Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mt76: mt7615: fix memleak when mt7615_unregister_device()<br /> <br /> mt7615_tx_token_put() should get call before mt76_free_pending_txwi().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: marvell: prestera: fix port event handling on init<br /> <br /> For some reason there might be a crash during ports creation if port<br /> events are handling at the same time because fw may send initial<br /> port event with down state.<br /> <br /> The crash points to cancel_delayed_work() which is called when port went<br /> is down. Currently I did not find out the real cause of the issue, so<br /> fixed it by cancel port stats work only if previous port&amp;#39;s state was up<br /> &amp; runnig.<br /> <br /> The following is the crash which can be triggered:<br /> <br /> [ 28.311104] Unable to handle kernel paging request at virtual address<br /> 000071775f776600<br /> [ 28.319097] Mem abort info:<br /> [ 28.321914] ESR = 0x96000004<br /> [ 28.324996] EC = 0x25: DABT (current EL), IL = 32 bits<br /> [ 28.330350] SET = 0, FnV = 0<br /> [ 28.333430] EA = 0, S1PTW = 0<br /> [ 28.336597] Data abort info:<br /> [ 28.339499] ISV = 0, ISS = 0x00000004<br /> [ 28.343362] CM = 0, WnR = 0<br /> [ 28.346354] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000100bf7000<br /> [ 28.352842] [000071775f776600] pgd=0000000000000000,<br /> p4d=0000000000000000<br /> [ 28.359695] Internal error: Oops: 96000004 [#1] PREEMPT SMP<br /> [ 28.365310] Modules linked in: prestera_pci(+) prestera<br /> uio_pdrv_genirq<br /> [ 28.372005] CPU: 0 PID: 1291 Comm: kworker/0:1H Not tainted<br /> 5.11.0-rc4 #1<br /> [ 28.378846] Hardware name: DNI AmazonGo1 A7040 board (DT)<br /> [ 28.384283] Workqueue: prestera_fw_wq prestera_fw_evt_work_fn<br /> [prestera_pci]<br /> [ 28.391413] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--)<br /> [ 28.397468] pc : get_work_pool+0x48/0x60<br /> [ 28.401442] lr : try_to_grab_pending+0x6c/0x1b0<br /> [ 28.406018] sp : ffff80001391bc60<br /> [ 28.409358] x29: ffff80001391bc60 x28: 0000000000000000<br /> [ 28.414725] x27: ffff000104fc8b40 x26: ffff80001127de88<br /> [ 28.420089] x25: 0000000000000000 x24: ffff000106119760<br /> [ 28.425452] x23: ffff00010775dd60 x22: ffff00010567e000<br /> [ 28.430814] x21: 0000000000000000 x20: ffff80001391bcb0<br /> [ 28.436175] x19: ffff00010775deb8 x18: 00000000000000c0<br /> [ 28.441537] x17: 0000000000000000 x16: 000000008d9b0e88<br /> [ 28.446898] x15: 0000000000000001 x14: 00000000000002ba<br /> [ 28.452261] x13: 80a3002c00000002 x12: 00000000000005f4<br /> [ 28.457622] x11: 0000000000000030 x10: 000000000000000c<br /> [ 28.462985] x9 : 000000000000000c x8 : 0000000000000030<br /> [ 28.468346] x7 : ffff800014400000 x6 : ffff000106119758<br /> [ 28.473708] x5 : 0000000000000003 x4 : ffff00010775dc60<br /> [ 28.479068] x3 : 0000000000000000 x2 : 0000000000000060<br /> [ 28.484429] x1 : 000071775f776600 x0 : ffff00010775deb8<br /> [ 28.489791] Call trace:<br /> [ 28.492259] get_work_pool+0x48/0x60<br /> [ 28.495874] cancel_delayed_work+0x38/0xb0<br /> [ 28.500011] prestera_port_handle_event+0x90/0xa0 [prestera]<br /> [ 28.505743] prestera_evt_recv+0x98/0xe0 [prestera]<br /> [ 28.510683] prestera_fw_evt_work_fn+0x180/0x228 [prestera_pci]<br /> [ 28.516660] process_one_work+0x1e8/0x360<br /> [ 28.520710] worker_thread+0x44/0x480<br /> [ 28.524412] kthread+0x154/0x160<br /> [ 28.527670] ret_from_fork+0x10/0x38<br /> [ 28.531290] Code: a8c17bfd d50323bf d65f03c0 9278dc21 (f9400020)<br /> [ 28.537429] ---[ end trace 5eced933df3a080b ]---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vsock/virtio: free queued packets when closing socket<br /> <br /> As reported by syzbot [1], there is a memory leak while closing the<br /> socket. We partially solved this issue with commit ac03046ece2b<br /> ("vsock/virtio: free packets during the socket release"), but we<br /> forgot to drain the RX queue when the socket is definitely closed by<br /> the scheduled work.<br /> <br /> To avoid future issues, let&amp;#39;s use the new virtio_transport_remove_sock()<br /> to drain the RX queue before removing the socket from the af_vsock lists<br /> calling vsock_remove_sock().<br /> <br /> [1] https://syzkaller.appspot.com/bug?extid=24452624fc4c571eedd9

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommu/mediatek: Always enable the clk on resume<br /> <br /> In mtk_iommu_runtime_resume always enable the clk, even<br /> if m4u_dom is null. Otherwise the &amp;#39;suspend&amp;#39; cb might<br /> disable the clk which is already disabled causing the warning:<br /> <br /> [ 1.586104] infra_m4u already disabled<br /> [ 1.586133] WARNING: CPU: 0 PID: 121 at drivers/clk/clk.c:952 clk_core_disable+0xb0/0xb8<br /> [ 1.594391] mtk-iommu 10205000.iommu: bound 18001000.larb (ops mtk_smi_larb_component_ops)<br /> [ 1.598108] Modules linked in:<br /> [ 1.598114] CPU: 0 PID: 121 Comm: kworker/0:2 Not tainted 5.12.0-rc5 #69<br /> [ 1.609246] mtk-iommu 10205000.iommu: bound 14027000.larb (ops mtk_smi_larb_component_ops)<br /> [ 1.617487] Hardware name: Google Elm (DT)<br /> [ 1.617491] Workqueue: pm pm_runtime_work<br /> [ 1.620545] mtk-iommu 10205000.iommu: bound 19001000.larb (ops mtk_smi_larb_component_ops)<br /> <br /> [ 1.627229] pstate: 60000085 (nZCv daIf -PAN -UAO -TCO BTYPE=--)<br /> [ 1.659297] pc : clk_core_disable+0xb0/0xb8<br /> [ 1.663475] lr : clk_core_disable+0xb0/0xb8<br /> [ 1.667652] sp : ffff800011b9bbe0<br /> [ 1.670959] x29: ffff800011b9bbe0 x28: 0000000000000000<br /> [ 1.676267] x27: ffff800011448000 x26: ffff8000100cfd98<br /> [ 1.681574] x25: ffff800011b9bd48 x24: 0000000000000000<br /> [ 1.686882] x23: 0000000000000000 x22: ffff8000106fad90<br /> [ 1.692189] x21: 000000000000000a x20: ffff0000c0048500<br /> [ 1.697496] x19: ffff0000c0048500 x18: ffffffffffffffff<br /> [ 1.702804] x17: 0000000000000000 x16: 0000000000000000<br /> [ 1.708112] x15: ffff800011460300 x14: fffffffffffe0000<br /> [ 1.713420] x13: ffff8000114602d8 x12: 0720072007200720<br /> [ 1.718727] x11: 0720072007200720 x10: 0720072007200720<br /> [ 1.724035] x9 : ffff800011b9bbe0 x8 : ffff800011b9bbe0<br /> [ 1.729342] x7 : 0000000000000009 x6 : ffff8000114b8328<br /> [ 1.734649] x5 : 0000000000000000 x4 : 0000000000000000<br /> [ 1.739956] x3 : 00000000ffffffff x2 : ffff800011460298<br /> [ 1.745263] x1 : 1af1d7de276f4500 x0 : 0000000000000000<br /> [ 1.750572] Call trace:<br /> [ 1.753010] clk_core_disable+0xb0/0xb8<br /> [ 1.756840] clk_core_disable_lock+0x24/0x40<br /> [ 1.761105] clk_disable+0x20/0x30<br /> [ 1.764501] mtk_iommu_runtime_suspend+0x88/0xa8<br /> [ 1.769114] pm_generic_runtime_suspend+0x2c/0x48<br /> [ 1.773815] __rpm_callback+0xe0/0x178<br /> [ 1.777559] rpm_callback+0x24/0x88<br /> [ 1.781041] rpm_suspend+0xdc/0x470<br /> [ 1.784523] rpm_idle+0x12c/0x170<br /> [ 1.787831] pm_runtime_work+0xa8/0xc0<br /> [ 1.791573] process_one_work+0x1e8/0x360<br /> [ 1.795580] worker_thread+0x44/0x478<br /> [ 1.799237] kthread+0x150/0x158<br /> [ 1.802460] ret_from_fork+0x10/0x30<br /> [ 1.806034] ---[ end trace 82402920ef64573b ]---<br /> [ 1.810728] ------------[ cut here ]------------<br /> <br /> In addition, we now don&amp;#39;t need to enable the clock from the<br /> function mtk_iommu_hw_init since it is already enabled by the resume.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/rtrs-clt: destroy sysfs after removing session from active list<br /> <br /> A session can be removed dynamically by sysfs interface "remove_path" that<br /> eventually calls rtrs_clt_remove_path_from_sysfs function. The current<br /> rtrs_clt_remove_path_from_sysfs first removes the sysfs interfaces and<br /> frees sess-&gt;stats object. Second it removes the session from the active<br /> list.<br /> <br /> Therefore some functions could access non-connected session and access the<br /> freed sess-&gt;stats object even-if they check the session status before<br /> accessing the session.<br /> <br /> For instance rtrs_clt_request and get_next_path_min_inflight check the<br /> session status and try to send IO to the session. The session status<br /> could be changed when they are trying to send IO but they could not catch<br /> the change and update the statistics information in sess-&gt;stats object,<br /> and generate use-after-free problem.<br /> (see: "RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its<br /> stats")<br /> <br /> This patch changes the rtrs_clt_remove_path_from_sysfs to remove the<br /> session from the active session list and then destroy the sysfs<br /> interfaces.<br /> <br /> Each function still should check the session status because closing or<br /> error recovery paths can change the status.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mt76: mt7921: fix kernel crash when the firmware fails to download<br /> <br /> Fix kernel crash when the firmware is missing or fails to download.<br /> <br /> [ 9.444758] kernel BUG at drivers/pci/msi.c:375!<br /> [ 9.449363] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP<br /> [ 9.501033] pstate: a0400009 (NzCv daif +PAN -UAO)<br /> [ 9.505814] pc : free_msi_irqs+0x180/0x184<br /> [ 9.509897] lr : free_msi_irqs+0x40/0x184<br /> [ 9.513893] sp : ffffffc015193870<br /> [ 9.517194] x29: ffffffc015193870 x28: 00000000f0e94fa2<br /> [ 9.522492] x27: 0000000000000acd x26: 000000000000009a<br /> [ 9.527790] x25: ffffffc0152cee58 x24: ffffffdbb383e0d8<br /> [ 9.533087] x23: ffffffdbb38628d0 x22: 0000000000040200<br /> [ 9.538384] x21: ffffff8cf7de7318 x20: ffffff8cd65a2480<br /> [ 9.543681] x19: ffffff8cf7de7000 x18: 0000000000000000<br /> [ 9.548979] x17: ffffff8cf9ca03b4 x16: ffffffdc13ad9a34<br /> [ 9.554277] x15: 0000000000000000 x14: 0000000000080800<br /> [ 9.559575] x13: ffffff8cd65a2980 x12: 0000000000000000<br /> [ 9.564873] x11: ffffff8cfa45d820 x10: ffffff8cfa45d6d0<br /> [ 9.570171] x9 : 0000000000000040 x8 : ffffff8ccef1b780<br /> [ 9.575469] x7 : aaaaaaaaaaaaaaaa x6 : 0000000000000000<br /> [ 9.580766] x5 : ffffffdc13824900 x4 : ffffff8ccefe0000<br /> [ 9.586063] x3 : 0000000000000000 x2 : 0000000000000000<br /> [ 9.591362] x1 : 0000000000000125 x0 : ffffff8ccefe0000<br /> [ 9.596660] Call trace:<br /> [ 9.599095] free_msi_irqs+0x180/0x184<br /> [ 9.602831] pci_disable_msi+0x100/0x130<br /> [ 9.606740] pci_free_irq_vectors+0x24/0x30<br /> [ 9.610915] mt7921_pci_probe+0xbc/0x250 [mt7921e]<br /> [ 9.615693] pci_device_probe+0xd4/0x14c<br /> [ 9.619604] really_probe+0x134/0x2ec<br /> [ 9.623252] driver_probe_device+0x64/0xfc<br /> [ 9.627335] device_driver_attach+0x4c/0x6c<br /> [ 9.631506] __driver_attach+0xac/0xc0<br /> [ 9.635243] bus_for_each_dev+0x8c/0xd4<br /> [ 9.639066] driver_attach+0x2c/0x38<br /> [ 9.642628] bus_add_driver+0xfc/0x1d0<br /> [ 9.646365] driver_register+0x64/0xf8<br /> [ 9.650101] __pci_register_driver+0x6c/0x7c<br /> [ 9.654360] init_module+0x28/0xfdc [mt7921e]<br /> [ 9.658704] do_one_initcall+0x13c/0x2d0<br /> [ 9.662615] do_init_module+0x58/0x1e8<br /> [ 9.666351] load_module+0xd80/0xeb4<br /> [ 9.669912] __arm64_sys_finit_module+0xa8/0xe0<br /> [ 9.674430] el0_svc_common+0xa4/0x16c<br /> [ 9.678168] el0_svc_compat_handler+0x2c/0x40<br /> [ 9.682511] el0_svc_compat+0x8/0x10<br /> [ 9.686076] Code: a94257f6 f9400bf7 a8c47bfd d65f03c0 (d4210000)<br /> [ 9.692155] ---[ end trace 7621f966afbf0a29 ]---<br /> [ 9.697385] Kernel panic - not syncing: Fatal exception<br /> [ 9.702599] SMP: stopping secondary CPUs<br /> [ 9.706549] Kernel Offset: 0x1c03600000 from 0xffffffc010000000<br /> [ 9.712456] PHYS_OFFSET: 0xfffffff440000000<br /> [ 9.716625] CPU features: 0x080026,2a80aa18<br /> [ 9.720795] Memory Limit: none

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mt76: mt7915: fix txrate reporting<br /> <br /> Properly check rate_info to fix unexpected reporting.<br /> <br /> [ 1215.161863] Call trace:<br /> [ 1215.164307] cfg80211_calculate_bitrate+0x124/0x200 [cfg80211]<br /> [ 1215.170139] ieee80211s_update_metric+0x80/0xc0 [mac80211]<br /> [ 1215.175624] ieee80211_tx_status_ext+0x508/0x838 [mac80211]<br /> [ 1215.181190] mt7915_mcu_get_rx_rate+0x28c/0x8d0 [mt7915e]<br /> [ 1215.186580] mt7915_mac_tx_free+0x324/0x7c0 [mt7915e]<br /> [ 1215.191623] mt7915_queue_rx_skb+0xa8/0xd0 [mt7915e]<br /> [ 1215.196582] mt76_dma_cleanup+0x7b0/0x11d0 [mt76]<br /> [ 1215.201276] __napi_poll+0x38/0xf8<br /> [ 1215.204668] napi_workfn+0x40/0x80<br /> [ 1215.208062] process_one_work+0x1fc/0x390<br /> [ 1215.212062] worker_thread+0x48/0x4d0<br /> [ 1215.215715] kthread+0x120/0x128<br /> [ 1215.218935] ret_from_fork+0x10/0x1c

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mt76: connac: fix kernel warning adding monitor interface<br /> <br /> Fix the following kernel warning adding a monitor interface in<br /> mt76_connac_mcu_uni_add_dev routine.<br /> <br /> [ 507.984882] ------------[ cut here ]------------<br /> [ 507.989515] WARNING: CPU: 1 PID: 3017 at mt76_connac_mcu_uni_add_dev+0x178/0x190 [mt76_connac_lib]<br /> [ 508.059379] CPU: 1 PID: 3017 Comm: ifconfig Not tainted 5.4.98 #0<br /> [ 508.065461] Hardware name: MT7622_MT7531 RFB (DT)<br /> [ 508.070156] pstate: 80000005 (Nzcv daif -PAN -UAO)<br /> [ 508.074939] pc : mt76_connac_mcu_uni_add_dev+0x178/0x190 [mt76_connac_lib]<br /> [ 508.081806] lr : mt7921_eeprom_init+0x1288/0x1cb8 [mt7921e]<br /> [ 508.087367] sp : ffffffc013a33930<br /> [ 508.090671] x29: ffffffc013a33930 x28: ffffff801e628ac0<br /> [ 508.095973] x27: ffffff801c7f1200 x26: ffffff801c7eb008<br /> [ 508.101275] x25: ffffff801c7eaef0 x24: ffffff801d025610<br /> [ 508.106577] x23: ffffff801d022990 x22: ffffff801d024de8<br /> [ 508.111879] x21: ffffff801d0226a0 x20: ffffff801c7eaee8<br /> [ 508.117181] x19: ffffff801d0226a0 x18: 000000005d00b000<br /> [ 508.122482] x17: 00000000ffffffff x16: 0000000000000000<br /> [ 508.127785] x15: 0000000000000080 x14: ffffff801d704000<br /> [ 508.133087] x13: 0000000000000040 x12: 0000000000000002<br /> [ 508.138389] x11: 000000000000000c x10: 0000000000000000<br /> [ 508.143691] x9 : 0000000000000020 x8 : 0000000000000001<br /> [ 508.148992] x7 : 0000000000000000 x6 : 0000000000000000<br /> [ 508.154294] x5 : ffffff801c7eaee8 x4 : 0000000000000006<br /> [ 508.159596] x3 : 0000000000000001 x2 : 0000000000000000<br /> [ 508.164898] x1 : ffffff801c7eac08 x0 : ffffff801d0226a0<br /> [ 508.170200] Call trace:<br /> [ 508.172640] mt76_connac_mcu_uni_add_dev+0x178/0x190 [mt76_connac_lib]<br /> [ 508.179159] mt7921_eeprom_init+0x1288/0x1cb8 [mt7921e]<br /> [ 508.184394] drv_add_interface+0x34/0x88 [mac80211]<br /> [ 508.189271] ieee80211_add_virtual_monitor+0xe0/0xb48 [mac80211]<br /> [ 508.195277] ieee80211_do_open+0x86c/0x918 [mac80211]<br /> [ 508.200328] ieee80211_do_open+0x900/0x918 [mac80211]<br /> [ 508.205372] __dev_open+0xcc/0x150<br /> [ 508.208763] __dev_change_flags+0x134/0x198<br /> [ 508.212937] dev_change_flags+0x20/0x60<br /> [ 508.216764] devinet_ioctl+0x3e8/0x748<br /> [ 508.220503] inet_ioctl+0x1e4/0x350<br /> [ 508.223983] sock_do_ioctl+0x48/0x2a0<br /> [ 508.227635] sock_ioctl+0x310/0x4f8<br /> [ 508.231116] do_vfs_ioctl+0xa4/0xac0<br /> [ 508.234681] ksys_ioctl+0x44/0x90<br /> [ 508.237985] __arm64_sys_ioctl+0x1c/0x48<br /> [ 508.241901] el0_svc_common.constprop.1+0x7c/0x100<br /> [ 508.246681] el0_svc_handler+0x18/0x20<br /> [ 508.250421] el0_svc+0x8/0x1c8<br /> [ 508.253465] ---[ end trace c7b90fee13d72c39 ]---<br /> [ 508.261278] ------------[ cut here ]------------

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mt76: mt7615: fix memory leak in mt7615_coredump_work<br /> <br /> Similar to the issue fixed in mt7921_coredump_work, fix a possible memory<br /> leak in mt7615_coredump_work routine.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mt76: mt7921: fix memory leak in mt7921_coredump_work<br /> <br /> Fix possible memory leak in mt7921_coredump_work.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mt76: mt7915: fix tx skb dma unmap<br /> <br /> The first pointer in the txp needs to be unmapped as well, otherwise it will<br /> leak DMA mapping entries

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mt76: mt7615: fix tx skb dma unmap<br /> <br /> The first pointer in the txp needs to be unmapped as well, otherwise it will<br /> leak DMA mapping entries