xamxte/cve-to-cwe huggingface dataset:
CVE-2023-54192: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix null pointer panic in tracepoint in __replace_atomic_write_block  We got a kernel panic if old_addr is NULL.  https://bugzilla.kernel.org/show_bug.cgi?id=217266  BUG: kernel NULL pointer dereference, address: 0000000000000000  Call Trace:   <TASK>   f2fs_commit_atomic_write+0x619/0x990 [f2fs a1b985b80f5babd6f3ea778384908880812bfa43]   __f2fs_ioctl+0xd8e/0x4080 [f2fs a1b985b80f5babd6f3ea778384908880812bfa43]   ? vfs_write+0x2ae/0x3f0   ? vfs_write+0x2ae/0x3f0   __x64_sys_ioctl+0x91/0xd0   do_syscall_64+0x5c/0x90   entry_SYSCALL_64_after_hwframe+0x72/0xdc  RIP: 0033:0x7f69095fe53f
CVE-2023-54195: In the Linux kernel, the following vulnerability has been resolved:  rxrpc: Fix timeout of a call that hasn't yet been granted a channel  afs_make_call() calls rxrpc_kernel_begin_call() to begin a call (which may get stalled in the background waiting for a connection to become available); it then calls rxrpc_kernel_set_max_life() to set the timeouts - but that starts the call timer so the call timer might then expire before we get a connection assigned - leading to the following oops if the call stalled:   BUG: kernel NULL pointer dereference, address: 0000000000000000  ...  CPU: 1 PID: 5111 Comm: krxrpcio/0 Not tainted 6.3.0-rc7-build3+ #701  RIP: 0010:rxrpc_alloc_txbuf+0xc0/0x157  ...  Call Trace:   <TASK>   rxrpc_send_ACK+0x50/0x13b   rxrpc_input_call_event+0x16a/0x67d   rxrpc_io_thread+0x1b6/0x45f   ? _raw_spin_unlock_irqrestore+0x1f/0x35   ? rxrpc_input_packet+0x519/0x519   kthread+0xe7/0xef   ? kthread_complete_and_exit+0x1b/0x1b   ret_from_fork+0x22/0x30  Fix this by noting the timeouts in struct rxrpc_call when the call is created.  The timer will be started when the first packet is transmitted.  It shouldn't be possible to trigger this directly from userspace through AF_RXRPC as sendmsg() will return EBUSY if the call is in the waiting-for-conn state if it dropped out of the wait due to a signal.
CVE-2023-54198: In the Linux kernel, the following vulnerability has been resolved:  tty: fix out-of-bounds access in tty_driver_lookup_tty()  When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid number.  To reproduce:  qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \ -kernel ../linux-build-x86/arch/x86/boot/bzImage \ -append "console=ttyS0 console=tty3270"  This crashes with:  [    0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef [    0.771265] #PF: supervisor read access in kernel mode [    0.771773] #PF: error_code(0x0000) - not-present page [    0.772609] Oops: 0000 [#1] PREEMPT SMP PTI [    0.774878] RIP: 0010:tty_open+0x268/0x6f0 [    0.784013]  chrdev_open+0xbd/0x230 [    0.784444]  ? cdev_device_add+0x80/0x80 [    0.784920]  do_dentry_open+0x1e0/0x410 [    0.785389]  path_openat+0xca9/0x1050 [    0.785813]  do_filp_open+0xaa/0x150 [    0.786240]  file_open_name+0x133/0x1b0 [    0.786746]  filp_open+0x27/0x50 [    0.787244]  console_on_rootfs+0x14/0x4d [    0.787800]  kernel_init_freeable+0x1e4/0x20d [    0.788383]  ? rest_init+0xc0/0xc0 [    0.788881]  kernel_init+0x11/0x120 [    0.789356]  ret_from_fork+0x22/0x30
CVE-2023-54199: In the Linux kernel, the following vulnerability has been resolved:  drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()  Fix the below kernel panic due to null pointer access: [   18.504431] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 [   18.513464] Mem abort info: [   18.516346]   ESR = 0x0000000096000005 [   18.520204]   EC = 0x25: DABT (current EL), IL = 32 bits [   18.525706]   SET = 0, FnV = 0 [   18.528878]   EA = 0, S1PTW = 0 [   18.532117]   FSC = 0x05: level 1 translation fault [   18.537138] Data abort info: [   18.540110]   ISV = 0, ISS = 0x00000005 [   18.544060]   CM = 0, WnR = 0 [   18.547109] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000112826000 [   18.553738] [0000000000000048] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [   18.562690] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP **Snip** [   18.696758] Call trace: [   18.699278]  adreno_gpu_cleanup+0x30/0x88 [   18.703396]  a6xx_destroy+0xc0/0x130 [   18.707066]  a6xx_gpu_init+0x308/0x424 [   18.710921]  adreno_bind+0x178/0x288 [   18.714590]  component_bind_all+0xe0/0x214 [   18.718797]  msm_drm_bind+0x1d4/0x614 [   18.722566]  try_to_bring_up_aggregate_device+0x16c/0x1b8 [   18.728105]  __component_add+0xa0/0x158 [   18.732048]  component_add+0x20/0x2c [   18.735719]  adreno_probe+0x40/0xc0 [   18.739300]  platform_probe+0xb4/0xd4 [   18.743068]  really_probe+0xfc/0x284 [   18.746738]  __driver_probe_device+0xc0/0xec [   18.751129]  driver_probe_device+0x48/0x110 [   18.755421]  __device_attach_driver+0xa8/0xd0 [   18.759900]  bus_for_each_drv+0x90/0xdc [   18.763843]  __device_attach+0xfc/0x174 [   18.767786]  device_initial_probe+0x20/0x2c [   18.772090]  bus_probe_device+0x40/0xa0 [   18.776032]  deferred_probe_work_func+0x94/0xd0 [   18.780686]  process_one_work+0x190/0x3d0 [   18.784805]  worker_thread+0x280/0x3d4 [   18.788659]  kthread+0x104/0x1c0 [   18.791981]  ret_from_fork+0x10/0x20 [   18.795654] Code: f9400408 aa0003f3 aa1f03f4 91142015 (f9402516) [   18.801913] ---[ end trace 0000000000000000 ]--- [   18.809039] Kernel panic - not syncing: Oops: Fatal exception  Patchwork: https://patchwork.freedesktop.org/patch/515605/
CVE-2023-54200: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nf_tables: always release netdev hooks from notifier  This reverts "netfilter: nf_tables: skip netdev events generated on netns removal".  The problem is that when a veth device is released, the veth release callback will also queue the peer netns device for removal.  Its possible that the peer netns is also slated for removal.  In this case, the device memory is already released before the pre_exit hook of the peer netns runs:  BUG: KASAN: slab-use-after-free in nf_hook_entry_head+0x1b8/0x1d0 Read of size 8 at addr ffff88812c0124f0 by task kworker/u8:1/45 Workqueue: netns cleanup_net Call Trace:  nf_hook_entry_head+0x1b8/0x1d0  __nf_unregister_net_hook+0x76/0x510  nft_netdev_unregister_hooks+0xa0/0x220  __nft_release_hook+0x184/0x490  nf_tables_pre_exit_net+0x12f/0x1b0  ..  Order is: 1. First netns is released, veth_dellink() queues peer netns device    for removal 2. peer netns is queued for removal 3. peer netns device is released, unreg event is triggered 4. unreg event is ignored because netns is going down 5. pre_exit hook calls nft_netdev_unregister_hooks but device memory    might be free'd already.
CVE-2023-54202: In the Linux kernel, the following vulnerability has been resolved:  drm/i915: fix race condition UAF in i915_perf_add_config_ioctl  Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the object after unlocking the metrics_lock.  For that reason, unlocking the metrics_lock must be done after we are done dereferencing the object.  [tursulin: Manually added stable tag.] (cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395)
CVE-2023-54203: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr  When smb1 mount fails, KASAN detect slab-out-of-bounds in init_smb2_rsp_hdr like the following one. For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 is called. The issue occurs while handling smb1 negotiate as smb2 server operations. Add smb server operations for smb1 (get_cmd_val, init_rsp_hdr, allocate_rsp_buf, check_user_session) to handle smb1 negotiate so that smb2 server operation does not handle it.  [  411.400423] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers [  411.400452] CIFS: Attempting to mount \\192.168.45.139\homes [  411.479312] ksmbd: init_smb2_rsp_hdr : 492 [  411.479323] ================================================================== [  411.479327] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [  411.479369] Read of size 16 at addr ffff888488ed0734 by task kworker/14:1/199  [  411.479379] CPU: 14 PID: 199 Comm: kworker/14:1 Tainted: G  OE      6.1.21 #3 [  411.479386] Hardware name: ASUSTeK COMPUTER INC. Z10PA-D8 Series/Z10PA-D8 Series, BIOS 3801 08/23/2019 [  411.479390] Workqueue: ksmbd-io handle_ksmbd_work [ksmbd] [  411.479425] Call Trace: [  411.479428]  <TASK> [  411.479432]  dump_stack_lvl+0x49/0x63 [  411.479444]  print_report+0x171/0x4a8 [  411.479452]  ? kasan_complete_mode_report_info+0x3c/0x200 [  411.479463]  ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [  411.479497]  kasan_report+0xb4/0x130 [  411.479503]  ? init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [  411.479537]  kasan_check_range+0x149/0x1e0 [  411.479543]  memcpy+0x24/0x70 [  411.479550]  init_smb2_rsp_hdr+0x1e2/0x1f4 [ksmbd] [  411.479585]  handle_ksmbd_work+0x109/0x760 [ksmbd] [  411.479616]  ? _raw_spin_unlock_irqrestore+0x50/0x50 [  411.479624]  ? smb3_encrypt_resp+0x340/0x340 [ksmbd] [  411.479656]  process_one_work+0x49c/0x790 [  411.479667]  worker_thread+0x2b1/0x6e0 [  411.479674]  ? process_one_work+0x790/0x790 [  411.479680]  kthread+0x177/0x1b0 [  411.479686]  ? kthread_complete_and_exit+0x30/0x30 [  411.479692]  ret_from_fork+0x22/0x30 [  411.479702]  </TASK>
CVE-2023-54204: In the Linux kernel, the following vulnerability has been resolved:  mmc: sunplus: fix return value check of mmc_add_host()  mmc_add_host() may return error, if we ignore its return value, 1. the memory allocated in mmc_alloc_host() will be leaked 2. null-ptr-deref will happen when calling mmc_remove_host() in remove function spmmc_drv_remove() because deleting not added device.  Fix this by checking the return value of mmc_add_host(). Moreover, I fixed the error handling path of spmmc_drv_probe() to clean up.
CVE-2023-54205: In the Linux kernel, the following vulnerability has been resolved:  pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain  of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
CVE-2023-54208: In the Linux kernel, the following vulnerability has been resolved:  media: ov5675: Fix memleak in ov5675_init_controls()  There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock device:  AssertionError: unreferenced object 0xffff888107362160 (size 16):   comm "python3", pid 277, jiffies 4294832798 (age 20.722s)   hex dump (first 16 bytes):     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................   backtrace:     [<00000000abe7d67c>] __kmalloc_node+0x44/0x1b0     [<000000008a725aac>] kvmalloc_node+0x34/0x180     [<000000009a53cd11>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev]     [<0000000055b46db0>] ov5675_probe+0x38b/0x897 [ov5675]     [<00000000153d886c>] i2c_device_probe+0x28d/0x680     [<000000004afb7e8f>] really_probe+0x17c/0x3f0     [<00000000ff2f18e4>] __driver_probe_device+0xe3/0x170     [<000000000a001029>] driver_probe_device+0x49/0x120     [<00000000e39743c7>] __device_attach_driver+0xf7/0x150     [<00000000d32fd070>] bus_for_each_drv+0x114/0x180     [<000000009083ac41>] __device_attach+0x1e5/0x2d0     [<0000000015b4a830>] bus_probe_device+0x126/0x140     [<000000007813deaf>] device_add+0x810/0x1130     [<000000007becb867>] i2c_new_client_device+0x386/0x540     [<000000007f9cf4b4>] of_i2c_register_device+0xf1/0x110     [<00000000ebfdd032>] of_i2c_notify+0xfc/0x1f0  ov5675_init_controls() won't clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak.
CVE-2023-54210: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()  KASAN reports that there's a use-after-free in hci_remove_adv_monitor(). Trawling through the disassembly, you can see that the complaint is from the access in bt_dev_dbg() under the HCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because msft_remove_monitor() can end up freeing the monitor structure. Specifically:   hci_remove_adv_monitor() ->   msft_remove_monitor() ->   msft_remove_monitor_sync() ->   msft_le_cancel_monitor_advertisement_cb() ->   hci_free_adv_monitor()  Let's fix the problem by just stashing the relevant data when it's still valid.
CVE-2023-54213: In the Linux kernel, the following vulnerability has been resolved:  USB: sisusbvga: Add endpoint checks  The syzbot fuzzer was able to provoke a WARNING from the sisusbvga driver:  ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 26 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.2.0-rc5-syzkaller-00199-g5af6ce704936 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 6c 50 80 fb 48 8b 7c 24 18 e8 62 1a 01 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 60 b1 fa 8a e8 84 b0 be 03 <0f> 0b e9 58 f8 ff ff e8 3e 50 80 fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90000a1ed18 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff888012783a80 RSI: ffffffff816680ec RDI: fffff52000143d95 RBP: ffff888079020000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff888017d33370 R14: 0000000000000003 R15: ffff888021213600 FS:  0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005592753a60b0 CR3: 0000000022899000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace:  <TASK>  sisusb_bulkout_msg drivers/usb/misc/sisusbvga/sisusbvga.c:224 [inline]  sisusb_send_bulk_msg.constprop.0+0x904/0x1230 drivers/usb/misc/sisusbvga/sisusbvga.c:379  sisusb_send_bridge_packet drivers/usb/misc/sisusbvga/sisusbvga.c:567 [inline]  sisusb_do_init_gfxdevice drivers/usb/misc/sisusbvga/sisusbvga.c:2077 [inline]  sisusb_init_gfxdevice+0x87b/0x4000 drivers/usb/misc/sisusbvga/sisusbvga.c:2177  sisusb_probe+0x9cd/0xbe2 drivers/usb/misc/sisusbvga/sisusbvga.c:2869 ...  The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types.  This can be fixed by adding a simple check of the endpoints.
CVE-2023-54214: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: L2CAP: Fix potential user-after-free  This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which makes it possible that the chan is disconnected in the meantime.
CVE-2023-54215: In the Linux kernel, the following vulnerability has been resolved:  virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs()  Free the cpumask allocated by create_affinity_masks() before returning from the function.
CVE-2023-54218: In the Linux kernel, the following vulnerability has been resolved:  net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().  KCSAN found a data race in sock_recv_cmsgs() where the read access to sk->sk_stamp needs READ_ONCE().  BUG: KCSAN: data-race in packet_recvmsg / packet_recvmsg  write (marked) to 0xffff88803c81f258 of 8 bytes by task 19171 on cpu 0:  sock_write_timestamp include/net/sock.h:2670 [inline]  sock_recv_cmsgs include/net/sock.h:2722 [inline]  packet_recvmsg+0xb97/0xd00 net/packet/af_packet.c:3489  sock_recvmsg_nosec net/socket.c:1019 [inline]  sock_recvmsg+0x11a/0x130 net/socket.c:1040  sock_read_iter+0x176/0x220 net/socket.c:1118  call_read_iter include/linux/fs.h:1845 [inline]  new_sync_read fs/read_write.c:389 [inline]  vfs_read+0x5e0/0x630 fs/read_write.c:470  ksys_read+0x163/0x1a0 fs/read_write.c:613  __do_sys_read fs/read_write.c:623 [inline]  __se_sys_read fs/read_write.c:621 [inline]  __x64_sys_read+0x41/0x50 fs/read_write.c:621  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x72/0xdc  read to 0xffff88803c81f258 of 8 bytes by task 19183 on cpu 1:  sock_recv_cmsgs include/net/sock.h:2721 [inline]  packet_recvmsg+0xb64/0xd00 net/packet/af_packet.c:3489  sock_recvmsg_nosec net/socket.c:1019 [inline]  sock_recvmsg+0x11a/0x130 net/socket.c:1040  sock_read_iter+0x176/0x220 net/socket.c:1118  call_read_iter include/linux/fs.h:1845 [inline]  new_sync_read fs/read_write.c:389 [inline]  vfs_read+0x5e0/0x630 fs/read_write.c:470  ksys_read+0x163/0x1a0 fs/read_write.c:613  __do_sys_read fs/read_write.c:623 [inline]  __se_sys_read fs/read_write.c:621 [inline]  __x64_sys_read+0x41/0x50 fs/read_write.c:621  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x72/0xdc  value changed: 0xffffffffc4653600 -> 0x0000000000000000  Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19183 Comm: syz-executor.5 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
CVE-2023-54220: In the Linux kernel, the following vulnerability has been resolved:  serial: 8250: Fix oops for port->pm on uart_change_pm()  Unloading a hardware specific 8250 driver can produce error "Unable to handle kernel paging request at virtual address" about ten seconds after unloading the driver. This happens on uart_hangup() calling uart_change_pm().  Turns out commit 04e82793f068 ("serial: 8250: Reinit port->pm on port specific driver unbind") was only a partial fix. If the hardware specific driver has initialized port->pm function, we need to clear port->pm too. Just reinitializing port->ops does not do this. Otherwise serial8250_pm() will call port->pm() instead of serial8250_do_pm().
CVE-2023-54221: In the Linux kernel, the following vulnerability has been resolved:  clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe  In function probe(), it returns directly without unregistered hws when error occurs.  Fix this by adding 'goto unregister_hws;' on line 295 and line 310.  Use devm_kzalloc() instead of kzalloc() to automatically free the memory using devm_kfree() when error occurs.  Replace of_iomap() with devm_of_iomap() to automatically handle the unused ioremap region and delete 'iounmap(anatop_base);' in unregister_hws.
CVE-2023-54222: In the Linux kernel, the following vulnerability has been resolved:  hte: tegra-194: Fix off by one in tegra_hte_map_to_line_id()  The "map_sz" is the number of elements in the "m" array so the > comparison needs to be changed to >= to prevent an out of bounds read.
CVE-2023-54223: In the Linux kernel, the following vulnerability has been resolved:  net/mlx5e: xsk: Fix invalid buffer access for legacy rq  The below crash can be encountered when using xdpsock in rx mode for legacy rq: the buffer gets released in the XDP_REDIRECT path, and then once again in the driver. This fix sets the flag to avoid releasing on the driver side.  XSK handling of buffers for legacy rq was relying on the caller to set the skip release flag. But the referenced fix started using fragment counts for pages instead of the skip flag.  Crash log:  general protection fault, probably for non-canonical address 0xffff8881217e3a: 0000 [#1] SMP  CPU: 0 PID: 14 Comm: ksoftirqd/0 Not tainted 6.5.0-rc1+ #31  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014  RIP: 0010:bpf_prog_03b13f331978c78c+0xf/0x28  Code:  ...  RSP: 0018:ffff88810082fc98 EFLAGS: 00010246  RAX: 0000000000000000 RBX: ffff888138404901 RCX: c0ffffc900027cbc  RDX: ffffffffa000b514 RSI: 00ffff8881217e32 RDI: ffff888138404901  RBP: ffff88810082fc98 R08: 0000000000091100 R09: 0000000000000006  R10: 0000000000000800 R11: 0000000000000800 R12: ffffc9000027a000  R13: ffff8881217e2dc0 R14: ffff8881217e2910 R15: ffff8881217e2f00  FS:  0000000000000000(0000) GS:ffff88852c800000(0000) knlGS:0000000000000000  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033  CR2: 0000564cb2e2cde0 CR3: 000000010e603004 CR4: 0000000000370eb0  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400  Call Trace:   <TASK>   ? die_addr+0x32/0x80   ? exc_general_protection+0x192/0x390   ? asm_exc_general_protection+0x22/0x30   ? 0xffffffffa000b514   ? bpf_prog_03b13f331978c78c+0xf/0x28   mlx5e_xdp_handle+0x48/0x670 [mlx5_core]   ? dev_gro_receive+0x3b5/0x6e0   mlx5e_xsk_skb_from_cqe_linear+0x6e/0x90 [mlx5_core]   mlx5e_handle_rx_cqe+0x55/0x100 [mlx5_core]   mlx5e_poll_rx_cq+0x87/0x6e0 [mlx5_core]   mlx5e_napi_poll+0x45e/0x6b0 [mlx5_core]   __napi_poll+0x25/0x1a0   net_rx_action+0x28a/0x300   __do_softirq+0xcd/0x279   ? sort_range+0x20/0x20   run_ksoftirqd+0x1a/0x20   smpboot_thread_fn+0xa2/0x130   kthread+0xc9/0xf0   ? kthread_complete_and_exit+0x20/0x20   ret_from_fork+0x1f/0x30   </TASK>  Modules linked in: mlx5_ib mlx5_core rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm ib_uverbs ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay zram zsmalloc fuse [last unloaded: mlx5_core]  ---[ end trace 0000000000000000 ]---
CVE-2023-54226: In the Linux kernel, the following vulnerability has been resolved:  af_unix: Fix data races around sk->sk_shutdown.  KCSAN found a data race around sk->sk_shutdown where unix_release_sock() and unix_shutdown() update it under unix_state_lock(), OTOH unix_poll() and unix_dgram_poll() read it locklessly.  We need to annotate the writes and reads with WRITE_ONCE() and READ_ONCE().  BUG: KCSAN: data-race in unix_poll / unix_release_sock  write to 0xffff88800d0f8aec of 1 bytes by task 264 on cpu 0:  unix_release_sock+0x75c/0x910 net/unix/af_unix.c:631  unix_release+0x59/0x80 net/unix/af_unix.c:1042  __sock_release+0x7d/0x170 net/socket.c:653  sock_close+0x19/0x30 net/socket.c:1397  __fput+0x179/0x5e0 fs/file_table.c:321  ____fput+0x15/0x20 fs/file_table.c:349  task_work_run+0x116/0x1a0 kernel/task_work.c:179  resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]  exit_to_user_mode_loop kernel/entry/common.c:171 [inline]  exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204  __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]  syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297  do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86  entry_SYSCALL_64_after_hwframe+0x72/0xdc  read to 0xffff88800d0f8aec of 1 bytes by task 222 on cpu 1:  unix_poll+0xa3/0x2a0 net/unix/af_unix.c:3170  sock_poll+0xcf/0x2b0 net/socket.c:1385  vfs_poll include/linux/poll.h:88 [inline]  ep_item_poll.isra.0+0x78/0xc0 fs/eventpoll.c:855  ep_send_events fs/eventpoll.c:1694 [inline]  ep_poll fs/eventpoll.c:1823 [inline]  do_epoll_wait+0x6c4/0xea0 fs/eventpoll.c:2258  __do_sys_epoll_wait fs/eventpoll.c:2270 [inline]  __se_sys_epoll_wait fs/eventpoll.c:2265 [inline]  __x64_sys_epoll_wait+0xcc/0x190 fs/eventpoll.c:2265  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x72/0xdc  value changed: 0x00 -> 0x03  Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 222 Comm: dbus-broker Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014