xamxte/cve-to-cwe huggingface dataset:
CVE-2023-54276: In the Linux kernel, the following vulnerability has been resolved:  nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net  Commit f5f9d4a314da ("nfsd: move reply cache initialization into nfsd startup") moved the initialization of the reply cache into nfsd startup, but didn't account for the stats counters, which can be accessed before nfsd is ever started. The result can be a NULL pointer dereference when someone accesses /proc/fs/nfsd/reply_cache_stats while nfsd is still shut down.  This is a regression and a user-triggerable oops in the right situation:  - non-x86_64 arch - /proc/fs/nfsd is mounted in the namespace - nfsd is not started in the namespace - unprivileged user calls "cat /proc/fs/nfsd/reply_cache_stats"  Although this is easy to trigger on some arches (like aarch64), on x86_64, calling this_cpu_ptr(NULL) evidently returns a pointer to the fixed_percpu_data. That struct looks just enough like a newly initialized percpu var to allow nfsd_reply_cache_stats_show to access it without Oopsing.  Move the initialization of the per-net+per-cpu reply-cache counters back into nfsd_init_net, while leaving the rest of the reply cache allocations to be done at nfsd startup time.  Kudos to Eirik who did most of the legwork to track this down.
CVE-2023-54277: In the Linux kernel, the following vulnerability has been resolved:  fbdev: udlfb: Fix endpoint check  The syzbot fuzzer detected a problem in the udlfb driver, caused by an endpoint not having the expected type:  usb 1-1: Read EDID byte 0 failed: -71 usb 1-1: Unable to get valid EDID from device/display ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.4.0-rc1-syzkaller-00016-ga4422ff22142 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace:  <TASK>  dlfb_submit_urb+0x92/0x180 drivers/video/fbdev/udlfb.c:1980  dlfb_set_video_mode+0x21f0/0x2950 drivers/video/fbdev/udlfb.c:315  dlfb_ops_set_par+0x2a7/0x8d0 drivers/video/fbdev/udlfb.c:1111  dlfb_usb_probe+0x149a/0x2710 drivers/video/fbdev/udlfb.c:1743  The current approach for this issue failed to catch the problem because it only checks for the existence of a bulk-OUT endpoint; it doesn't check whether this endpoint is the one that the driver will actually use.  We can fix the problem by instead checking that the endpoint used by the driver does exist and is bulk-OUT.
CVE-2023-54279: In the Linux kernel, the following vulnerability has been resolved:  MIPS: fw: Allow firmware to pass a empty env  fw_getenv will use env entry to determine style of env, however it is legal for firmware to just pass a empty list.  Check if first entry exist before running strchr to avoid null pointer dereference.
CVE-2023-54280: In the Linux kernel, the following vulnerability has been resolved:  cifs: fix potential race when tree connecting ipc  Protect access of TCP_Server_Info::hostname when building the ipc tree name as it might get freed in cifsd thread and thus causing an use-after-free bug in __tree_connect_dfs_target().  Also, while at it, update status of IPC tcon on success and then avoid any extra tree connects.
CVE-2023-54283: In the Linux kernel, the following vulnerability has been resolved:  bpf: Address KCSAN report on bpf_lru_list  KCSAN reported a data-race when accessing node->ref. Although node->ref does not have to be accurate, take this chance to use a more common READ_ONCE() and WRITE_ONCE() pattern instead of data_race().  There is an existing bpf_lru_node_is_ref() and bpf_lru_node_set_ref(). This patch also adds bpf_lru_node_clear_ref() to do the WRITE_ONCE(node->ref, 0) also.  ================================================================== BUG: KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem  write to 0xffff888137038deb of 1 bytes by task 11240 on cpu 1: __bpf_lru_node_move kernel/bpf/bpf_lru_list.c:113 [inline] __bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:149 [inline] __bpf_lru_list_rotate+0x1bf/0x750 kernel/bpf/bpf_lru_list.c:240 bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:329 [inline] bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline] bpf_lru_pop_free+0x638/0xe20 kernel/bpf/bpf_lru_list.c:499 prealloc_lru_pop kernel/bpf/hashtab.c:290 [inline] __htab_lru_percpu_map_update_elem+0xe7/0x820 kernel/bpf/hashtab.c:1316 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 __sys_bpf+0x338/0x810 __do_sys_bpf kernel/bpf/syscall.c:5096 [inline] __se_sys_bpf kernel/bpf/syscall.c:5094 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd  read to 0xffff888137038deb of 1 bytes by task 11241 on cpu 0: bpf_lru_node_set_ref kernel/bpf/bpf_lru_list.h:70 [inline] __htab_lru_percpu_map_update_elem+0x2f1/0x820 kernel/bpf/hashtab.c:1332 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 __sys_bpf+0x338/0x810 __do_sys_bpf kernel/bpf/syscall.c:5096 [inline] __se_sys_bpf kernel/bpf/syscall.c:5094 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd  value changed: 0x01 -> 0x00  Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 11241 Comm: syz-executor.3 Not tainted 6.3.0-rc7-syzkaller-00136-g6a66fdd29ea1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 ==================================================================
CVE-2023-54286: In the Linux kernel, the following vulnerability has been resolved:  wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace  A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the iwl_keyinfo.key field.  Add a check to not copy more data to iwl_keyinfo.key then will fit.  This fixes backtraces like this one:   memcpy: detected field-spanning write (size 32) of single field "sta_cmd.key.key" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16)  WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm]  <snip>  Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017  RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm]  <snip>  Call Trace:   <TASK>   iwl_set_dynamic_key+0x1f0/0x220 [iwldvm]   iwlagn_mac_set_key+0x1e4/0x280 [iwldvm]   drv_set_key+0xa4/0x1b0 [mac80211]   ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211]   ieee80211_key_replace+0x22d/0x8e0 [mac80211]  <snip>
CVE-2023-54289: In the Linux kernel, the following vulnerability has been resolved:  scsi: qedf: Fix NULL dereference in error handling  Smatch reported:  drivers/scsi/qedf/qedf_main.c:3056 qedf_alloc_global_queues() warn: missing unwind goto?  At this point in the function, nothing has been allocated so we can return directly. In particular the "qedf->global_queues" have not been allocated so calling qedf_free_global_queues() will lead to a NULL dereference when we check if (!gl[i]) and "gl" is NULL.
CVE-2023-54291: In the Linux kernel, the following vulnerability has been resolved:  vduse: fix NULL pointer dereference  vduse_vdpa_set_vq_affinity callback can be called with NULL value as cpu_mask when deleting the vduse device.  This patch resets virtqueue's IRQ affinity mask value to set all CPUs instead of dereferencing NULL cpu_mask.  [ 4760.952149] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 4760.959110] #PF: supervisor read access in kernel mode [ 4760.964247] #PF: error_code(0x0000) - not-present page [ 4760.969385] PGD 0 P4D 0 [ 4760.971927] Oops: 0000 [#1] PREEMPT SMP PTI [ 4760.976112] CPU: 13 PID: 2346 Comm: vdpa Not tainted 6.4.0-rc6+ #4 [ 4760.982291] Hardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.8.1 06/26/2020 [ 4760.989769] RIP: 0010:memcpy_orig+0xc5/0x130 [ 4760.994049] Code: 16 f8 4c 89 07 4c 89 4f 08 4c 89 54 17 f0 4c 89 5c 17 f8 c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 fa 08 72 1b <4c> 8b 06 4c 8b 4c 16 f8 4c 89 07 4c 89 4c 17 f8 c3 cc cc cc cc 66 [ 4761.012793] RSP: 0018:ffffb1d565abb830 EFLAGS: 00010246 [ 4761.018020] RAX: ffff9f4bf6b27898 RBX: ffff9f4be23969c0 RCX: ffff9f4bcadf6400 [ 4761.025152] RDX: 0000000000000008 RSI: 0000000000000000 RDI: ffff9f4bf6b27898 [ 4761.032286] RBP: 0000000000000000 R08: 0000000000000008 R09: 0000000000000000 [ 4761.039416] R10: 0000000000000000 R11: 0000000000000600 R12: 0000000000000000 [ 4761.046549] R13: 0000000000000000 R14: 0000000000000080 R15: ffffb1d565abbb10 [ 4761.053680] FS:  00007f64c2ec2740(0000) GS:ffff9f635f980000(0000) knlGS:0000000000000000 [ 4761.061765] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4761.067513] CR2: 0000000000000000 CR3: 0000001875270006 CR4: 00000000007706e0 [ 4761.074645] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4761.081775] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4761.088909] PKRU: 55555554 [ 4761.091620] Call Trace: [ 4761.094074]  <TASK> [ 4761.096180]  ? __die+0x1f/0x70 [ 4761.099238]  ? page_fault_oops+0x171/0x4f0 [ 4761.103340]  ? exc_page_fault+0x7b/0x180 [ 4761.107265]  ? asm_exc_page_fault+0x22/0x30 [ 4761.111460]  ? memcpy_orig+0xc5/0x130 [ 4761.115126]  vduse_vdpa_set_vq_affinity+0x3e/0x50 [vduse] [ 4761.120533]  virtnet_clean_affinity.part.0+0x3d/0x90 [virtio_net] [ 4761.126635]  remove_vq_common+0x1a4/0x250 [virtio_net] [ 4761.131781]  virtnet_remove+0x5d/0x70 [virtio_net] [ 4761.136580]  virtio_dev_remove+0x3a/0x90 [ 4761.140509]  device_release_driver_internal+0x19b/0x200 [ 4761.145742]  bus_remove_device+0xc2/0x130 [ 4761.149755]  device_del+0x158/0x3e0 [ 4761.153245]  ? kernfs_find_ns+0x35/0xc0 [ 4761.157086]  device_unregister+0x13/0x60 [ 4761.161010]  unregister_virtio_device+0x11/0x20 [ 4761.165543]  device_release_driver_internal+0x19b/0x200 [ 4761.170770]  bus_remove_device+0xc2/0x130 [ 4761.174782]  device_del+0x158/0x3e0 [ 4761.178276]  ? __pfx_vdpa_name_match+0x10/0x10 [vdpa] [ 4761.183336]  device_unregister+0x13/0x60 [ 4761.187260]  vdpa_nl_cmd_dev_del_set_doit+0x63/0xe0 [vdpa]
CVE-2023-54292: In the Linux kernel, the following vulnerability has been resolved:  RDMA/irdma: Fix data race on CQP request done  KCSAN detects a data race on cqp_request->request_done memory location which is accessed locklessly in irdma_handle_cqp_op while being updated in irdma_cqp_ce_handler.  Annotate lockless intent with READ_ONCE/WRITE_ONCE to avoid any compiler optimizations like load fusing and/or KCSAN warning.  [222808.417128] BUG: KCSAN: data-race in irdma_cqp_ce_handler [irdma] / irdma_wait_event [irdma]  [222808.417532] write to 0xffff8e44107019dc of 1 bytes by task 29658 on cpu 5: [222808.417610]  irdma_cqp_ce_handler+0x21e/0x270 [irdma] [222808.417725]  cqp_compl_worker+0x1b/0x20 [irdma] [222808.417827]  process_one_work+0x4d1/0xa40 [222808.417835]  worker_thread+0x319/0x700 [222808.417842]  kthread+0x180/0x1b0 [222808.417852]  ret_from_fork+0x22/0x30  [222808.417918] read to 0xffff8e44107019dc of 1 bytes by task 29688 on cpu 1: [222808.417995]  irdma_wait_event+0x1e2/0x2c0 [irdma] [222808.418099]  irdma_handle_cqp_op+0xae/0x170 [irdma] [222808.418202]  irdma_cqp_cq_destroy_cmd+0x70/0x90 [irdma] [222808.418308]  irdma_puda_dele_rsrc+0x46d/0x4d0 [irdma] [222808.418411]  irdma_rt_deinit_hw+0x179/0x1d0 [irdma] [222808.418514]  irdma_ib_dealloc_device+0x11/0x40 [irdma] [222808.418618]  ib_dealloc_device+0x2a/0x120 [ib_core] [222808.418823]  __ib_unregister_device+0xde/0x100 [ib_core] [222808.418981]  ib_unregister_device+0x22/0x40 [ib_core] [222808.419142]  irdma_ib_unregister_device+0x70/0x90 [irdma] [222808.419248]  i40iw_close+0x6f/0xc0 [irdma] [222808.419352]  i40e_client_device_unregister+0x14a/0x180 [i40e] [222808.419450]  i40iw_remove+0x21/0x30 [irdma] [222808.419554]  auxiliary_bus_remove+0x31/0x50 [222808.419563]  device_remove+0x69/0xb0 [222808.419572]  device_release_driver_internal+0x293/0x360 [222808.419582]  driver_detach+0x7c/0xf0 [222808.419592]  bus_remove_driver+0x8c/0x150 [222808.419600]  driver_unregister+0x45/0x70 [222808.419610]  auxiliary_driver_unregister+0x16/0x30 [222808.419618]  irdma_exit_module+0x18/0x1e [irdma] [222808.419733]  __do_sys_delete_module.constprop.0+0x1e2/0x310 [222808.419745]  __x64_sys_delete_module+0x1b/0x30 [222808.419755]  do_syscall_64+0x39/0x90 [222808.419763]  entry_SYSCALL_64_after_hwframe+0x63/0xcd  [222808.419829] value changed: 0x01 -> 0x03
CVE-2023-54293: In the Linux kernel, the following vulnerability has been resolved:  bcache: fixup btree_cache_wait list damage  We get a kernel crash about "list_add corruption. next->prev should be prev (ffff9c801bc01210), but was ffff9c77b688237c. (next=ffffae586d8afe68)."  crash> struct list_head 0xffff9c801bc01210 struct list_head {   next = 0xffffae586d8afe68,   prev = 0xffffae586d8afe68 } crash> struct list_head 0xffff9c77b688237c struct list_head {   next = 0x0,   prev = 0x0 } crash> struct list_head 0xffffae586d8afe68 struct list_head struct: invalid kernel virtual address: ffffae586d8afe68  type: "gdb_readmem_callback" Cannot access memory at address 0xffffae586d8afe68  [230469.019492] Call Trace: [230469.032041]  prepare_to_wait+0x8a/0xb0 [230469.044363]  ? bch_btree_keys_free+0x6c/0xc0 [escache] [230469.056533]  mca_cannibalize_lock+0x72/0x90 [escache] [230469.068788]  mca_alloc+0x2ae/0x450 [escache] [230469.080790]  bch_btree_node_get+0x136/0x2d0 [escache] [230469.092681]  bch_btree_check_thread+0x1e1/0x260 [escache] [230469.104382]  ? finish_wait+0x80/0x80 [230469.115884]  ? bch_btree_check_recurse+0x1a0/0x1a0 [escache] [230469.127259]  kthread+0x112/0x130 [230469.138448]  ? kthread_flush_work_fn+0x10/0x10 [230469.149477]  ret_from_fork+0x35/0x40  bch_btree_check_thread() and bch_dirty_init_thread() may call mca_cannibalize() to cannibalize other cached btree nodes. Only one thread can do it at a time, so the op of other threads will be added to the btree_cache_wait list.  We must call finish_wait() to remove op from btree_cache_wait before free it's memory address. Otherwise, the list will be damaged. Also should call bch_cannibalize_unlock() to release the btree_cache_alloc_lock and wake_up other waiters.
CVE-2023-54294: In the Linux kernel, the following vulnerability has been resolved:  md/raid10: fix memleak of md thread  In raid10_run(), if setup_conf() succeed and raid10_run() failed before setting 'mddev->thread', then in the error path 'conf->thread' is not freed.  Fix the problem by setting 'mddev->thread' right after setup_conf().
CVE-2023-54296: In the Linux kernel, the following vulnerability has been resolved:  KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration  Fix a goof where KVM tries to grab source vCPUs from the destination VM when doing intrahost migration.  Grabbing the wrong vCPU not only hoses the guest, it also crashes the host due to the VMSA pointer being left NULL.    BUG: unable to handle page fault for address: ffffe38687000000   #PF: supervisor read access in kernel mode   #PF: error_code(0x0000) - not-present page   PGD 0 P4D 0   Oops: 0000 [#1] SMP NOPTI   CPU: 39 PID: 17143 Comm: sev_migrate_tes Tainted: GO       6.5.0-smp--fff2e47e6c3b-next #151   Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.28.0 07/10/2023   RIP: 0010:__free_pages+0x15/0xd0   RSP: 0018:ffff923fcf6e3c78 EFLAGS: 00010246   RAX: 0000000000000000 RBX: ffffe38687000000 RCX: 0000000000000100   RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffe38687000000   RBP: ffff923fcf6e3c88 R08: ffff923fcafb0000 R09: 0000000000000000   R10: 0000000000000000 R11: ffffffff83619b90 R12: ffff923fa9540000   R13: 0000000000080007 R14: ffff923f6d35d000 R15: 0000000000000000   FS:  0000000000000000(0000) GS:ffff929d0d7c0000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: ffffe38687000000 CR3: 0000005224c34005 CR4: 0000000000770ee0   PKRU: 55555554   Call Trace:    <TASK>    sev_free_vcpu+0xcb/0x110 [kvm_amd]    svm_vcpu_free+0x75/0xf0 [kvm_amd]    kvm_arch_vcpu_destroy+0x36/0x140 [kvm]    kvm_destroy_vcpus+0x67/0x100 [kvm]    kvm_arch_destroy_vm+0x161/0x1d0 [kvm]    kvm_put_kvm+0x276/0x560 [kvm]    kvm_vm_release+0x25/0x30 [kvm]    __fput+0x106/0x280    ____fput+0x12/0x20    task_work_run+0x86/0xb0    do_exit+0x2e3/0x9c0    do_group_exit+0xb1/0xc0    __x64_sys_exit_group+0x1b/0x20    do_syscall_64+0x41/0x90    entry_SYSCALL_64_after_hwframe+0x63/0xcd    </TASK>   CR2: ffffe38687000000
CVE-2023-54297: In the Linux kernel, the following vulnerability has been resolved:  btrfs: zoned: fix memory leak after finding block group with super blocks  At exclude_super_stripes(), if we happen to find a block group that has super blocks mapped to it and we are on a zoned filesystem, we error out as this is not supposed to happen, indicating either a bug or maybe some memory corruption for example. However we are exiting the function without freeing the memory allocated for the logical address of the super blocks. Fix this by freeing the logical address.
CVE-2023-54298: In the Linux kernel, the following vulnerability has been resolved:  thermal: intel: quark_dts: fix error pointer dereference  If alloc_soc_dts() fails, then we can just return.  Trying to free "soc_dts" will lead to an Oops.
CVE-2023-54299: In the Linux kernel, the following vulnerability has been resolved:  usb: typec: bus: verify partner exists in typec_altmode_attention  Some usb hubs will negotiate DisplayPort Alt mode with the device but will then negotiate a data role swap after entering the alt mode. The data role swap causes the device to unregister all alt modes, however the usb hub will still send Attention messages even after failing to reregister the Alt Mode. type_altmode_attention currently does not verify whether or not a device's altmode partner exists, which results in a NULL pointer error when dereferencing the typec_altmode and typec_altmode_ops belonging to the altmode partner.  Verify the presence of a device's altmode partner before sending the Attention message to the Alt Mode driver.
CVE-2023-54300: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx  For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should validate pkt_len before accessing the SKB.  For example, the obtained SKB may have been badly constructed with pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr but after being processed in ath9k_htc_rx_msg() and passed to ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI command header which should be located inside its data payload.  Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit memory can be referenced.  Tested on Qualcomm Atheros Communications AR9271 802.11n .  Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
CVE-2023-54301: In the Linux kernel, the following vulnerability has been resolved:  serial: 8250_bcm7271: fix leak in `brcmuart_probe`  Smatch reports: drivers/tty/serial/8250/8250_bcm7271.c:1120 brcmuart_probe() warn: 'baud_mux_clk' from clk_prepare_enable() not released on lines: 1032.  The issue is fixed by using a managed clock.
CVE-2023-54302: In the Linux kernel, the following vulnerability has been resolved:  RDMA/irdma: Fix data race on CQP completion stats  CQP completion statistics is read lockesly in irdma_wait_event and irdma_check_cqp_progress while it can be updated in the completion thread irdma_sc_ccq_get_cqe_info on another CPU as KCSAN reports.  Make completion statistics an atomic variable to reflect coherent updates to it. This will also avoid load/store tearing logic bug potentially possible by compiler optimizations.  [77346.170861] BUG: KCSAN: data-race in irdma_handle_cqp_op [irdma] / irdma_sc_ccq_get_cqe_info [irdma]  [77346.171383] write to 0xffff8a3250b108e0 of 8 bytes by task 9544 on cpu 4: [77346.171483]  irdma_sc_ccq_get_cqe_info+0x27a/0x370 [irdma] [77346.171658]  irdma_cqp_ce_handler+0x164/0x270 [irdma] [77346.171835]  cqp_compl_worker+0x1b/0x20 [irdma] [77346.172009]  process_one_work+0x4d1/0xa40 [77346.172024]  worker_thread+0x319/0x700 [77346.172037]  kthread+0x180/0x1b0 [77346.172054]  ret_from_fork+0x22/0x30  [77346.172136] read to 0xffff8a3250b108e0 of 8 bytes by task 9838 on cpu 2: [77346.172234]  irdma_handle_cqp_op+0xf4/0x4b0 [irdma] [77346.172413]  irdma_cqp_aeq_cmd+0x75/0xa0 [irdma] [77346.172592]  irdma_create_aeq+0x390/0x45a [irdma] [77346.172769]  irdma_rt_init_hw.cold+0x212/0x85d [irdma] [77346.172944]  irdma_probe+0x54f/0x620 [irdma] [77346.173122]  auxiliary_bus_probe+0x66/0xa0 [77346.173137]  really_probe+0x140/0x540 [77346.173154]  __driver_probe_device+0xc7/0x220 [77346.173173]  driver_probe_device+0x5f/0x140 [77346.173190]  __driver_attach+0xf0/0x2c0 [77346.173208]  bus_for_each_dev+0xa8/0xf0 [77346.173225]  driver_attach+0x29/0x30 [77346.173240]  bus_add_driver+0x29c/0x2f0 [77346.173255]  driver_register+0x10f/0x1a0 [77346.173272]  __auxiliary_driver_register+0xbc/0x140 [77346.173287]  irdma_init_module+0x55/0x1000 [irdma] [77346.173460]  do_one_initcall+0x7d/0x410 [77346.173475]  do_init_module+0x81/0x2c0 [77346.173491]  load_module+0x1232/0x12c0 [77346.173506]  __do_sys_finit_module+0x101/0x180 [77346.173522]  __x64_sys_finit_module+0x3c/0x50 [77346.173538]  do_syscall_64+0x39/0x90 [77346.173553]  entry_SYSCALL_64_after_hwframe+0x63/0xcd  [77346.173634] value changed: 0x0000000000000094 -> 0x0000000000000095
CVE-2023-54303: In the Linux kernel, the following vulnerability has been resolved:  bpf: Disable preemption in bpf_perf_event_output  The nesting protection in bpf_perf_event_output relies on disabled preemption, which is guaranteed for kprobes and tracepoints.  However bpf_perf_event_output can be also called from uprobes context through bpf_prog_run_array_sleepable function which disables migration, but keeps preemption enabled.  This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like:    kernel tried to execute NX-protected page - exploit attempt? (uid: 0)   BUG: unable to handle page fault for address: ffffffff82be3eea   ...   Call Trace:    ? __die+0x1f/0x70    ? page_fault_oops+0x176/0x4d0    ? exc_page_fault+0x132/0x230    ? asm_exc_page_fault+0x22/0x30    ? perf_output_sample+0x12b/0x910    ? perf_event_output+0xd0/0x1d0    ? bpf_perf_event_output+0x162/0x1d0    ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87    ? __uprobe_perf_func+0x12b/0x540    ? uprobe_dispatcher+0x2c4/0x430    ? uprobe_notify_resume+0x2da/0xce0    ? atomic_notifier_call_chain+0x7b/0x110    ? exit_to_user_mode_prepare+0x13e/0x290    ? irqentry_exit_to_user_mode+0x5/0x30    ? asm_exc_int3+0x35/0x40  Fixing this by disabling preemption in bpf_perf_event_output.
CVE-2023-54304: In the Linux kernel, the following vulnerability has been resolved:  firmware: meson_sm: fix to avoid potential NULL pointer dereference  of_match_device() may fail and returns a NULL pointer.  Fix this by checking the return value of of_match_device.
CVE-2023-54305: In the Linux kernel, the following vulnerability has been resolved:  ext4: refuse to create ea block when umounted  The ea block expansion need to access s_root while it is already set as NULL when umount is triggered. Refuse this request to avoid panic.