Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: dwc3: host: Stop setting the ACPI companion<br /> <br /> It is no longer needed. The sysdev pointer is now used when<br /> assigning the ACPI companions to the xHCI ports and USB<br /> devices.<br /> <br /> Assigning the ACPI companion here resulted in the<br /> fwnode-&gt;secondary pointer to be replaced also for the parent<br /> dwc3 device since the primary fwnode (the ACPI companion)<br /> was shared. That was unintentional and it created potential<br /> side effects like resource leaks.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()<br /> <br /> When the driver fails at alloc_hdlcdev(), and then we remove the driver<br /> module, we will get the following splat:<br /> <br /> [ 25.065966] general protection fault, probably for non-canonical address 0xdffffc0000000182: 0000 [#1] PREEMPT SMP KASAN PTI<br /> [ 25.066914] KASAN: null-ptr-deref in range [0x0000000000000c10-0x0000000000000c17]<br /> [ 25.069262] RIP: 0010:detach_hdlc_protocol+0x2a/0x3e0<br /> [ 25.077709] Call Trace:<br /> [ 25.077924] <br /> [ 25.078108] unregister_hdlc_device+0x16/0x30<br /> [ 25.078481] slgt_cleanup+0x157/0x9f0 [synclink_gt]<br /> <br /> Fix this by checking whether the &amp;#39;info-&gt;netdev&amp;#39; is a null pointer first.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> extcon: Modify extcon device to be created after driver data is set<br /> <br /> Currently, someone can invoke the sysfs such as state_show()<br /> intermittently before dev_set_drvdata() is done.<br /> And it can be a cause of kernel Oops because of edev is Null at that time.<br /> So modified the driver registration to after setting drviver data.<br /> <br /> - Oops&amp;#39;s backtrace.<br /> <br /> Backtrace:<br /> [] (state_show) from [] (dev_attr_show)<br /> [] (dev_attr_show) from [] (sysfs_kf_seq_show)<br /> [] (sysfs_kf_seq_show) from [] (kernfs_seq_show)<br /> [] (kernfs_seq_show) from [] (seq_read)<br /> [] (seq_read) from [] (kernfs_fop_read)<br /> [] (kernfs_fop_read) from [] (__vfs_read)<br /> [] (__vfs_read) from [] (vfs_read)<br /> [] (vfs_read) from [] (ksys_read)<br /> [] (ksys_read) from [] (sys_read)<br /> [] (sys_read) from [] (__sys_trace_return)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> char: xillybus: fix a refcount leak in cleanup_dev()<br /> <br /> usb_get_dev is called in xillyusb_probe. So it is better to call<br /> usb_put_dev before xdev is released.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()<br /> <br /> There is a deadlock in rtw_joinbss_event_prehandle(), which is shown<br /> below:<br /> <br /> (Thread 1) | (Thread 2)<br /> | _set_timer()<br /> rtw_joinbss_event_prehandle()| mod_timer()<br /> spin_lock_bh() //(1) | (wait a time)<br /> ... | _rtw_join_timeout_handler()<br /> del_timer_sync() | spin_lock_bh() //(2)<br /> (wait timer to stop) | ...<br /> <br /> We hold pmlmepriv-&gt;lock in position (1) of thread 1 and<br /> use del_timer_sync() to wait timer to stop, but timer handler<br /> also need pmlmepriv-&gt;lock in position (2) of thread 2.<br /> As a result, rtw_joinbss_event_prehandle() will block forever.<br /> <br /> This patch extracts del_timer_sync() from the protection of<br /> spin_lock_bh(), which could let timer handler to obtain<br /> the needed lock. What`s more, we change spin_lock_bh() to<br /> spin_lock_irq() in _rtw_join_timeout_handler() in order to<br /> prevent deadlock.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: rtl8712: fix a potential memory leak in r871xu_drv_init()<br /> <br /> In r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory<br /> allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not<br /> properly released as there is no action will be performed by<br /> r8712_usb_dvobj_deinit().<br /> To properly release it, we should call r8712_free_io_queue() in<br /> r8712_usb_dvobj_deinit().<br /> <br /> Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called<br /> by r871x_dev_unload() under condition `padapter-&gt;bup` and<br /> r8712_free_io_queue() is called by r8712_free_drv_sw().<br /> However, r8712_usb_dvobj_deinit() does not rely on `padapter-&gt;bup` and<br /> calling r8712_free_io_queue() in r8712_free_drv_sw() is negative for<br /> better understading the code.<br /> So I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove<br /> r8712_free_io_queue() from r8712_free_drv_sw().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()<br /> <br /> There is a deadlock in rtw_surveydone_event_callback(),<br /> which is shown below:<br /> <br /> (Thread 1) | (Thread 2)<br /> | _set_timer()<br /> rtw_surveydone_event_callback()| mod_timer()<br /> spin_lock_bh() //(1) | (wait a time)<br /> ... | rtw_scan_timeout_handler()<br /> del_timer_sync() | spin_lock_bh() //(2)<br /> (wait timer to stop) | ...<br /> <br /> We hold pmlmepriv-&gt;lock in position (1) of thread 1 and use<br /> del_timer_sync() to wait timer to stop, but timer handler<br /> also need pmlmepriv-&gt;lock in position (2) of thread 2.<br /> As a result, rtw_surveydone_event_callback() will block forever.<br /> <br /> This patch extracts del_timer_sync() from the protection of<br /> spin_lock_bh(), which could let timer handler to obtain<br /> the needed lock. What`s more, we change spin_lock_bh() in<br /> rtw_scan_timeout_handler() to spin_lock_irq(). Otherwise,<br /> spin_lock_bh() will also cause deadlock() in timer handler.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: oss: Fix PCM OSS buffer allocation overflow<br /> <br /> We&amp;#39;ve got syzbot reports hitting INT_MAX overflow at vmalloc()<br /> allocation that is called from snd_pcm_plug_alloc(). Although we<br /> apply the restrictions to input parameters, it&amp;#39;s based only on the<br /> hw_params of the underlying PCM device. Since the PCM OSS layer<br /> allocates a temporary buffer for the data conversion, the size may<br /> become unexpectedly large when more channels or higher rates is given;<br /> in the reported case, it went over INT_MAX, hence it hits WARN_ON().<br /> <br /> This patch is an attempt to avoid such an overflow and an allocation<br /> for too large buffers. First off, it adds the limit of 1MB as the<br /> upper bound for period bytes. This must be large enough for all use<br /> cases, and we really don&amp;#39;t want to handle a larger temporary buffer<br /> than this size. The size check is performed at two places, where the<br /> original period bytes is calculated and where the plugin buffer size<br /> is calculated.<br /> <br /> In addition, the driver uses array_size() and array3_size() for<br /> multiplications to catch overflows for the converted period size and<br /> buffer bytes.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: initialize registers in nft_do_chain()<br /> <br /> Initialize registers to avoid stack leak into userspace.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amd/display: Check if modulo is 0 before dividing.<br /> <br /> [How &amp; Why]<br /> If a value of 0 is read, then this will cause a divide-by-0 panic.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nbd: call genl_unregister_family() first in nbd_cleanup()<br /> <br /> Otherwise there may be race between module removal and the handling of<br /> netlink command, which can lead to the oops as shown below:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000098<br /> Oops: 0002 [#1] SMP PTI<br /> CPU: 1 PID: 31299 Comm: nbd-client Tainted: G E 5.14.0-rc4<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)<br /> RIP: 0010:down_write+0x1a/0x50<br /> Call Trace:<br /> start_creating+0x89/0x130<br /> debugfs_create_dir+0x1b/0x130<br /> nbd_start_device+0x13d/0x390 [nbd]<br /> nbd_genl_connect+0x42f/0x748 [nbd]<br /> genl_family_rcv_msg_doit.isra.0+0xec/0x150<br /> genl_rcv_msg+0xe5/0x1e0<br /> netlink_rcv_skb+0x55/0x100<br /> genl_rcv+0x29/0x40<br /> netlink_unicast+0x1a8/0x250<br /> netlink_sendmsg+0x21b/0x430<br /> ____sys_sendmsg+0x2a4/0x2d0<br /> ___sys_sendmsg+0x81/0xc0<br /> __sys_sendmsg+0x62/0xb0<br /> __x64_sys_sendmsg+0x1f/0x30<br /> do_syscall_64+0x3b/0xc0<br /> entry_SYSCALL_64_after_hwframe+0x44/0xae<br /> Modules linked in: nbd(E-)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ceph: fix possible deadlock when holding Fwb to get inline_data<br /> <br /> 1, mount with wsync.<br /> 2, create a file with O_RDWR, and the request was sent to mds.0:<br /> <br /> ceph_atomic_open()--&gt;<br /> ceph_mdsc_do_request(openc)<br /> finish_open(file, dentry, ceph_open)--&gt;<br /> ceph_open()--&gt;<br /> ceph_init_file()--&gt;<br /> ceph_init_file_info()--&gt;<br /> ceph_uninline_data()--&gt;<br /> {<br /> ...<br /> if (inline_version == 1 || /* initial version, no data */<br /> inline_version == CEPH_INLINE_NONE)<br /> goto out_unlock;<br /> ...<br /> }<br /> <br /> The inline_version will be 1, which is the initial version for the<br /> new create file. And here the ci-&gt;i_inline_version will keep with 1,<br /> it&amp;#39;s buggy.<br /> <br /> 3, buffer write to the file immediately:<br /> <br /> ceph_write_iter()--&gt;<br /> ceph_get_caps(file, need=Fw, want=Fb, ...);<br /> generic_perform_write()--&gt;<br /> a_ops-&gt;write_begin()--&gt;<br /> ceph_write_begin()--&gt;<br /> netfs_write_begin()--&gt;<br /> netfs_begin_read()--&gt;<br /> netfs_rreq_submit_slice()--&gt;<br /> netfs_read_from_server()--&gt;<br /> rreq-&gt;netfs_ops-&gt;issue_read()--&gt;<br /> ceph_netfs_issue_read()--&gt;<br /> {<br /> ...<br /> if (ci-&gt;i_inline_version != CEPH_INLINE_NONE &amp;&amp;<br /> ceph_netfs_issue_op_inline(subreq))<br /> return;<br /> ...<br /> }<br /> ceph_put_cap_refs(ci, Fwb);<br /> <br /> The ceph_netfs_issue_op_inline() will send a getattr(Fsr) request to<br /> mds.1.<br /> <br /> 4, then the mds.1 will request the rd lock for CInode::filelock from<br /> the auth mds.0, the mds.0 will do the CInode::filelock state transation<br /> from excl --&gt; sync, but it need to revoke the Fxwb caps back from the<br /> clients.<br /> <br /> While the kernel client has aleady held the Fwb caps and waiting for<br /> the getattr(Fsr).<br /> <br /> It&amp;#39;s deadlock!<br /> <br /> URL: https://tracker.ceph.com/issues/55377