Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: tun: Update napi-&gt;skb after XDP process<br /> <br /> The syzbot report a UAF issue:<br /> <br /> BUG: KASAN: slab-use-after-free in skb_reset_mac_header include/linux/skbuff.h:3150 [inline]<br /> BUG: KASAN: slab-use-after-free in napi_frags_skb net/core/gro.c:723 [inline]<br /> BUG: KASAN: slab-use-after-free in napi_gro_frags+0x6e/0x1030 net/core/gro.c:758<br /> Read of size 8 at addr ffff88802ef22c18 by task syz.0.17/6079<br /> CPU: 0 UID: 0 PID: 6079 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120<br /> print_address_description mm/kasan/report.c:378 [inline]<br /> print_report+0xca/0x240 mm/kasan/report.c:482<br /> kasan_report+0x118/0x150 mm/kasan/report.c:595<br /> skb_reset_mac_header include/linux/skbuff.h:3150 [inline]<br /> napi_frags_skb net/core/gro.c:723 [inline]<br /> napi_gro_frags+0x6e/0x1030 net/core/gro.c:758<br /> tun_get_user+0x28cb/0x3e20 drivers/net/tun.c:1920<br /> tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996<br /> new_sync_write fs/read_write.c:593 [inline]<br /> vfs_write+0x5c9/0xb30 fs/read_write.c:686<br /> ksys_write+0x145/0x250 fs/read_write.c:738<br /> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]<br /> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> <br /> Allocated by task 6079:<br /> kasan_save_stack mm/kasan/common.c:47 [inline]<br /> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68<br /> unpoison_slab_object mm/kasan/common.c:330 [inline]<br /> __kasan_mempool_unpoison_object+0xa0/0x170 mm/kasan/common.c:558<br /> kasan_mempool_unpoison_object include/linux/kasan.h:388 [inline]<br /> napi_skb_cache_get+0x37b/0x6d0 net/core/skbuff.c:295<br /> __alloc_skb+0x11e/0x2d0 net/core/skbuff.c:657<br /> napi_alloc_skb+0x84/0x7d0 net/core/skbuff.c:811<br /> napi_get_frags+0x69/0x140 net/core/gro.c:673<br /> tun_napi_alloc_frags drivers/net/tun.c:1404 [inline]<br /> tun_get_user+0x77c/0x3e20 drivers/net/tun.c:1784<br /> tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996<br /> new_sync_write fs/read_write.c:593 [inline]<br /> vfs_write+0x5c9/0xb30 fs/read_write.c:686<br /> ksys_write+0x145/0x250 fs/read_write.c:738<br /> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]<br /> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> Freed by task 6079:<br /> kasan_save_stack mm/kasan/common.c:47 [inline]<br /> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68<br /> kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576<br /> poison_slab_object mm/kasan/common.c:243 [inline]<br /> __kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275<br /> kasan_slab_free include/linux/kasan.h:233 [inline]<br /> slab_free_hook mm/slub.c:2422 [inline]<br /> slab_free mm/slub.c:4695 [inline]<br /> kmem_cache_free+0x18f/0x400 mm/slub.c:4797<br /> skb_pp_cow_data+0xdd8/0x13e0 net/core/skbuff.c:969<br /> netif_skb_check_for_xdp net/core/dev.c:5390 [inline]<br /> netif_receive_generic_xdp net/core/dev.c:5431 [inline]<br /> do_xdp_generic+0x699/0x11a0 net/core/dev.c:5499<br /> tun_get_user+0x2523/0x3e20 drivers/net/tun.c:1872<br /> tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996<br /> new_sync_write fs/read_write.c:593 [inline]<br /> vfs_write+0x5c9/0xb30 fs/read_write.c:686<br /> ksys_write+0x145/0x250 fs/read_write.c:738<br /> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]<br /> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> After commit e6d5dbdd20aa ("xdp: add multi-buff support for xdp running in<br /> generic mode"), the original skb may be freed in skb_pp_cow_data() when<br /> XDP program was attached, which was allocated in tun_napi_alloc_frags().<br /> However, the napi-&gt;skb still point to the original skb, update it after<br /> XDP process.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow<br /> <br /> Sending an PF_PACKET allows to bypass the CAN framework logic and to<br /> directly reach the xmit() function of a CAN driver. The only check<br /> which is performed by the PF_PACKET framework is to make sure that<br /> skb-&gt;len fits the interface&amp;#39;s MTU.<br /> <br /> Unfortunately, because the mcba_usb driver does not populate its<br /> net_device_ops-&gt;ndo_change_mtu(), it is possible for an attacker to<br /> configure an invalid MTU by doing, for example:<br /> <br /> $ ip link set can0 mtu 9999<br /> <br /> After doing so, the attacker could open a PF_PACKET socket using the<br /> ETH_P_CANXL protocol:<br /> <br /> socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))<br /> <br /> to inject a malicious CAN XL frames. For example:<br /> <br /> struct canxl_frame frame = {<br /> .flags = 0xff,<br /> .len = 2048,<br /> };<br /> <br /> The CAN drivers&amp;#39; xmit() function are calling can_dev_dropped_skb() to<br /> check that the skb is valid, unfortunately under above conditions, the<br /> malicious packet is able to go through can_dev_dropped_skb() checks:<br /> <br /> 1. the skb-&gt;protocol is set to ETH_P_CANXL which is valid (the<br /> function does not check the actual device capabilities).<br /> <br /> 2. the length is a valid CAN XL length.<br /> <br /> And so, mcba_usb_start_xmit() receives a CAN XL frame which it is not<br /> able to correctly handle and will thus misinterpret it as a CAN frame.<br /> <br /> This can result in a buffer overflow. The driver will consume cf-&gt;len<br /> as-is with no further checks on these lines:<br /> <br /> usb_msg.dlc = cf-&gt;len;<br /> <br /> memcpy(usb_msg.data, cf-&gt;data, usb_msg.dlc);<br /> <br /> Here, cf-&gt;len corresponds to the flags field of the CAN XL frame. In<br /> our previous example, we set canxl_frame-&gt;flags to 0xff. Because the<br /> maximum expected length is 8, a buffer overflow of 247 bytes occurs!<br /> <br /> Populate net_device_ops-&gt;ndo_change_mtu() to ensure that the<br /> interface&amp;#39;s MTU can not be set to anything bigger than CAN_MTU. By<br /> fixing the root cause, this prevents the buffer overflow.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow<br /> <br /> Sending an PF_PACKET allows to bypass the CAN framework logic and to<br /> directly reach the xmit() function of a CAN driver. The only check<br /> which is performed by the PF_PACKET framework is to make sure that<br /> skb-&gt;len fits the interface&amp;#39;s MTU.<br /> <br /> Unfortunately, because the sun4i_can driver does not populate its<br /> net_device_ops-&gt;ndo_change_mtu(), it is possible for an attacker to<br /> configure an invalid MTU by doing, for example:<br /> <br /> $ ip link set can0 mtu 9999<br /> <br /> After doing so, the attacker could open a PF_PACKET socket using the<br /> ETH_P_CANXL protocol:<br /> <br /> socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))<br /> <br /> to inject a malicious CAN XL frames. For example:<br /> <br /> struct canxl_frame frame = {<br /> .flags = 0xff,<br /> .len = 2048,<br /> };<br /> <br /> The CAN drivers&amp;#39; xmit() function are calling can_dev_dropped_skb() to<br /> check that the skb is valid, unfortunately under above conditions, the<br /> malicious packet is able to go through can_dev_dropped_skb() checks:<br /> <br /> 1. the skb-&gt;protocol is set to ETH_P_CANXL which is valid (the<br /> function does not check the actual device capabilities).<br /> <br /> 2. the length is a valid CAN XL length.<br /> <br /> And so, sun4ican_start_xmit() receives a CAN XL frame which it is not<br /> able to correctly handle and will thus misinterpret it as a CAN frame.<br /> <br /> This can result in a buffer overflow. The driver will consume cf-&gt;len<br /> as-is with no further checks on this line:<br /> <br /> dlc = cf-&gt;len;<br /> <br /> Here, cf-&gt;len corresponds to the flags field of the CAN XL frame. In<br /> our previous example, we set canxl_frame-&gt;flags to 0xff. Because the<br /> maximum expected length is 8, a buffer overflow of 247 bytes occurs a<br /> couple line below when doing:<br /> <br /> for (i = 0; i data[i], priv-&gt;base + (dreg + i * 4));<br /> <br /> Populate net_device_ops-&gt;ndo_change_mtu() to ensure that the<br /> interface&amp;#39;s MTU can not be set to anything bigger than CAN_MTU. By<br /> fixing the root cause, this prevents the buffer overflow.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: hi311x: populate ndo_change_mtu() to prevent buffer overflow<br /> <br /> Sending an PF_PACKET allows to bypass the CAN framework logic and to<br /> directly reach the xmit() function of a CAN driver. The only check<br /> which is performed by the PF_PACKET framework is to make sure that<br /> skb-&gt;len fits the interface&amp;#39;s MTU.<br /> <br /> Unfortunately, because the sun4i_can driver does not populate its<br /> net_device_ops-&gt;ndo_change_mtu(), it is possible for an attacker to<br /> configure an invalid MTU by doing, for example:<br /> <br /> $ ip link set can0 mtu 9999<br /> <br /> After doing so, the attacker could open a PF_PACKET socket using the<br /> ETH_P_CANXL protocol:<br /> <br /> socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))<br /> <br /> to inject a malicious CAN XL frames. For example:<br /> <br /> struct canxl_frame frame = {<br /> .flags = 0xff,<br /> .len = 2048,<br /> };<br /> <br /> The CAN drivers&amp;#39; xmit() function are calling can_dev_dropped_skb() to<br /> check that the skb is valid, unfortunately under above conditions, the<br /> malicious packet is able to go through can_dev_dropped_skb() checks:<br /> <br /> 1. the skb-&gt;protocol is set to ETH_P_CANXL which is valid (the<br /> function does not check the actual device capabilities).<br /> <br /> 2. the length is a valid CAN XL length.<br /> <br /> And so, hi3110_hard_start_xmit() receives a CAN XL frame which it is<br /> not able to correctly handle and will thus misinterpret it as a CAN<br /> frame. The driver will consume frame-&gt;len as-is with no further<br /> checks.<br /> <br /> This can result in a buffer overflow later on in hi3110_hw_tx() on<br /> this line:<br /> <br /> memcpy(buf + HI3110_FIFO_EXT_DATA_OFF,<br /> frame-&gt;data, frame-&gt;len);<br /> <br /> Here, frame-&gt;len corresponds to the flags field of the CAN XL frame.<br /> In our previous example, we set canxl_frame-&gt;flags to 0xff. Because<br /> the maximum expected length is 8, a buffer overflow of 247 bytes<br /> occurs!<br /> <br /> Populate net_device_ops-&gt;ndo_change_mtu() to ensure that the<br /> interface&amp;#39;s MTU can not be set to anything bigger than CAN_MTU. By<br /> fixing the root cause, this prevents the buffer overflow.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow<br /> <br /> Sending an PF_PACKET allows to bypass the CAN framework logic and to<br /> directly reach the xmit() function of a CAN driver. The only check<br /> which is performed by the PF_PACKET framework is to make sure that<br /> skb-&gt;len fits the interface&amp;#39;s MTU.<br /> <br /> Unfortunately, because the etas_es58x driver does not populate its<br /> net_device_ops-&gt;ndo_change_mtu(), it is possible for an attacker to<br /> configure an invalid MTU by doing, for example:<br /> <br /> $ ip link set can0 mtu 9999<br /> <br /> After doing so, the attacker could open a PF_PACKET socket using the<br /> ETH_P_CANXL protocol:<br /> <br /> socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL));<br /> <br /> to inject a malicious CAN XL frames. For example:<br /> <br /> struct canxl_frame frame = {<br /> .flags = 0xff,<br /> .len = 2048,<br /> };<br /> <br /> The CAN drivers&amp;#39; xmit() function are calling can_dev_dropped_skb() to<br /> check that the skb is valid, unfortunately under above conditions, the<br /> malicious packet is able to go through can_dev_dropped_skb() checks:<br /> <br /> 1. the skb-&gt;protocol is set to ETH_P_CANXL which is valid (the<br /> function does not check the actual device capabilities).<br /> <br /> 2. the length is a valid CAN XL length.<br /> <br /> And so, es58x_start_xmit() receives a CAN XL frame which it is not<br /> able to correctly handle and will thus misinterpret it as a CAN(FD)<br /> frame.<br /> <br /> This can result in a buffer overflow. For example, using the es581.4<br /> variant, the frame will be dispatched to es581_4_tx_can_msg(), go<br /> through the last check at the beginning of this function:<br /> <br /> if (can_is_canfd_skb(skb))<br /> return -EMSGSIZE;<br /> <br /> and reach this line:<br /> <br /> memcpy(tx_can_msg-&gt;data, cf-&gt;data, cf-&gt;len);<br /> <br /> Here, cf-&gt;len corresponds to the flags field of the CAN XL frame. In<br /> our previous example, we set canxl_frame-&gt;flags to 0xff. Because the<br /> maximum expected length is 8, a buffer overflow of 247 bytes occurs!<br /> <br /> Populate net_device_ops-&gt;ndo_change_mtu() to ensure that the<br /> interface&amp;#39;s MTU can not be set to anything bigger than CAN_MTU or<br /> CANFD_MTU (depending on the device capabilities). By fixing the root<br /> cause, this prevents the buffer overflow.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: MGMT: Fix possible UAFs<br /> <br /> This attemps to fix possible UAFs caused by struct mgmt_pending being<br /> freed while still being processed like in the following trace, in order<br /> to fix mgmt_pending_valid is introduce and use to check if the<br /> mgmt_pending hasn&amp;#39;t been removed from the pending list, on the complete<br /> callbacks it is used to check and in addtion remove the cmd from the list<br /> while holding mgmt_pending_lock to avoid TOCTOU problems since if the cmd<br /> is left on the list it can still be accessed and freed.<br /> <br /> BUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223<br /> Read of size 8 at addr ffff8880709d4dc0 by task kworker/u11:0/55<br /> <br /> CPU: 0 UID: 0 PID: 55 Comm: kworker/u11:0 Not tainted 6.16.4 #2 PREEMPT(full)<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014<br /> Workqueue: hci0 hci_cmd_sync_work<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120<br /> print_address_description mm/kasan/report.c:378 [inline]<br /> print_report+0xca/0x240 mm/kasan/report.c:482<br /> kasan_report+0x118/0x150 mm/kasan/report.c:595<br /> mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223<br /> hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332<br /> process_one_work kernel/workqueue.c:3238 [inline]<br /> process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321<br /> worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402<br /> kthread+0x711/0x8a0 kernel/kthread.c:464<br /> ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148<br /> ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245<br /> <br /> <br /> Allocated by task 12210:<br /> kasan_save_stack mm/kasan/common.c:47 [inline]<br /> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68<br /> poison_kmalloc_redzone mm/kasan/common.c:377 [inline]<br /> __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394<br /> kasan_kmalloc include/linux/kasan.h:260 [inline]<br /> __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364<br /> kmalloc_noprof include/linux/slab.h:905 [inline]<br /> kzalloc_noprof include/linux/slab.h:1039 [inline]<br /> mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c:269<br /> mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296<br /> __add_adv_patterns_monitor+0x130/0x200 net/bluetooth/mgmt.c:5247<br /> add_adv_patterns_monitor+0x214/0x360 net/bluetooth/mgmt.c:5364<br /> hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719<br /> hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839<br /> sock_sendmsg_nosec net/socket.c:714 [inline]<br /> __sock_sendmsg+0x219/0x270 net/socket.c:729<br /> sock_write_iter+0x258/0x330 net/socket.c:1133<br /> new_sync_write fs/read_write.c:593 [inline]<br /> vfs_write+0x5c9/0xb30 fs/read_write.c:686<br /> ksys_write+0x145/0x250 fs/read_write.c:738<br /> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]<br /> do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> Freed by task 12221:<br /> kasan_save_stack mm/kasan/common.c:47 [inline]<br /> kasan_save_track+0x3e/0x80 mm/kasan/common.c:68<br /> kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576<br /> poison_slab_object mm/kasan/common.c:247 [inline]<br /> __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264<br /> kasan_slab_free include/linux/kasan.h:233 [inline]<br /> slab_free_hook mm/slub.c:2381 [inline]<br /> slab_free mm/slub.c:4648 [inline]<br /> kfree+0x18e/0x440 mm/slub.c:4847<br /> mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline]<br /> mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257<br /> __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444<br /> hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290<br /> hci_dev_do_close net/bluetooth/hci_core.c:501 [inline]<br /> hci_dev_close+0x108/0x200 net/bluetooth/hci_core.c:526<br /> sock_do_ioctl+0xd9/0x300 net/socket.c:1192<br /> sock_ioctl+0x576/0x790 net/socket.c:1313<br /> vfs_ioctl fs/ioctl.c:51 [inline]<br /> __do_sys_ioctl fs/ioctl.c:907 [inline]<br /> __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893<br /> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]<br /> do_syscall_64+0xf<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> i40e: add validation for ring_len param<br /> <br /> The `ring_len` parameter provided by the virtual function (VF)<br /> is assigned directly to the hardware memory context (HMC) without<br /> any validation.<br /> <br /> To address this, introduce an upper boundary check for both Tx and Rx<br /> queue lengths. The maximum number of descriptors supported by the<br /> hardware is 8k-32.<br /> Additionally, enforce alignment constraints: Tx rings must be a multiple<br /> of 8, and Rx rings must be a multiple of 32.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()<br /> <br /> When config osnoise cpus by write() syscall, the following KASAN splat may<br /> be observed:<br /> <br /> BUG: KASAN: slab-out-of-bounds in _parse_integer_limit+0x103/0x130<br /> Read of size 1 at addr ffff88810121e3a1 by task test/447<br /> CPU: 1 UID: 0 PID: 447 Comm: test Not tainted 6.17.0-rc6-dirty #288 PREEMPT(voluntary)<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x55/0x70<br /> print_report+0xcb/0x610<br /> kasan_report+0xb8/0xf0<br /> _parse_integer_limit+0x103/0x130<br /> bitmap_parselist+0x16d/0x6f0<br /> osnoise_cpus_write+0x116/0x2d0<br /> vfs_write+0x21e/0xcc0<br /> ksys_write+0xee/0x1c0<br /> do_syscall_64+0xa8/0x2a0<br /> entry_SYSCALL_64_after_hwframe+0x77/0x7f<br /> <br /> <br /> This issue can be reproduced by below code:<br /> <br /> const char *cpulist = "1";<br /> int fd=open("/sys/kernel/debug/tracing/osnoise/cpus", O_WRONLY);<br /> write(fd, cpulist, strlen(cpulist));<br /> <br /> Function bitmap_parselist() was called to parse cpulist, it require that<br /> the parameter &amp;#39;buf&amp;#39; must be terminated with a &amp;#39;\0&amp;#39; or &amp;#39;\n&amp;#39;. Fix this issue<br /> by adding a &amp;#39;\0&amp;#39; to &amp;#39;buf&amp;#39; in osnoise_cpus_write().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> smb: client: fix wrong index reference in smb2_compound_op()<br /> <br /> In smb2_compound_op(), the loop that processes each command&amp;#39;s response<br /> uses wrong indices when accessing response bufferes.<br /> <br /> This incorrect indexing leads to improper handling of command results.<br /> Also, if incorrectly computed index is greather than or equal to<br /> MAX_COMPOUND, it can cause out-of-bounds accesses.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> futex: Use correct exit on failure from futex_hash_allocate_default()<br /> <br /> copy_process() uses the wrong error exit path from futex_hash_allocate_default().<br /> After exiting from futex_hash_allocate_default(), neither tasklist_lock<br /> nor siglock has been acquired. The exit label bad_fork_core_free unlocks<br /> both of these locks which is wrong.<br /> <br /> The next exit label, bad_fork_cancel_cgroup, is the correct exit.<br /> sched_cgroup_fork() did not allocate any resources that need to freed.<br /> <br /> Use bad_fork_cancel_cgroup on error exit from futex_hash_allocate_default().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> futex: Prevent use-after-free during requeue-PI<br /> <br /> syzbot managed to trigger the following race:<br /> <br /> T1 T2<br /> <br /> futex_wait_requeue_pi()<br /> futex_do_wait()<br /> schedule()<br /> futex_requeue()<br /> futex_proxy_trylock_atomic()<br /> futex_requeue_pi_prepare()<br /> requeue_pi_wake_futex()<br /> futex_requeue_pi_complete()<br /> /* preempt */<br /> <br /> * timeout/ signal wakes T1 *<br /> <br /> futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED<br /> futex_hash_put()<br /> // back to userland, on stack futex_q is garbage<br /> <br /> /* back */<br /> wake_up_state(q-&gt;task, TASK_NORMAL);<br /> <br /> In this scenario futex_wait_requeue_pi() is able to leave without using<br /> futex_q::lock_ptr for synchronization.<br /> <br /> This can be prevented by reading futex_q::task before updating the<br /> futex_q::requeue_state. A reference on the task_struct is not needed<br /> because requeue_pi_wake_futex() is invoked with a spinlock_t held which<br /> implies a RCU read section.<br /> <br /> Even if T1 terminates immediately after, the task_struct will remain valid<br /> during T2&amp;#39;s wake_up_state(). A READ_ONCE on futex_q::task before<br /> futex_requeue_pi_complete() is enough because it ensures that the variable<br /> is read before the state is updated.<br /> <br /> Read futex_q::task before updating the requeue state, use it for the<br /> following wakeup.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()<br /> <br /> This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node"<br /> and then dereferences it on the next line. Two lines later, we take<br /> a mutex so I don&amp;#39;t think this is an RCU safe region. Re-order it to do<br /> the dereferences before queuing up the free.