xamxte/cve-to-cwe huggingface dataset:
CVE-2022-50815: In the Linux kernel, the following vulnerability has been resolved:  ext2: Add sanity checks for group and filesystem size  Add sanity check that filesystem size does not exceed the underlying device size and that group size is big enough so that metadata can fit into it. This avoid trying to mount some crafted filesystems with extremely large group counts.
CVE-2022-50817: In the Linux kernel, the following vulnerability has been resolved:  net: hsr: avoid possible NULL deref in skb_clone()  syzbot got a crash [1] in skb_clone(), caused by a bug in hsr_get_untagged_frame().  When/if create_stripped_skb_hsr() returns NULL, we must not attempt to call skb_clone().  While we are at it, replace a WARN_ONCE() by netdev_warn_once().  [1] general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] CPU: 1 PID: 754 Comm: syz-executor.0 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 RIP: 0010:skb_clone+0x108/0x3c0 net/core/skbuff.c:1641 Code: 93 02 00 00 49 83 7c 24 28 00 0f 85 e9 00 00 00 e8 5d 4a 29 fa 4c 8d 75 7e 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 4c 89 f2 83 e2 07 38 d0 7f 08 84 c0 0f 85 9e 01 00 00 RSP: 0018:ffffc90003ccf4e0 EFLAGS: 00010207  RAX: dffffc0000000000 RBX: ffffc90003ccf5f8 RCX: ffffc9000c24b000 RDX: 000000000000000f RSI: ffffffff8751cb13 RDI: 0000000000000000 RBP: 0000000000000000 R08: 00000000000000f0 R09: 0000000000000140 R10: fffffbfff181d972 R11: 0000000000000000 R12: ffff888161fc3640 R13: 0000000000000a20 R14: 000000000000007e R15: ffffffff8dc5f620 FS: 00007feb621e4700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007feb621e3ff8 CR3: 00000001643a9000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> hsr_get_untagged_frame+0x4e/0x610 net/hsr/hsr_forward.c:164 hsr_forward_do net/hsr/hsr_forward.c:461 [inline] hsr_forward_skb+0xcca/0x1d50 net/hsr/hsr_forward.c:623 hsr_handle_frame+0x588/0x7c0 net/hsr/hsr_slave.c:69 __netif_receive_skb_core+0x9fe/0x38f0 net/core/dev.c:5379 __netif_receive_skb_one_core+0xae/0x180 net/core/dev.c:5483 __netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5599 netif_receive_skb_internal net/core/dev.c:5685 [inline] netif_receive_skb+0x12f/0x8d0 net/core/dev.c:5744 tun_rx_batched+0x4ab/0x7a0 drivers/net/tun.c:1544 tun_get_user+0x2686/0x3a00 drivers/net/tun.c:1995 tun_chr_write_iter+0xdb/0x200 drivers/net/tun.c:2025 call_write_iter include/linux/fs.h:2187 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x9e9/0xdd0 fs/read_write.c:584 ksys_write+0x127/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
CVE-2022-50820: In the Linux kernel, the following vulnerability has been resolved:  perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init()  dmc620_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. Remove the callback by cpuhp_remove_multi_state() in fail path.  Similar to the handling of arm_ccn_init() in commit 26242b330093 ("bus: arm-ccn: Prevent hotplug callback leak")
CVE-2022-50821: In the Linux kernel, the following vulnerability has been resolved:  SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
CVE-2022-50822: In the Linux kernel, the following vulnerability has been resolved:  RDMA/restrack: Release MR restrack when delete  The MR restrack also needs to be released when delete it, otherwise it cause memory leak as the task struct won't be released.
CVE-2022-50823: In the Linux kernel, the following vulnerability has been resolved:  clk: tegra: Fix refcount leak in tegra114_clock_init  of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
CVE-2022-50824: In the Linux kernel, the following vulnerability has been resolved:  tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak  In check_acpi_tpm2(), we get the TPM2 table just to make sure the table is there, not used after the init, so the acpi_put_table() should be added to release the ACPI memory.
CVE-2022-50825: In the Linux kernel, the following vulnerability has been resolved:  usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe()  I got the following report while doing fault injection test:    OF: ERROR: memory leak, expected refcount 1 instead of 4,   of_node_get()/of_node_put() unbalanced - destroy cset entry:   attach overlay node /i2c/tcpc@60/connector  If wusb3801_hw_init() fails, fwnode_handle_put() needs be called to avoid refcount leak.
CVE-2022-50826: In the Linux kernel, the following vulnerability has been resolved:  ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection()  Calling v4l2_subdev_get_try_crop() and v4l2_subdev_get_try_compose() with a subdev state of NULL leads to a NULL pointer dereference. This can currently happen in imgu_subdev_set_selection() when the state passed in is NULL, as this method first gets pointers to both the "try" and "active" states and only then decides which to use.  The same issue has been addressed for imgu_subdev_get_selection() with commit 30d03a0de650 ("ipu3-imgu: Fix NULL pointer dereference in active selection access"). However the issue still persists in imgu_subdev_set_selection().  Therefore, apply a similar fix as done in the aforementioned commit to imgu_subdev_set_selection(). To keep things a bit cleaner, introduce helper functions for "crop" and "compose" access and use them in both imgu_subdev_set_selection() and imgu_subdev_get_selection().
CVE-2022-50827: In the Linux kernel, the following vulnerability has been resolved:  scsi: lpfc: Fix memory leak in lpfc_create_port()  Commit 5e633302ace1 ("scsi: lpfc: vmid: Add support for VMID in mailbox command") introduced allocations for the VMID resources in lpfc_create_port() after the call to scsi_host_alloc(). Upon failure on the VMID allocations, the new code would branch to the 'out' label, which returns NULL without unwinding anything, thus skipping the call to scsi_host_put().  Fix the problem by creating a separate label 'out_free_vmid' to unwind the VMID resources and make the 'out_put_shost' label call only scsi_host_put(), as was done before the introduction of allocations for VMID.
CVE-2022-50828: In the Linux kernel, the following vulnerability has been resolved:  clk: zynqmp: Fix stack-out-of-bounds in strncpy`  "BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68"  Linux-ATF interface is using 16 bytes of SMC payload. In case clock name is longer than 15 bytes, string terminated NULL character will not be received by Linux. Add explicit NULL character at last byte to fix issues when clock name is longer.  This fixes below bug reported by KASAN:   ==================================================================  BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68  Read of size 1 at addr ffff0008c89a7410 by task swapper/0/1   CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.4.0-00396-g81ef9e7-dirty #3  Hardware name: Xilinx Versal vck190 Eval board revA (QSPI) (DT)  Call trace:   dump_backtrace+0x0/0x1e8   show_stack+0x14/0x20   dump_stack+0xd4/0x108   print_address_description.isra.0+0xbc/0x37c   __kasan_report+0x144/0x198   kasan_report+0xc/0x18   __asan_load1+0x5c/0x68   strncpy+0x30/0x68   zynqmp_clock_probe+0x238/0x7b8   platform_drv_probe+0x6c/0xc8   really_probe+0x14c/0x418   driver_probe_device+0x74/0x130   __device_attach_driver+0xc4/0xe8   bus_for_each_drv+0xec/0x150   __device_attach+0x160/0x1d8   device_initial_probe+0x10/0x18   bus_probe_device+0xe0/0xf0   device_add+0x528/0x950   of_device_add+0x5c/0x80   of_platform_device_create_pdata+0x120/0x168   of_platform_bus_create+0x244/0x4e0   of_platform_populate+0x50/0xe8   zynqmp_firmware_probe+0x370/0x3a8   platform_drv_probe+0x6c/0xc8   really_probe+0x14c/0x418   driver_probe_device+0x74/0x130   device_driver_attach+0x94/0xa0   __driver_attach+0x70/0x108   bus_for_each_dev+0xe4/0x158   driver_attach+0x30/0x40   bus_add_driver+0x21c/0x2b8   driver_register+0xbc/0x1d0   __platform_driver_register+0x7c/0x88   zynqmp_firmware_driver_init+0x1c/0x24   do_one_initcall+0xa4/0x234   kernel_init_freeable+0x1b0/0x24c   kernel_init+0x10/0x110   ret_from_fork+0x10/0x18   The buggy address belongs to the page:  page:ffff0008f9be1c88 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0  raw: 0008d00000000000 ffff0008f9be1c90 ffff0008f9be1c90 0000000000000000  raw: 0000000000000000 0000000000000000 00000000ffffffff  page dumped because: kasan: bad access detected   addr ffff0008c89a7410 is located in stack of task swapper/0/1 at offset 112 in frame:   zynqmp_clock_probe+0x0/0x7b8   this frame has 3 objects:   [32, 44) 'response'   [64, 80) 'ret_payload'   [96, 112) 'name'   Memory state around the buggy address:   ffff0008c89a7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ffff0008c89a7380: 00 00 00 00 f1 f1 f1 f1 00 04 f2 f2 00 00 f2 f2  >ffff0008c89a7400: 00 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00                           ^   ffff0008c89a7480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ffff0008c89a7500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ==================================================================
CVE-2022-50829: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()  It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak.  The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function.  Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
CVE-2022-50830: In the Linux kernel, the following vulnerability has been resolved:  auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()  hd44780_probe() allocates a memory chunk for hd with kzalloc() and makes "lcd->drvdata->hd44780" point to it. When we call hd44780_remove(), we should release all relevant memory and resource. But "lcd->drvdata ->hd44780" is not released, which will lead to a memory leak.  We should release the "lcd->drvdata->hd44780" in hd44780_remove() to fix the memory leak bug.
CVE-2022-50832: In the Linux kernel, the following vulnerability has been resolved:  wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()  The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add dev_kfree_skb() to fix it. Compile tested only.
CVE-2022-50834: In the Linux kernel, the following vulnerability has been resolved:  nfc: Fix potential resource leaks  nfc_get_device() take reference for the device, add missing nfc_put_device() to release it when not need anymore. Also fix the style warnning by use error EOPNOTSUPP instead of ENOTSUPP.
CVE-2022-50835: In the Linux kernel, the following vulnerability has been resolved:  jbd2: add miss release buffer head in fc_do_one_pass()  In fc_do_one_pass() miss release buffer head after use which will lead to reference count leak.
CVE-2022-50836: In the Linux kernel, the following vulnerability has been resolved:  remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()  The kfree() should be called when of_irq_get_byname() fails or devm_request_threaded_irq() fails in qcom_add_sysmon_subdev(), otherwise there will be a memory leak, so add kfree() to fix it.
CVE-2022-50837: In the Linux kernel, the following vulnerability has been resolved:  net: dsa: tag_8021q: avoid leaking ctx on dsa_tag_8021q_register() error path  If dsa_tag_8021q_setup() fails, for example due to the inability of the device to install a VLAN, the tag_8021q context of the switch will leak. Make sure it is freed on the error path.
CVE-2022-50838: In the Linux kernel, the following vulnerability has been resolved:  net: stream: purge sk_error_queue in sk_stream_kill_queues()  Changheon Lee reported TCP socket leaks, with a nice repro.  It seems we leak TCP sockets with the following sequence:  1) SOF_TIMESTAMPING_TX_ACK is enabled on the socket.     Each ACK will cook an skb put in error queue, from __skb_tstamp_tx().    __skb_tstamp_tx() is using skb_clone(), unless    SOF_TIMESTAMPING_OPT_TSONLY was also requested.  2) If the application is also using MSG_ZEROCOPY, then we put in the    error queue cloned skbs that had a struct ubuf_info attached to them.     Whenever an struct ubuf_info is allocated, sock_zerocopy_alloc()    does a sock_hold().     As long as the cloned skbs are still in sk_error_queue,    socket refcount is kept elevated.  3) Application closes the socket, while error queue is not empty.  Since tcp_close() no longer purges the socket error queue, we might end up with a TCP socket with at least one skb in error queue keeping the socket alive forever.  This bug can be (ab)used to consume all kernel memory and freeze the host.  We need to purge the error queue, with proper synchronization against concurrent writers.
CVE-2022-50840: In the Linux kernel, the following vulnerability has been resolved:  scsi: snic: Fix possible UAF in snic_tgt_create()  Smatch reports a warning as follows:  drivers/scsi/snic/snic_disc.c:307 snic_tgt_create() warn:   '&tgt->list' not removed from list  If device_add() fails in snic_tgt_create(), tgt will be freed, but tgt->list will not be removed from snic->disc.tgt_list, then list traversal may cause UAF.  Remove from snic->disc.tgt_list before free().
CVE-2022-50842: In the Linux kernel, the following vulnerability has been resolved:  drm/virtio: Check whether transferred 2D BO is shmem  Transferred 2D BO always must be a shmem BO. Add check for that to prevent NULL dereference if userspace passes a VRAM BO.
CVE-2022-50843: In the Linux kernel, the following vulnerability has been resolved:  dm clone: Fix UAF in clone_dtr()  Dm_clone also has the same UAF problem when dm_resume() and dm_destroy() are concurrent.  Therefore, cancelling timer again in clone_dtr().
CVE-2022-50844: In the Linux kernel, the following vulnerability has been resolved:  drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback  With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A proposed warning in clang aims to catch these at compile time, which reveals:    drivers/gpu/drm/amd/amdgpu/../pm/swsmu/amdgpu_smu.c:3008:29: error: incompatible function pointer types initializing 'int (*)(void *, uint32_t, long *, uint32_t)' (aka 'int (*)(void *, unsigned int, long *, unsigned int)') with an expression of type 'int (void *, enum PP_OD_DPM_TABLE_COMMAND, long *, uint32_t)' (aka 'int (void *, enum PP_OD_DPM_TABLE_COMMAND, long *, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict]           .odn_edit_dpm_table      = smu_od_edit_dpm_table,                                      ^~~~~~~~~~~~~~~~~~~~~   1 error generated.  There are only two implementations of ->odn_edit_dpm_table() in 'struct amd_pm_funcs': smu_od_edit_dpm_table() and pp_odn_edit_dpm_table(). One has a second parameter type of 'enum PP_OD_DPM_TABLE_COMMAND' and the other uses 'u32'. Ultimately, smu_od_edit_dpm_table() calls ->od_edit_dpm_table() from 'struct pptable_funcs' and pp_odn_edit_dpm_table() calls ->odn_edit_dpm_table() from 'struct pp_hwmgr_func', which both have a second parameter type of 'enum PP_OD_DPM_TABLE_COMMAND'.  Update the type parameter in both the prototype in 'struct amd_pm_funcs' and pp_odn_edit_dpm_table() to 'enum PP_OD_DPM_TABLE_COMMAND', which cleans up the warning.
CVE-2022-50845: In the Linux kernel, the following vulnerability has been resolved:  ext4: fix inode leak in ext4_xattr_inode_create() on an error path  There is issue as follows when do setxattr with inject fault:  [localhost]# fsck.ext4  -fn  /dev/sda e2fsck 1.46.6-rc1 (12-Sep-2022) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Unattached zero-length inode 15.  Clear? no  Unattached inode 15 Connect to /lost+found? no  Pass 5: Checking group summary information  /dev/sda: ********** WARNING: Filesystem still has errors **********  /dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks  This occurs in 'ext4_xattr_inode_create()'. If 'ext4_mark_inode_dirty()' fails, dropping i_nlink of the inode is needed. Or will lead to inode leak.
CVE-2022-50846: In the Linux kernel, the following vulnerability has been resolved:  mmc: via-sdmmc: fix return value check of mmc_add_host()  mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to    delete device, but it's not added yet, it will lead a kernel    crash because of null-ptr-deref in device_del().  Fix this by checking the return value and goto error path which will call mmc_free_host().
CVE-2022-50847: In the Linux kernel, the following vulnerability has been resolved:  drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe  During device boot, the HPD interrupt could be triggered before the DRM subsystem registers it6505 as a DRM bridge. In such cases, the driver tries to access AUX channel and causes NULL pointer dereference. Initializing the AUX channel earlier to prevent such error.
CVE-2022-50848: In the Linux kernel, the following vulnerability has been resolved:  drivers: dio: fix possible memory leak in dio_init()  If device_register() returns error, the 'dev' and name needs be freed. Add a release function, and then call put_device() in the error path, so the name is freed in kobject_cleanup() and to the 'dev' is freed in release function.
CVE-2022-50852: In the Linux kernel, the following vulnerability has been resolved:  wifi: mt76: mt7921: fix use after free in mt7921_acpi_read()  Don't dereference "sar_root" after it has been freed.
CVE-2022-50853: In the Linux kernel, the following vulnerability has been resolved:  NFSv4: Fix a credential leak in _nfs4_discover_trunking()
CVE-2022-50854: In the Linux kernel, the following vulnerability has been resolved:  nfc: virtual_ncidev: Fix memory leak in virtual_nci_send()  skb should be free in virtual_nci_send(), otherwise kmemleak will report memleak.  Steps for reproduction (simulated in qemu):  cd tools/testing/selftests/nci  make  ./nci_dev  BUG: memory leak unreferenced object 0xffff888107588000 (size 208):   comm "nci_dev", pid 206, jiffies 4294945376 (age 368.248s)   hex dump (first 32 bytes):     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................   backtrace:     [<000000008d94c8fd>] __alloc_skb+0x1da/0x290     [<00000000278bc7f8>] nci_send_cmd+0xa3/0x350     [<0000000081256a22>] nci_reset_req+0x6b/0xa0     [<000000009e721112>] __nci_request+0x90/0x250     [<000000005d556e59>] nci_dev_up+0x217/0x5b0     [<00000000e618ce62>] nfc_dev_up+0x114/0x220     [<00000000981e226b>] nfc_genl_dev_up+0x94/0xe0     [<000000009bb03517>] genl_family_rcv_msg_doit.isra.14+0x228/0x2d0     [<00000000b7f8c101>] genl_rcv_msg+0x35c/0x640     [<00000000c94075ff>] netlink_rcv_skb+0x11e/0x350     [<00000000440cfb1e>] genl_rcv+0x24/0x40     [<0000000062593b40>] netlink_unicast+0x43f/0x640     [<000000001d0b13cc>] netlink_sendmsg+0x73a/0xbf0     [<000000003272487f>] __sys_sendto+0x324/0x370     [<00000000ef9f1747>] __x64_sys_sendto+0xdd/0x1b0     [<000000001e437841>] do_syscall_64+0x3f/0x90
CVE-2022-50855: In the Linux kernel, the following vulnerability has been resolved:  bpf: prevent leak of lsm program after failed attach  In [0], we added the ability to bpf_prog_attach LSM programs to cgroups, but in our validation to make sure the prog is meant to be attached to BPF_LSM_CGROUP, we return too early if the check fails. This results in lack of decrementing prog's refcnt (through bpf_prog_put) leaving the LSM program alive past the point of the expected lifecycle. This fix allows for the decrement to take place.  [0] https://lore.kernel.org/all/20220628174314.1216643-4-sdf@google.com/
CVE-2022-50856: In the Linux kernel, the following vulnerability has been resolved:  cifs: Fix xid leak in cifs_ses_add_channel()  Before return, should free the xid, otherwise, the xid will be leaked.
CVE-2022-50857: In the Linux kernel, the following vulnerability has been resolved:  rapidio: rio: fix possible name leak in rio_register_mport()  If device_register() returns error, the name allocated by dev_set_name() need be freed.  It should use put_device() to give up the reference in the error path, so that the name can be freed in kobject_cleanup(), and list_del() is called to delete the port from rio_mports.
CVE-2022-50858: In the Linux kernel, the following vulnerability has been resolved:  mmc: alcor: fix return value check of mmc_add_host()  mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path.  So fix this by checking the return value and calling mmc_free_host() in the error path.
CVE-2022-50860: In the Linux kernel, the following vulnerability has been resolved:  apparmor: Fix memleak in alloc_ns()  After changes in commit a1bd627b46d1 ("apparmor: share profile name on replacement"), the hname member of struct aa_policy is not valid slab object, but a subset of that, it can not be freed by kfree_sensitive(), use aa_policy_destroy() to fix it.
CVE-2022-50861: In the Linux kernel, the following vulnerability has been resolved:  NFSD: Finish converting the NFSv2 GETACL result encoder  The xdr_stream conversion inadvertently left some code that set the page_len of the send buffer. The XDR stream encoders should handle this automatically now.  This oversight adds garbage past the end of the Reply message. Clients typically ignore the garbage, but NFSD does not need to send it, as it leaks stale memory contents onto the wire.