Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio/type1: fix cap_migration information leak<br /> <br /> Fix an information leak where an uninitialized hole in struct<br /> vfio_iommu_type1_info_cap_migration on the stack is exposed to userspace.<br /> <br /> The definition of struct vfio_iommu_type1_info_cap_migration contains a hole as<br /> shown in this pahole(1) output:<br /> <br /> struct vfio_iommu_type1_info_cap_migration {<br /> struct vfio_info_cap_header header; /* 0 8 */<br /> __u32 flags; /* 8 4 */<br /> <br /> /* XXX 4 bytes hole, try to pack */<br /> <br /> __u64 pgsize_bitmap; /* 16 8 */<br /> __u64 max_dirty_bitmap_size; /* 24 8 */<br /> <br /> /* size: 32, cachelines: 1, members: 4 */<br /> /* sum members: 28, holes: 1, sum holes: 4 */<br /> /* last cacheline: 32 bytes */<br /> };<br /> <br /> The cap_mig variable is filled in without initializing the hole:<br /> <br /> static int vfio_iommu_migration_build_caps(struct vfio_iommu *iommu,<br /> struct vfio_info_cap *caps)<br /> {<br /> struct vfio_iommu_type1_info_cap_migration cap_mig;<br /> <br /> cap_mig.header.id = VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION;<br /> cap_mig.header.version = 1;<br /> <br /> cap_mig.flags = 0;<br /> /* support minimum pgsize */<br /> cap_mig.pgsize_bitmap = (size_t)1 id, cap-&gt;version);<br /> if (IS_ERR(header))<br /> return PTR_ERR(header);<br /> <br /> memcpy(header + 1, cap + 1, size - sizeof(*header));<br /> <br /> return 0;<br /> }<br /> <br /> This issue was found by code inspection.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/msm: fix NULL-deref on irq uninstall<br /> <br /> In case of early initialisation errors and on platforms that do not use<br /> the DPU controller, the deinitilisation code can be called with the kms<br /> pointer set to NULL.<br /> <br /> Patchwork: https://patchwork.freedesktop.org/patch/525104/

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing/user_events: Ensure write index cannot be negative<br /> <br /> The write index indicates which event the data is for and accesses a<br /> per-file array. The index is passed by user processes during write()<br /> calls as the first 4 bytes. Ensure that it cannot be negative by<br /> returning -EINVAL to prevent out of bounds accesses.<br /> <br /> Update ftrace self-test to ensure this occurs properly.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse<br /> <br /> A syzbot stress test using a corrupted disk image reported that<br /> mark_buffer_dirty() called from __nilfs_mark_inode_dirty() or<br /> nilfs_palloc_commit_alloc_entry() may output a kernel warning, and can<br /> panic if the kernel is booted with panic_on_warn.<br /> <br /> This is because nilfs2 keeps buffer pointers in local structures for some<br /> metadata and reuses them, but such buffers may be forcibly discarded by<br /> nilfs_clear_dirty_page() in some critical situations.<br /> <br /> This issue is reported to appear after commit 28a65b49eb53 ("nilfs2: do<br /> not write dirty data after degenerating to read-only"), but the issue has<br /> potentially existed before.<br /> <br /> Fix this issue by checking the uptodate flag when attempting to reuse an<br /> internally held buffer, and reloading the metadata instead of reusing the<br /> buffer if the flag was lost.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: rt2x00: Fix memory leak when handling surveys<br /> <br /> When removing a rt2x00 device, its associated channel surveys<br /> are not freed, causing a memory leak observable with kmemleak:<br /> <br /> unreferenced object 0xffff9620f0881a00 (size 512):<br /> comm "systemd-udevd", pid 2290, jiffies 4294906974 (age 33.768s)<br /> hex dump (first 32 bytes):<br /> 70 44 12 00 00 00 00 00 92 8a 00 00 00 00 00 00 pD..............<br /> 00 00 00 00 00 00 00 00 ab 87 01 00 00 00 00 00 ................<br /> backtrace:<br /> [] __kmalloc+0x4b/0x130<br /> [] rt2800_probe_hw+0xc2b/0x1380 [rt2800lib]<br /> [] rt2800usb_probe_hw+0xe/0x60 [rt2800usb]<br /> [] rt2x00lib_probe_dev+0x21a/0x7d0 [rt2x00lib]<br /> [] rt2x00usb_probe+0x1be/0x980 [rt2x00usb]<br /> [] usb_probe_interface+0xe2/0x310 [usbcore]<br /> [] really_probe+0x1a5/0x410<br /> [] __driver_probe_device+0x78/0x180<br /> [] driver_probe_device+0x1e/0x90<br /> [] __driver_attach+0xd2/0x1c0<br /> [] bus_for_each_dev+0x77/0xd0<br /> [] bus_add_driver+0x112/0x210<br /> [] driver_register+0x5c/0x120<br /> [] usb_register_driver+0x88/0x150 [usbcore]<br /> [] do_one_initcall+0x44/0x220<br /> [] do_init_module+0x4c/0x220<br /> <br /> Fix this by freeing the channel surveys on device removal.<br /> <br /> Tested with a RT3070 based USB wireless adapter.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> erofs: stop parsing non-compact HEAD index if clusterofs is invalid<br /> <br /> Syzbot generated a crafted image [1] with a non-compact HEAD index of<br /> clusterofs 33024 while valid numbers should be 0 ~ lclustersize-1,<br /> which causes the following unexpected behavior as below:<br /> <br /> BUG: unable to handle page fault for address: fffff52101a3fff9<br /> #PF: supervisor read access in kernel mode<br /> #PF: error_code(0x0000) - not-present page<br /> PGD 23ffed067 P4D 23ffed067 PUD 0<br /> Oops: 0000 [#1] PREEMPT SMP KASAN<br /> CPU: 1 PID: 4398 Comm: kworker/u5:1 Not tainted 6.3.0-rc6-syzkaller-g09a9639e56c0 #0<br /> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023<br /> Workqueue: erofs_worker z_erofs_decompressqueue_work<br /> RIP: 0010:z_erofs_decompress_queue+0xb7e/0x2b40<br /> ...<br /> Call Trace:<br /> <br /> z_erofs_decompressqueue_work+0x99/0xe0<br /> process_one_work+0x8f6/0x1170<br /> worker_thread+0xa63/0x1210<br /> kthread+0x270/0x300<br /> ret_from_fork+0x1f/0x30<br /> <br /> Note that normal images or images using compact indexes are not<br /> impacted. Let&amp;#39;s fix this now.<br /> <br /> [1] https://lore.kernel.org/r/000000000000ec75b005ee97fbaa@google.com

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfp: clean mc addresses in application firmware when closing port<br /> <br /> When moving devices from one namespace to another, mc addresses are<br /> cleaned in software while not removed from application firmware. Thus<br /> the mc addresses are remained and will cause resource leak.<br /> <br /> Now use `__dev_mc_unsync` to clean mc addresses when closing port.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> autofs: fix memory leak of waitqueues in autofs_catatonic_mode<br /> <br /> Syzkaller reports a memory leak:<br /> <br /> BUG: memory leak<br /> unreferenced object 0xffff88810b279e00 (size 96):<br /> comm "syz-executor399", pid 3631, jiffies 4294964921 (age 23.870s)<br /> hex dump (first 32 bytes):<br /> 00 00 00 00 00 00 00 00 08 9e 27 0b 81 88 ff ff ..........&amp;#39;.....<br /> 08 9e 27 0b 81 88 ff ff 00 00 00 00 00 00 00 00 ..&amp;#39;.............<br /> backtrace:<br /> [] kmalloc_trace+0x20/0x90 mm/slab_common.c:1046<br /> [] kmalloc include/linux/slab.h:576 [inline]<br /> [] autofs_wait+0x3fa/0x9a0 fs/autofs/waitq.c:378<br /> [] autofs_do_expire_multi+0xa7/0x3e0 fs/autofs/expire.c:593<br /> [] autofs_expire_multi+0x53/0x80 fs/autofs/expire.c:619<br /> [] autofs_root_ioctl_unlocked+0x322/0x3b0 fs/autofs/root.c:897<br /> [] autofs_root_ioctl+0x25/0x30 fs/autofs/root.c:910<br /> [] vfs_ioctl fs/ioctl.c:51 [inline]<br /> [] __do_sys_ioctl fs/ioctl.c:870 [inline]<br /> [] __se_sys_ioctl fs/ioctl.c:856 [inline]<br /> [] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:856<br /> [] do_syscall_x64 arch/x86/entry/common.c:50 [inline]<br /> [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80<br /> [] entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> autofs_wait_queue structs should be freed if their wait_ctr becomes zero.<br /> Otherwise they will be lost.<br /> <br /> In this case an AUTOFS_IOC_EXPIRE_MULTI ioctl is done, then a new<br /> waitqueue struct is allocated in autofs_wait(), its initial wait_ctr<br /> equals 2. After that wait_event_killable() is interrupted (it returns<br /> -ERESTARTSYS), so that &amp;#39;wq-&gt;name.name == NULL&amp;#39; condition may be not<br /> satisfied. Actually, this condition can be satisfied when<br /> autofs_wait_release() or autofs_catatonic_mode() is called and, what is<br /> also important, wait_ctr is decremented in those places. Upon the exit of<br /> autofs_wait(), wait_ctr is decremented to 1. Then the unmounting process<br /> begins: kill_sb calls autofs_catatonic_mode(), which should have freed the<br /> waitqueues, but it only decrements its usage counter to zero which is not<br /> a correct behaviour.<br /> <br /> edit:imk<br /> This description is of course not correct. The umount performed as a result<br /> of an expire is a umount of a mount that has been automounted, it&amp;#39;s not the<br /> autofs mount itself. They happen independently, usually after everything<br /> mounted within the autofs file system has been expired away. If everything<br /> hasn&amp;#39;t been expired away the automount daemon can still exit leaving mounts<br /> in place. But expires done in both cases will result in a notification that<br /> calls autofs_wait_release() with a result status. The problem case is the<br /> summary execution of of the automount daemon. In this case any waiting<br /> processes won&amp;#39;t be woken up until either they are terminated or the mount<br /> is umounted.<br /> end edit: imk<br /> <br /> So in catatonic mode we should free waitqueues which counter becomes zero.<br /> <br /> edit: imk<br /> Initially I was concerned that the calling of autofs_wait_release() and<br /> autofs_catatonic_mode() was not mutually exclusive but that can&amp;#39;t be the<br /> case (obviously) because the queue entry (or entries) is removed from the<br /> list when either of these two functions are called. Consequently the wait<br /> entry will be freed by only one of these functions or by the woken process<br /> in autofs_wait() depending on the order of the calls.<br /> end edit: imk

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: fix incorrect splitting in btrfs_drop_extent_map_range<br /> <br /> In production we were seeing a variety of WARN_ON()&amp;#39;s in the extent_map<br /> code, specifically in btrfs_drop_extent_map_range() when we have to call<br /> add_extent_mapping() for our second split.<br /> <br /> Consider the following extent map layout<br /> <br /> PINNED<br /> [0 16K) [32K, 48K)<br /> <br /> and then we call btrfs_drop_extent_map_range for [0, 36K), with<br /> skip_pinned == true. The initial loop will have<br /> <br /> start = 0<br /> end = 36K<br /> len = 36K<br /> <br /> we will find the [0, 16k) extent, but since we are pinned we will skip<br /> it, which has this code<br /> <br /> start = em_end;<br /> if (end != (u64)-1)<br /> len = start + len - em_end;<br /> <br /> em_end here is 16K, so now the values are<br /> <br /> start = 16K<br /> len = 16K + 36K - 16K = 36K<br /> <br /> len should instead be 20K. This is a problem when we find the next<br /> extent at [32K, 48K), we need to split this extent to leave [36K, 48k),<br /> however the code for the split looks like this<br /> <br /> split-&gt;start = start + len;<br /> split-&gt;len = em_end - (start + len);<br /> <br /> In this case we have<br /> <br /> em_end = 48K<br /> split-&gt;start = 16K + 36K // this should be 16K + 20K<br /> split-&gt;len = 48K - (16K + 36K) // this overflows as 16K + 36K is 52K<br /> <br /> and now we have an invalid extent_map in the tree that potentially<br /> overlaps other entries in the extent map. Even in the non-overlapping<br /> case we will have split-&gt;start set improperly, which will cause problems<br /> with any block related calculations.<br /> <br /> We don&amp;#39;t actually need len in this loop, we can simply use end as our<br /> end point, and only adjust start up when we find a pinned extent we need<br /> to skip.<br /> <br /> Adjust the logic to do this, which keeps us from inserting an invalid<br /> extent map.<br /> <br /> We only skip_pinned in the relocation case, so this is relatively rare,<br /> except in the case where you are running relocation a lot, which can<br /> happen with auto relocation on.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/msm/dpu: Add check for cstate<br /> <br /> As kzalloc may fail and return NULL pointer,<br /> it should be better to check cstate<br /> in order to avoid the NULL pointer dereference<br /> in __drm_atomic_helper_crtc_reset.<br /> <br /> Patchwork: https://patchwork.freedesktop.org/patch/514163/

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> md/raid10: fix memleak for &amp;#39;conf-&gt;bio_split&amp;#39;<br /> <br /> In the error path of raid10_run(), &amp;#39;conf&amp;#39; need be freed, however,<br /> &amp;#39;conf-&gt;bio_split&amp;#39; is missed and memory will be leaked.<br /> <br /> Since there are 3 places to free &amp;#39;conf&amp;#39;, factor out a helper to fix the<br /> problem.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> f2fs: fix to drop all dirty pages during umount() if cp_error is set<br /> <br /> xfstest generic/361 reports a bug as below:<br /> <br /> f2fs_bug_on(sbi, sbi-&gt;fsync_node_num);<br /> <br /> kernel BUG at fs/f2fs/super.c:1627!<br /> RIP: 0010:f2fs_put_super+0x3a8/0x3b0<br /> Call Trace:<br /> generic_shutdown_super+0x8c/0x1b0<br /> kill_block_super+0x2b/0x60<br /> kill_f2fs_super+0x87/0x110<br /> deactivate_locked_super+0x39/0x80<br /> deactivate_super+0x46/0x50<br /> cleanup_mnt+0x109/0x170<br /> __cleanup_mnt+0x16/0x20<br /> task_work_run+0x65/0xa0<br /> exit_to_user_mode_prepare+0x175/0x190<br /> syscall_exit_to_user_mode+0x25/0x50<br /> do_syscall_64+0x4c/0x90<br /> entry_SYSCALL_64_after_hwframe+0x72/0xdc<br /> <br /> During umount(), if cp_error is set, f2fs_wait_on_all_pages() should<br /> not stop waiting all F2FS_WB_CP_DATA pages to be writebacked, otherwise,<br /> fsync_node_num can be non-zero after f2fs_wait_on_all_pages() causing<br /> this bug.<br /> <br /> In this case, to avoid deadloop in f2fs_wait_on_all_pages(), it needs<br /> to drop all dirty pages rather than redirtying them.