Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> fou: Don&amp;#39;t allow 0 for FOU_ATTR_IPPROTO.<br /> <br /> fou_udp_recv() has the same problem mentioned in the previous<br /> patch.<br /> <br /> If FOU_ATTR_IPPROTO is set to 0, skb is not freed by<br /> fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu().<br /> <br /> Let&amp;#39;s forbid 0 for FOU_ATTR_IPPROTO.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list<br /> <br /> When the parameter pmac_id_valid argument of be_cmd_get_mac_from_list() is<br /> set to false, the driver may request the PMAC_ID from the firmware of the<br /> network card, and this function will store that PMAC_ID at the provided<br /> address pmac_id. This is the contract of this function.<br /> <br /> However, there is a location within the driver where both<br /> pmac_id_valid == false and pmac_id == NULL are being passed. This could<br /> result in dereferencing a NULL pointer.<br /> <br /> To resolve this issue, it is necessary to pass the address of a stub<br /> variable to the function.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> irqchip/gic-v3-its: Avoid truncating memory addresses<br /> <br /> On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem<br /> allocations to be backed by addresses physical memory above the 32-bit<br /> address limit, as found while experimenting with larger VMSPLIT<br /> configurations.<br /> <br /> This caused the qemu virt model to crash in the GICv3 driver, which<br /> allocates the &amp;#39;itt&amp;#39; object using GFP_KERNEL. Since all memory below<br /> the 4GB physical address limit is in ZONE_DMA in this configuration,<br /> kmalloc() defaults to higher addresses for ZONE_NORMAL, and the<br /> ITS driver stores the physical address in a 32-bit &amp;#39;unsigned long&amp;#39;<br /> variable.<br /> <br /> Change the itt_addr variable to the correct phys_addr_t type instead,<br /> along with all other variables in this driver that hold a physical<br /> address.<br /> <br /> The gicv5 driver correctly uses u64 variables, while all other irqchip<br /> drivers don&amp;#39;t call virt_to_phys or similar interfaces. It&amp;#39;s expected that<br /> other device drivers have similar issues, but fixing this one is<br /> sufficient for booting a virtio based guest.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vsock/virtio: cap TX credit to local buffer size<br /> <br /> The virtio transports derives its TX credit directly from peer_buf_alloc,<br /> which is set from the remote endpoint&amp;#39;s SO_VM_SOCKETS_BUFFER_SIZE value.<br /> <br /> On the host side this means that the amount of data we are willing to<br /> queue for a connection is scaled by a guest-chosen buffer size, rather<br /> than the host&amp;#39;s own vsock configuration. A malicious guest can advertise<br /> a large buffer and read slowly, causing the host to allocate a<br /> correspondingly large amount of sk_buff memory.<br /> The same thing would happen in the guest with a malicious host, since<br /> virtio transports share the same code base.<br /> <br /> Introduce a small helper, virtio_transport_tx_buf_size(), that<br /> returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume<br /> peer_buf_alloc.<br /> <br /> This ensures the effective TX window is bounded by both the peer&amp;#39;s<br /> advertised buffer and our own buf_alloc (already clamped to<br /> buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer<br /> cannot force the other to queue more data than allowed by its own<br /> vsock settings.<br /> <br /> On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with<br /> 32 guest vsock connections advertising 2 GiB each and reading slowly<br /> drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only<br /> recovered after killing the QEMU process. That said, if QEMU memory is<br /> limited with cgroups, the maximum memory used will be limited.<br /> <br /> With this patch applied:<br /> <br /> Before:<br /> MemFree: ~61.6 GiB<br /> Slab: ~142 MiB<br /> SUnreclaim: ~117 MiB<br /> <br /> After 32 high-credit connections:<br /> MemFree: ~61.5 GiB<br /> Slab: ~178 MiB<br /> SUnreclaim: ~152 MiB<br /> <br /> Only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest<br /> remains responsive.<br /> <br /> Compatibility with non-virtio transports:<br /> <br /> - VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per<br /> socket based on the local vsk-&gt;buffer_* values; the remote side<br /> cannot enlarge those queues beyond what the local endpoint<br /> configured.<br /> <br /> - Hyper-V&amp;#39;s vsock transport uses fixed-size VMBus ring buffers and<br /> an MTU bound; there is no peer-controlled credit field comparable<br /> to peer_buf_alloc, and the remote endpoint cannot drive in-flight<br /> kernel memory above those ring sizes.<br /> <br /> - The loopback path reuses virtio_transport_common.c, so it<br /> naturally follows the same semantics as the virtio transport.<br /> <br /> This change is limited to virtio_transport_common.c and thus affects<br /> virtio-vsock, vhost-vsock, and loopback, bringing them in line with the<br /> "remote window intersected with local policy" behaviour that VMCI and<br /> Hyper-V already effectively have.<br /> <br /> [Stefano: small adjustments after changing the previous patch]<br /> [Stefano: tweak the commit message]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()<br /> <br /> Memory allocated for struct vscsiblk_info in scsiback_probe() is not<br /> freed in scsiback_remove() leading to potential memory leaks on remove,<br /> as well as in the scsiback_probe() error paths. Fix that by freeing it<br /> in scsiback_remove().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()<br /> <br /> When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees<br /> mixer-&gt;id_elems but the controls already added to the card still<br /> reference the freed memory. Later when snd_card_register() runs,<br /> the OSS mixer layer calls their callbacks and hits a use-after-free read.<br /> <br /> Call trace:<br /> get_ctl_value+0x63f/0x820 sound/usb/mixer.c:411<br /> get_min_max_with_quirks.isra.0+0x240/0x1f40 sound/usb/mixer.c:1241<br /> mixer_ctl_feature_info+0x26b/0x490 sound/usb/mixer.c:1381<br /> snd_mixer_oss_build_test+0x174/0x3a0 sound/core/oss/mixer_oss.c:887<br /> ...<br /> snd_card_register+0x4ed/0x6d0 sound/core/init.c:923<br /> usb_audio_probe+0x5ef/0x2a90 sound/usb/card.c:1025<br /> <br /> Fix by calling snd_ctl_remove() for all mixer controls before freeing<br /> id_elems. We save the next pointer first because snd_ctl_remove()<br /> frees the current element.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> slimbus: core: fix device reference leak on report present<br /> <br /> Slimbus devices can be allocated dynamically upon reception of<br /> report-present messages.<br /> <br /> Make sure to drop the reference taken when looking up already registered<br /> devices.<br /> <br /> Note that this requires taking an extra reference in case the device has<br /> not yet been registered and has to be allocated.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> intel_th: fix device leak on output open()<br /> <br /> Make sure to drop the reference taken when looking up the th device<br /> during output device open() on errors and on close().<br /> <br /> Note that a recent commit fixed the leak in a couple of open() error<br /> paths but not all of them, and the reference is still leaking on<br /> successful open().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge<br /> <br /> Patch series "mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted<br /> merge", v2.<br /> <br /> Commit 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA<br /> merges") introduced the ability to merge previously unavailable VMA merge<br /> scenarios.<br /> <br /> However, it is handling merges incorrectly when it comes to mremap() of a<br /> faulted VMA adjacent to an unfaulted VMA. The issues arise in three<br /> cases:<br /> <br /> 1. Previous VMA unfaulted:<br /> <br /> copied -----|<br /> v<br /> |-----------|.............|<br /> | unfaulted |(faulted VMA)|<br /> |-----------|.............|<br /> prev<br /> <br /> 2. Next VMA unfaulted:<br /> <br /> copied -----|<br /> v<br /> |.............|-----------|<br /> |(faulted VMA)| unfaulted |<br /> |.............|-----------|<br /> next<br /> <br /> 3. Both adjacent VMAs unfaulted:<br /> <br /> copied -----|<br /> v<br /> |-----------|.............|-----------|<br /> | unfaulted |(faulted VMA)| unfaulted |<br /> |-----------|.............|-----------|<br /> prev next<br /> <br /> This series fixes each of these cases, and introduces self tests to assert<br /> that the issues are corrected.<br /> <br /> I also test a further case which was already handled, to assert that my<br /> changes continues to correctly handle it:<br /> <br /> 4. prev unfaulted, next faulted:<br /> <br /> copied -----|<br /> v<br /> |-----------|.............|-----------|<br /> | unfaulted |(faulted VMA)| faulted |<br /> |-----------|.............|-----------|<br /> prev next<br /> <br /> This bug was discovered via a syzbot report, linked to in the first patch<br /> in the series, I confirmed that this series fixes the bug.<br /> <br /> I also discovered that we are failing to check that the faulted VMA was<br /> not forked when merging a copied VMA in cases 1-3 above, an issue this<br /> series also addresses.<br /> <br /> I also added self tests to assert that this is resolved (and confirmed<br /> that the tests failed prior to this).<br /> <br /> I also cleaned up vma_expand() as part of this work, renamed<br /> vma_had_uncowed_parents() to vma_is_fork_child() as the previous name was<br /> unduly confusing, and simplified the comments around this function.<br /> <br /> <br /> This patch (of 4):<br /> <br /> Commit 879bca0a2c4f ("mm/vma: fix incorrectly disallowed anonymous VMA<br /> merges") introduced the ability to merge previously unavailable VMA merge<br /> scenarios.<br /> <br /> The key piece of logic introduced was the ability to merge a faulted VMA<br /> immediately next to an unfaulted VMA, which relies upon dup_anon_vma() to<br /> correctly handle anon_vma state.<br /> <br /> In the case of the merge of an existing VMA (that is changing properties<br /> of a VMA and then merging if those properties are shared by adjacent<br /> VMAs), dup_anon_vma() is invoked correctly.<br /> <br /> However in the case of the merge of a new VMA, a corner case peculiar to<br /> mremap() was missed.<br /> <br /> The issue is that vma_expand() only performs dup_anon_vma() if the target<br /> (the VMA that will ultimately become the merged VMA): is not the next VMA,<br /> i.e. the one that appears after the range in which the new VMA is to be<br /> established.<br /> <br /> A key insight here is that in all other cases other than mremap(), a new<br /> VMA merge either expands an existing VMA, meaning that the target VMA will<br /> be that VMA, or would have anon_vma be NULL.<br /> <br /> Specifically:<br /> <br /> * __mmap_region() - no anon_vma in place, initial mapping.<br /> * do_brk_flags() - expanding an existing VMA.<br /> * vma_merge_extend() - expanding an existing VMA.<br /> * relocate_vma_down() - no anon_vma in place, initial mapping.<br /> <br /> In addition, we are in the unique situation of needing to duplicate<br /> anon_vma state from a VMA that is neither the previous or next VMA being<br /> merged with.<br /> <br /> dup_anon_vma() deals exclusively with the target=unfaulted, src=faulted<br /> case. This leaves four possibilities, in each case where the copied VMA<br /> is faulted:<br /> <br /> 1. Previous VMA unfaulted:<br /> <br /> copied -----|<br /> <br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify()<br /> <br /> On error handling paths, lineinfo_changed_notify() doesn&amp;#39;t free the<br /> allocated resources which results leaks. Fix it.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: phy: intel-xway: fix OF node refcount leakage<br /> <br /> Automated review spotted am OF node reference count leakage when<br /> checking if the &amp;#39;leds&amp;#39; child node exists.<br /> <br /> Call of_put_node() to correctly maintain the refcount.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: rsi: Fix memory corruption due to not set vif driver data size<br /> <br /> The struct ieee80211_vif contains trailing space for vif driver data,<br /> when struct ieee80211_vif is allocated, the total memory size that is<br /> allocated is sizeof(struct ieee80211_vif) + size of vif driver data.<br /> The size of vif driver data is set by each WiFi driver as needed.<br /> <br /> The RSI911x driver does not set vif driver data size, no trailing space<br /> for vif driver data is therefore allocated past struct ieee80211_vif .<br /> The RSI911x driver does however use the vif driver data to store its<br /> vif driver data structure "struct vif_priv". An access to vif-&gt;drv_priv<br /> leads to access out of struct ieee80211_vif bounds and corruption of<br /> some memory.<br /> <br /> In case of the failure observed locally, rsi_mac80211_add_interface()<br /> would write struct vif_priv *vif_info = (struct vif_priv *)vif-&gt;drv_priv;<br /> vif_info-&gt;vap_id = vap_idx. This write corrupts struct fq_tin member<br /> struct list_head new_flows . The flow = list_first_entry(head, struct<br /> fq_flow, flowchain); in fq_tin_reset() then reports non-NULL bogus<br /> address, which when accessed causes a crash.<br /> <br /> The trigger is very simple, boot the machine with init=/bin/sh , mount<br /> devtmpfs, sysfs, procfs, and then do "ip link set wlan0 up", "sleep 1",<br /> "ip link set wlan0 down" and the crash occurs.<br /> <br /> Fix this by setting the correct size of vif driver data, which is the<br /> size of "struct vif_priv", so that memory is allocated and the driver<br /> can store its driver data in it, instead of corrupting memory around<br /> it.