744dfd9a8b0d9142aa881f
CVE: CVE-2022-49709
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle

RCU_NONIDLE usage during __cfi_slowpath_diag can result in an invalid
RCU state in the cpuidle code path:

  WARNING: CPU: 1 PID: 0 at kernel/rcu/tree.c:613 rcu_eqs_enter+0xe4/0x138
  ...
  Call trace:
    rcu_eqs_enter+0xe4/0x138
    rcu_idle_enter+0xa8/0x100
    cpuidle_enter_state+0x154/0x3a8
    cpuidle_enter+0x3c/0x58
    do_idle.llvm[PII_REDACTED]138871020+0x1f4/0x2ec
    cpu_startup_entry+0x28/0x2c
    secondary_start_kernel+0x1b8/0x220
    __secondary_switched+0x94/0x98

Instead, call rcu_irq_enter/exit to wake up RCU only when needed and
disable interrupts for the entire CFI shadow/module check when we do.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/57cd6d157eb479f0a8e820fd36b7240845c8a937; https://git.kernel.org/stable/c/75f3a5fa2ad049c85ab5d5ee1ed9cfaa7e62c5ed; https://git.kernel.org/stable/c/ca3897f2ac02ceae5e6fa794f83c36f9885b93da
CVE: CVE-2022-49710
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

dm mirror log: round up region bitmap size to BITS_PER_LONG

The code in dm-log rounds up bitset_size to 32 bits. It then uses
find_next_zero_bit_le on the allocated region. find_next_zero_bit_le
accesses the bitmap using unsigned long pointers. So, on 64-bit
architectures, it may access 4 bytes beyond the allocated size.

Fix this bug by rounding up bitset_size to BITS_PER_LONG.

This bug was found by running the lvm2 testsuite with kasan.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0d2209b54f1de0c2f99cab246d4cf2cfe24aaaa9; https://git.kernel.org/stable/c/85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0; https://git.kernel.org/stable/c/9a02f3275acc628c0d956be771405ced79ac36df
CVE: CVE-2022-49711
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()

In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to
fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in
fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io
triggers KASAN use-after-free. To avoid the use-after-free, keep the
reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to
fsl_destroy_mc_io().

This patch needs rework to apply to kernels older than v5.15.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/161b68b0a728377aaa10a8e14c70e7734f3c9ff7; https://git.kernel.org/stable/c/720ab105df7bf3eee62d2bddd41526b29d07d045; https://git.kernel.org/stable/c/928ea98252ad[PII_REDACTED]1683893cf904541da9
CVE: CVE-2022-49712
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe

of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
of_node_put() will check NULL pointer.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0ef6917c0524da5b88496b9706628ffef108b9bb; https://git.kernel.org/stable/c/2a598da14856ead80c726b38ba426c68637d9211; https://git.kernel.org/stable/c/46da1e4a8b[PII_REDACTED]b2a4056941dfdd7f3efd
CVE: CVE-2022-49713
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: dwc2: Fix memory leak in dwc2_hcd_init

usb_create_hcd will alloc memory for hcd, and we should
call usb_put_hcd to free it when platform_get_resource()
fails to prevent memory leak.
goto error2 label instead error1 to fix this.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://git.kernel.org/stable/c/3755278f078460b021cd[PII_REDACTED]bf2039a57a; https://git.kernel.org/stable/c/52bfcedbfd5bf962dbdcb6e761f4d0dd3ba26dfd; https://git.kernel.org/stable/c/6506aff2dc2f7059aa3d45ee2e8639b25e87090f
CVE: CVE-2022-49714
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

irqchip/realtek-rtl: Fix refcount leak in map_interrupts

of_find_node_by_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
This function doesn't call of_node_put() in error path.
Call of_node_put() directly after of_property_read_u32() to cover
both normal path and error path.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/e85b1b797de0e7a271b906291ce[PII_REDACTED]0b8; https://git.kernel.org/stable/c/eff4780f83d0ae3e5b6c02ff5d999dc4c1c5c8ce; https://git.kernel.org/stable/c/f6d6223df0666fbc054e3a8c6ac14eb0af37c286
CVE: CVE-2022-49715
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions

of_find_node_by_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/506a88a5bf261d76a5214c0338a320f2214c67ac; https://git.kernel.org/stable/c/8d884c08eeb83142a7173cb46bcff0434ec42cf1; https://git.kernel.org/stable/c/c136c2924a59a399aa789858cfb320d481964fb7
CVE: CVE-2022-49716
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions

of_get_child_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
When kcalloc fails, it missing of_node_put() and results in refcount
leak. Fix this by goto out_put_node label.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0b325d993995a321f6ab4e6c51f0504ec092bf5b; https://git.kernel.org/stable/c/58e67c81e229351027d28c[PII_REDACTED]06e33a08; https://git.kernel.org/stable/c/7c9dd9d23f26dabcfb14148b9acdfba540418b19
CVE: CVE-2022-49717
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

irqchip/apple-aic: Fix refcount leak in build_fiq_affinity

of_find_node_by_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2dc14cebe5dc053434b507bb24e6821cb795050f; https://git.kernel.org/stable/c/b1ac803f47cb1615468f35cf1ccb553c52087301
CVE: CVE-2022-49718
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

irqchip/apple-aic: Fix refcount leak in aic_of_ic_init

of_get_child_by_name() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/3d45670fab3c25a7452721e4588cc95c51cda134; https://git.kernel.org/stable/c/6c0010d1dc67c89bcc857c46f542efe318f84ddc
CVE: CVE-2022-49719
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

irqchip/gic/realview: Fix refcount leak in realview_gic_of_init

of_find_matching_node_and_match() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/16b603cb8d34c2d917983918db1f88c8b831baaa; https://git.kernel.org/stable/c/486f68f85085d9b16ae097679b1486dcb1b6eb69; https://git.kernel.org/stable/c/56526c3883fc7a1f5898b1d40a02c8b8685a5d92
CVE: CVE-2022-49720
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

block: Fix handling of offline queues in blk_mq_alloc_request_hctx()

This patch prevents that test nvme/004 triggers the following:

UBSAN: array-index-out-of-bounds in block/blk-mq.h:135:9
index 512 is out of range for type 'long unsigned int [512]'
Call Trace:
 show_stack+0x52/0x58
 dump_stack_lvl+0x49/0x5e
 dump_stack+0x10/0x12
 ubsan_epilogue+0x9/0x3b
 __ubsan_handle_out_of_bounds.cold+0x44/0x49
 blk_mq_alloc_request_hctx+0x304/0x310
 __nvme_submit_sync_cmd+0x70/0x200 [nvme_core]
 nvmf_connect_io_queue+0x23e/0x2a0 [nvme_fabrics]
 nvme_loop_connect_io_queues+0x8d/0xb0 [nvme_loop]
 nvme_loop_create_ctrl+0x58e/0x7d0 [nvme_loop]
 nvmf_create_ctrl+0x1d7/0x4d0 [nvme_fabrics]
 nvmf_dev_write+0xae/0x111 [nvme_fabrics]
 vfs_write+0x144/0x560
 ksys_write+0xb7/0x140
 __x64_sys_write+0x42/0x50
 do_syscall_64+0x35/0x80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
CVSS Score: 7.8 (HIGH)
CWE: CWE-129, CWE-129
References: https://git.kernel.org/stable/c/14dc7a18abbe4176f5626c13c333670da8e06aa1; https://git.kernel.org/stable/c/7fa28a7c3d74933a4fc22d341b60927952f31c19; https://git.kernel.org/stable/c/b202a0bd2580ee5b0453772c46d464152fafff73
CVE: CVE-2022-49724
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

tty: goldfish: Fix free_irq() on remove

Pass the correct dev_id to free_irq() to fix this splat when the driver
is unbound:

 WARNING: CPU: 0 PID: 30 at kernel/irq/manage.c:1895 free_irq
 Trying to free already-free IRQ 65
 Call Trace:
  warn_slowpath_fmt
  free_irq
  goldfish_tty_remove
  platform_remove
  device_remove
  device_release_driver_internal
  device_driver_detach
  unbind_store
  drv_attr_store
  ...
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/499e13aac6c762e1e828172b0f0f5275651d6512; https://git.kernel.org/stable/c/65ca4db68b6819244df9024aea4be55edf8af1ef; https://git.kernel.org/stable/c/a6fcd7ffd76a9c1d998a2d02d518c78a55c5bed8