xamxte/cve-to-cwe huggingface dataset:
CVE-2023-53812: In the Linux kernel, the following vulnerability has been resolved:  media: mediatek: vcodec: fix decoder disable pm crash  Can't call pm_runtime_disable when the architecture support sub device for 'dev->pm.dev' is NUll, or will get below crash log.  [   10.771551] pc : _raw_spin_lock_irq+0x4c/0xa0 [   10.771556] lr : __pm_runtime_disable+0x30/0x130 [   10.771558] sp : ffffffc01e4cb800 [   10.771559] x29: ffffffc01e4cb800 x28: ffffffdf082108a8 [   10.771563] x27: ffffffc01e4cbd70 x26: ffffff8605df55f0 [   10.771567] x25: 0000000000000002 x24: 0000000000000002 [   10.771570] x23: ffffff85c0dc9c00 x22: 0000000000000001 [   10.771573] x21: 0000000000000001 x20: 0000000000000000 [   10.771577] x19: 00000000000000f4 x18: ffffffdf2e9fbe18 [   10.771580] x17: 0000000000000000 x16: ffffffdf2df13c74 [   10.771583] x15: 00000000000002ea x14: 0000000000000058 [   10.771587] x13: ffffffdf2de1b62c x12: ffffffdf2e9e30e4 [   10.771590] x11: 0000000000000000 x10: 0000000000000001 [   10.771593] x9 : 0000000000000000 x8 : 00000000000000f4 [   10.771596] x7 : 6bff6264632c6264 x6 : 0000000000008000 [   10.771600] x5 : 0080000000000000 x4 : 0000000000000001 [   10.771603] x3 : 0000000000000008 x2 : 0000000000000001 [   10.771608] x1 : 0000000000000000 x0 : 00000000000000f4 [   10.771613] Call trace: [   10.771617]  _raw_spin_lock_irq+0x4c/0xa0 [   10.771620]  __pm_runtime_disable+0x30/0x130 [   10.771657]  mtk_vcodec_probe+0x69c/0x728 [mtk_vcodec_dec 800cc929d6631f79f9b273254c8db94d0d3500dc] [   10.771662]  platform_drv_probe+0x9c/0xbc [   10.771665]  really_probe+0x13c/0x3a0 [   10.771668]  driver_probe_device+0x84/0xc0 [   10.771671]  device_driver_attach+0x54/0x78
CVE-2023-53815: In the Linux kernel, the following vulnerability has been resolved:  posix-timers: Prevent RT livelock in itimer_delete()  itimer_delete() has a retry loop when the timer is concurrently expired. On non-RT kernels this just spin-waits until the timer callback has completed, except for posix CPU timers which have HAVE_POSIX_CPU_TIMERS_TASK_WORK enabled.  In that case and on RT kernels the existing task could live lock when preempting the task which does the timer delivery.  Replace spin_unlock() with an invocation of timer_wait_running() to handle it the same way as the other retry loops in the posix timer code.
CVE-2023-53816: In the Linux kernel, the following vulnerability has been resolved:  drm/amdkfd: fix potential kgd_mem UAFs  kgd_mem pointers returned by kfd_process_device_translate_handle are only guaranteed to be valid while p->mutex is held. As soon as the mutex is unlocked, another thread can free the BO.
CVE-2023-53817: In the Linux kernel, the following vulnerability has been resolved:  crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()  During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a correctly sized, but zeroed Diffie Hellamn value. mpi_cmp_ui() was detecting this if the second parameter was 0, but 1 is passed from dh_is_pubkey_valid(). This causes the null pointer u->d to be dereferenced towards the end of mpi_cmp_ui()
CVE-2023-53818: In the Linux kernel, the following vulnerability has been resolved:  ARM: zynq: Fix refcount leak in zynq_early_slcr_init  of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on error path. Add missing of_node_put() to avoid refcount leak.
CVE-2023-53819: In the Linux kernel, the following vulnerability has been resolved:  amdgpu: validate offset_in_bo of drm_amdgpu_gem_va  This is motivated by OOB access in amdgpu_vm_update_range when offset_in_bo+map_size overflows.  v2: keep the validations in amdgpu_vm_bo_map v3: add the validations to amdgpu_vm_bo_map/amdgpu_vm_bo_replace_map     rather than to amdgpu_gem_va_ioctl
CVE-2022-50658: In the Linux kernel, the following vulnerability has been resolved:  cpufreq: qcom: fix memory leak in error path  If for some reason the speedbin length is incorrect, then there is a memory leak in the error path because we never free the speedbin buffer. This commit fixes the error path to always free the speedbin buffer.
CVE-2022-50659: In the Linux kernel, the following vulnerability has been resolved:  hwrng: geode - Fix PCI device refcount leak  for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL.  If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. We add a new struct 'amd_geode_priv' to record pointer of the pci_dev and membase, and then add missing pci_dev_put() for the normal and error path.
CVE-2022-50660: In the Linux kernel, the following vulnerability has been resolved:  wifi: ipw2200: fix memory leak in ipw_wdev_init()  In the error path of ipw_wdev_init(), exception value is returned, and the memory applied for in the function is not released. Also the memory is not released in ipw_pci_probe(). As a result, memory leakage occurs. So memory release needs to be added to the error path of ipw_wdev_init().
CVE-2022-50662: In the Linux kernel, the following vulnerability has been resolved:  RDMA/hns: fix memory leak in hns_roce_alloc_mr()  When hns_roce_mr_enable() failed in hns_roce_alloc_mr(), mr_key is not released. Compiled test only.
CVE-2022-50663: In the Linux kernel, the following vulnerability has been resolved:  net: stmmac: fix possible memory leak in stmmac_dvr_probe()  The bitmap_free() should be called to free priv->af_xdp_zc_qps when create_singlethread_workqueue() fails, otherwise there will be a memory leak, so we add the err path error_wq_init to fix it.
CVE-2022-50664: In the Linux kernel, the following vulnerability has been resolved:  media: dvb-frontends: fix leak of memory fw
CVE-2022-50666: In the Linux kernel, the following vulnerability has been resolved:  RDMA/siw: Fix QP destroy to wait for all references dropped.  Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after-free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed.
CVE-2022-50667: In the Linux kernel, the following vulnerability has been resolved:  drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()  If the copy of the description string from userspace fails, then the page for the instance descriptor doesn't get freed before returning -EFAULT, which leads to a memleak.
CVE-2022-50668: In the Linux kernel, the following vulnerability has been resolved:  ext4: fix deadlock due to mbcache entry corruption  When manipulating xattr blocks, we can deadlock infinitely looping inside ext4_xattr_block_set() where we constantly keep finding xattr block for reuse in mbcache but we are unable to reuse it because its reference count is too big. This happens because cache entry for the xattr block is marked as reusable (e_reusable set) although its reference count is too big. When this inconsistency happens, this inconsistent state is kept indefinitely and so ext4_xattr_block_set() keeps retrying indefinitely.  The inconsistent state is caused by non-atomic update of e_reusable bit. e_reusable is part of a bitfield and e_reusable update can race with update of e_referenced bit in the same bitfield resulting in loss of one of the updates. Fix the problem by using atomic bitops instead.  This bug has been around for many years, but it became *much* easier to hit after commit 65f8b80053a1 ("ext4: fix race when reusing xattr blocks").
CVE-2022-50669: In the Linux kernel, the following vulnerability has been resolved:  misc: ocxl: fix possible name leak in ocxl_file_register_afu()  If device_register() returns error in ocxl_file_register_afu(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(), and info is freed in info_release().
CVE-2022-50670: In the Linux kernel, the following vulnerability has been resolved:  mmc: omap_hsmmc: fix return value check of mmc_add_host()  mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to    delete device, but it's not added yet, it will lead a kernel    crash because of null-ptr-deref in device_del().  Fix this by checking the return value and goto error path wihch will call mmc_free_host().
CVE-2022-50671: In the Linux kernel, the following vulnerability has been resolved:  RDMA/rxe: Fix "kernel NULL pointer dereference" error  When rxe_queue_init in the function rxe_qp_init_req fails, both qp->req.task.func and qp->req.task.arg are not initialized.  Because of creation of qp fails, the function rxe_create_qp will call rxe_qp_do_cleanup to handle allocated resource.  Before calling __rxe_do_task, both qp->req.task.func and qp->req.task.arg should be checked.
CVE-2022-50673: In the Linux kernel, the following vulnerability has been resolved:  ext4: fix use-after-free in ext4_orphan_cleanup  I caught a issue as follows: ==================================================================  BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0  Read of size 8 at addr ffff88814b13f378 by task mount/710   CPU: 1 PID: 710 Comm: mount Not tainted 6.1.0-rc3-next #370  Call Trace:   <TASK>   dump_stack_lvl+0x73/0x9f   print_report+0x25d/0x759   kasan_report+0xc0/0x120   __asan_load8+0x99/0x140   __list_add_valid+0x28/0x1a0   ext4_orphan_cleanup+0x564/0x9d0 [ext4]   __ext4_fill_super+0x48e2/0x5300 [ext4]   ext4_fill_super+0x19f/0x3a0 [ext4]   get_tree_bdev+0x27b/0x450   ext4_get_tree+0x19/0x30 [ext4]   vfs_get_tree+0x49/0x150   path_mount+0xaae/0x1350   do_mount+0xe2/0x110   __x64_sys_mount+0xf0/0x190   do_syscall_64+0x35/0x80   entry_SYSCALL_64_after_hwframe+0x63/0xcd   </TASK>  [...] ==================================================================  Above issue may happen as follows: ------------------------------------- ext4_fill_super   ext4_orphan_cleanup    --- loop1: assume last_orphan is 12 ---     list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan)     ext4_truncate --> return 0       ext4_inode_attach_jinode --> return -ENOMEM     iput(inode) --> free inode<12>    --- loop2: last_orphan is still 12 ---     list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan);     // use inode<12> and trigger UAF  To solve this issue, we need to propagate the return value of ext4_inode_attach_jinode() appropriately.
CVE-2022-50674: In the Linux kernel, the following vulnerability has been resolved:  riscv: vdso: fix NULL deference in vdso_join_timens() when vfork  Testing tools/testing/selftests/timens/vfork_exec.c got below kernel log:  [    6.838454] Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000000020 [    6.842255] Oops [#1] [    6.842871] Modules linked in: [    6.844249] CPU: 1 PID: 64 Comm: vfork_exec Not tainted 6.0.0-rc3-rt15+ #8 [    6.845861] Hardware name: riscv-virtio,qemu (DT) [    6.848009] epc : vdso_join_timens+0xd2/0x110 [    6.850097]  ra : vdso_join_timens+0xd2/0x110 [    6.851164] epc : ffffffff8000635c ra : ffffffff8000635c sp : ff6000000181fbf0 [    6.852562]  gp : ffffffff80cff648 tp : ff60000000fdb700 t0 : 3030303030303030 [    6.853852]  t1 : 0000000000000030 t2 : 3030303030303030 s0 : ff6000000181fc40 [    6.854984]  s1 : ff60000001e6c000 a0 : 0000000000000010 a1 : ffffffff8005654c [    6.856221]  a2 : 00000000ffffefff a3 : 0000000000000000 a4 : 0000000000000000 [    6.858114]  a5 : 0000000000000000 a6 : 0000000000000008 a7 : 0000000000000038 [    6.859484]  s2 : ff60000001e6c068 s3 : ff6000000108abb0 s4 : 0000000000000000 [    6.860751]  s5 : 0000000000001000 s6 : ffffffff8089dc40 s7 : ffffffff8089dc38 [    6.862029]  s8 : ffffffff8089dc30 s9 : ff60000000fdbe38 s10: 000000000000005e [    6.863304]  s11: ffffffff80cc3510 t3 : ffffffff80d1112f t4 : ffffffff80d1112f [    6.864565]  t5 : ffffffff80d11130 t6 : ff6000000181fa00 [    6.865561] status: 0000000000000120 badaddr: 0000000000000020 cause: 000000000000000d [    6.868046] [<ffffffff8008dc94>] timens_commit+0x38/0x11a [    6.869089] [<ffffffff8008dde8>] timens_on_fork+0x72/0xb4 [    6.870055] [<ffffffff80190096>] begin_new_exec+0x3c6/0x9f0 [    6.871231] [<ffffffff801d826c>] load_elf_binary+0x628/0x1214 [    6.872304] [<ffffffff8018ee7a>] bprm_execve+0x1f2/0x4e4 [    6.873243] [<ffffffff8018f90c>] do_execveat_common+0x16e/0x1ee [    6.874258] [<ffffffff8018f9c8>] sys_execve+0x3c/0x48 [    6.875162] [<ffffffff80003556>] ret_from_syscall+0x0/0x2 [    6.877484] ---[ end trace 0000000000000000 ]---  This is because the mm->context.vdso_info is NULL in vfork case. From another side, mm->context.vdso_info either points to vdso info for RV64 or vdso info for compat, there's no need to bloat riscv's mm_context_t, we can handle the difference when setup the additional page for vdso.
CVE-2022-50677: In the Linux kernel, the following vulnerability has been resolved:  ipmi: fix use after free in _ipmi_destroy_user()  The intf_free() function frees the "intf" pointer so we cannot dereference it again on the next line.
CVE-2022-50678: In the Linux kernel, the following vulnerability has been resolved:  wifi: brcmfmac: fix invalid address access when enabling SCAN log level  The variable i is changed when setting random MAC address and causes invalid address access when printing the value of pi->reqs[i]->reqid.  We replace reqs index with ri to fix the issue.  [  136.726473] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000 [  136.737365] Mem abort info: [  136.740172]   ESR = 0x96000004 [  136.743359]   Exception class = DABT (current EL), IL = 32 bits [  136.749294]   SET = 0, FnV = 0 [  136.752481]   EA = 0, S1PTW = 0 [  136.755635] Data abort info: [  136.758514]   ISV = 0, ISS = 0x00000004 [  136.762487]   CM = 0, WnR = 0 [  136.765522] user pgtable: 4k pages, 48-bit VAs, pgdp = 000000005c4e2577 [  136.772265] [0000000000000000] pgd=0000000000000000 [  136.777160] Internal error: Oops: 96000004 [#1] PREEMPT SMP [  136.782732] Modules linked in: brcmfmac(O) brcmutil(O) cfg80211(O) compat(O) [  136.789788] Process wificond (pid: 3175, stack limit = 0x00000000053048fb) [  136.796664] CPU: 3 PID: 3175 Comm: wificond Tainted: G           O      4.19.42-00001-g531a5f5 #1 [  136.805532] Hardware name: Freescale i.MX8MQ EVK (DT) [  136.810584] pstate: 60400005 (nZCv daif +PAN -UAO) [  136.815429] pc : brcmf_pno_config_sched_scans+0x6cc/0xa80 [brcmfmac] [  136.821811] lr : brcmf_pno_config_sched_scans+0x67c/0xa80 [brcmfmac] [  136.828162] sp : ffff00000e9a3880 [  136.831475] x29: ffff00000e9a3890 x28: ffff800020543400 [  136.836786] x27: ffff8000b1008880 x26: ffff0000012bf6a0 [  136.842098] x25: ffff80002054345c x24: ffff800088d22400 [  136.847409] x23: ffff0000012bf638 x22: ffff0000012bf6d8 [  136.852721] x21: ffff8000aced8fc0 x20: ffff8000ac164400 [  136.858032] x19: ffff00000e9a3946 x18: 0000000000000000 [  136.863343] x17: 0000000000000000 x16: 0000000000000000 [  136.868655] x15: ffff0000093f3b37 x14: 0000000000000050 [  136.873966] x13: 0000000000003135 x12: 0000000000000000 [  136.879277] x11: 0000000000000000 x10: ffff000009a61888 [  136.884589] x9 : 000000000000000f x8 : 0000000000000008 [  136.889900] x7 : 303a32303d726464 x6 : ffff00000a1f957d [  136.895211] x5 : 0000000000000000 x4 : ffff00000e9a3942 [  136.900523] x3 : 0000000000000000 x2 : ffff0000012cead8 [  136.905834] x1 : ffff0000012bf6d8 x0 : 0000000000000000 [  136.911146] Call trace: [  136.913623]  brcmf_pno_config_sched_scans+0x6cc/0xa80 [brcmfmac] [  136.919658]  brcmf_pno_start_sched_scan+0xa4/0x118 [brcmfmac] [  136.925430]  brcmf_cfg80211_sched_scan_start+0x80/0xe0 [brcmfmac] [  136.931636]  nl80211_start_sched_scan+0x140/0x308 [cfg80211] [  136.937298]  genl_rcv_msg+0x358/0x3f4 [  136.940960]  netlink_rcv_skb+0xb4/0x118 [  136.944795]  genl_rcv+0x34/0x48 [  136.947935]  netlink_unicast+0x264/0x300 [  136.951856]  netlink_sendmsg+0x2e4/0x33c [  136.955781]  __sys_sendto+0x120/0x19c
CVE-2022-50679: In the Linux kernel, the following vulnerability has been resolved:  i40e: Fix DMA mappings leak  During reallocation of RX buffers, new DMA mappings are created for those buffers.  steps for reproduction: while : do for ((i=0; i<=8160; i=i+32)) do ethtool -G enp130s0f0 rx $i tx $i sleep 0.5 ethtool -g enp130s0f0 done done  This resulted in crash: i40e 0000:01:00.1: Unable to allocate memory for the Rx descriptor ring, size=65536 Driver BUG WARNING: CPU: 0 PID: 4300 at net/core/xdp.c:141 xdp_rxq_info_unreg+0x43/0x50 Call Trace: i40e_free_rx_resources+0x70/0x80 [i40e] i40e_set_ringparam+0x27c/0x800 [i40e] ethnl_set_rings+0x1b2/0x290 genl_family_rcv_msg_doit.isra.15+0x10f/0x150 genl_family_rcv_msg+0xb3/0x160 ? rings_fill_reply+0x1a0/0x1a0 genl_rcv_msg+0x47/0x90 ? genl_family_rcv_msg+0x160/0x160 netlink_rcv_skb+0x4c/0x120 genl_rcv+0x24/0x40 netlink_unicast+0x196/0x230 netlink_sendmsg+0x204/0x3d0 sock_sendmsg+0x4c/0x50 __sys_sendto+0xee/0x160 ? handle_mm_fault+0xbe/0x1e0 ? syscall_trace_enter+0x1d3/0x2c0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x5b/0x1a0 entry_SYSCALL_64_after_hwframe+0x65/0xca RIP: 0033:0x7f5eac8b035b Missing register, driver bug WARNING: CPU: 0 PID: 4300 at net/core/xdp.c:119 xdp_rxq_info_unreg_mem_model+0x69/0x140 Call Trace: xdp_rxq_info_unreg+0x1e/0x50 i40e_free_rx_resources+0x70/0x80 [i40e] i40e_set_ringparam+0x27c/0x800 [i40e] ethnl_set_rings+0x1b2/0x290 genl_family_rcv_msg_doit.isra.15+0x10f/0x150 genl_family_rcv_msg+0xb3/0x160 ? rings_fill_reply+0x1a0/0x1a0 genl_rcv_msg+0x47/0x90 ? genl_family_rcv_msg+0x160/0x160 netlink_rcv_skb+0x4c/0x120 genl_rcv+0x24/0x40 netlink_unicast+0x196/0x230 netlink_sendmsg+0x204/0x3d0 sock_sendmsg+0x4c/0x50 __sys_sendto+0xee/0x160 ? handle_mm_fault+0xbe/0x1e0 ? syscall_trace_enter+0x1d3/0x2c0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x5b/0x1a0 entry_SYSCALL_64_after_hwframe+0x65/0xca RIP: 0033:0x7f5eac8b035b  This was caused because of new buffers with different RX ring count should substitute older ones, but those buffers were freed in i40e_configure_rx_ring and reallocated again with i40e_alloc_rx_bi, thus kfree on rx_bi caused leak of already mapped DMA.  Fix this by reallocating ZC with rx_bi_zc struct when BPF program loads. Additionally reallocate back to rx_bi when BPF program unloads.  If BPF program is loaded/unloaded and XSK pools are created, reallocate RX queues accordingly in XSP_SETUP_XSK_POOL handler.
CVE-2023-53820: In the Linux kernel, the following vulnerability has been resolved:  loop: loop_set_status_from_info() check before assignment  In loop_set_status_from_info(), lo->lo_offset and lo->lo_sizelimit should be checked before reassignment, because if an overflow error occurs, the original correct value will be changed to the wrong value, and it will not be changed back.  More, the original patch did not solve the problem, the value was set and ioctl returned an error, but the subsequent io used the value in the loop driver, which still caused an alarm:  loop_handle_cmd  do_req_filebacked   loff_t pos = ((loff_t) blk_rq_pos(rq) << 9) + lo->lo_offset;   lo_rw_aio    cmd->iocb.ki_pos = pos
CVE-2023-53821: In the Linux kernel, the following vulnerability has been resolved:  ip6_vti: fix slab-use-after-free in decode_session6  When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ipv6_vti device sends IPv6 packets.  The stack information is as follows: BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 vti6_tnl_xmit+0x3e6/0x1ee0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> Allocated by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 netlink_sendmsg+0x9b1/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x40 ____kasan_slab_free+0x160/0x1c0 slab_free_freelist_hook+0x11b/0x220 kmem_cache_free+0xf0/0x490 skb_free_head+0x17f/0x1b0 skb_release_data+0x59c/0x850 consume_skb+0xd2/0x170 netlink_unicast+0x54f/0x7f0 netlink_sendmsg+0x926/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff88802e08ed00 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 194 bytes inside of freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)  As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
CVE-2023-53822: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath11k: Ignore frags from uninitialized peer in dp.  When max virtual ap interfaces are configured in all the bands with ACS and hostapd restart is done every 60s, a crash is observed at random times. In this certain scenario, a fragmented packet is received for self peer, for which rx_tid and rx_frags are not initialized in datapath. While handling this fragment, crash is observed as the rx_frag list is uninitialised and when we walk in ath11k_dp_rx_h_sort_frags, skb null leads to exception.  To address this, before processing received fragments we check dp_setup_done flag is set to ensure that peer has completed its dp peer setup for fragment queue, else ignore processing the fragments.  Call trace:   ath11k_dp_process_rx_err+0x550/0x1084 [ath11k]   ath11k_dp_service_srng+0x70/0x370 [ath11k]   0xffffffc009693a04   __napi_poll+0x30/0xa4   net_rx_action+0x118/0x270   __do_softirq+0x10c/0x244   irq_exit+0x64/0xb4   __handle_domain_irq+0x88/0xac   gic_handle_irq+0x74/0xbc   el1_irq+0xf0/0x1c0   arch_cpu_idle+0x10/0x18   do_idle+0x104/0x248   cpu_startup_entry+0x20/0x64   rest_init+0xd0/0xdc   arch_call_rest_init+0xc/0x14   start_kernel+0x480/0x4b8   Code: f9400281 f94066a2 91405021 b94a0023 (f9406401)  Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1