Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm, slub: fix potential memoryleak in kmem_cache_open()<br /> <br /> In error path, the random_seq of slub cache might be leaked. Fix this<br /> by using __kmem_cache_release() to release all the relevant resources.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> kunit: fix reference count leak in kfree_at_end<br /> <br /> The reference counting issue happens in the normal path of<br /> kfree_at_end(). When kunit_alloc_and_get_resource() is invoked, the<br /> function forgets to handle the returned resource object, whose refcount<br /> increased inside, causing a refcount leak.<br /> <br /> Fix this issue by calling kunit_alloc_resource() instead of<br /> kunit_alloc_and_get_resource().<br /> <br /> Fixed the following when applying:<br /> Shuah Khan <br /> <br /> CHECK: Alignment should match open parenthesis<br /> + kunit_alloc_resource(test, NULL, kfree_res_free, GFP_KERNEL,<br /> (void *)to_free);

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> isdn: mISDN: Fix sleeping function called from invalid context<br /> <br /> The driver can call card-&gt;isac.release() function from an atomic<br /> context.<br /> <br /> Fix this by calling this function after releasing the lock.<br /> <br /> The following log reveals it:<br /> <br /> [ 44.168226 ] BUG: sleeping function called from invalid context at kernel/workqueue.c:3018<br /> [ 44.168941 ] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5475, name: modprobe<br /> [ 44.169574 ] INFO: lockdep is turned off.<br /> [ 44.169899 ] irq event stamp: 0<br /> [ 44.170160 ] hardirqs last enabled at (0): [] 0x0<br /> [ 44.170627 ] hardirqs last disabled at (0): [] copy_process+0x132d/0x3e00<br /> [ 44.171240 ] softirqs last enabled at (0): [] copy_process+0x135a/0x3e00<br /> [ 44.171852 ] softirqs last disabled at (0): [] 0x0<br /> [ 44.172318 ] Preemption disabled at:<br /> [ 44.172320 ] [] nj_release+0x69/0x500 [netjet]<br /> [ 44.174441 ] Call Trace:<br /> [ 44.174630 ] dump_stack_lvl+0xa8/0xd1<br /> [ 44.174912 ] dump_stack+0x15/0x17<br /> [ 44.175166 ] ___might_sleep+0x3a2/0x510<br /> [ 44.175459 ] ? nj_release+0x69/0x500 [netjet]<br /> [ 44.175791 ] __might_sleep+0x82/0xe0<br /> [ 44.176063 ] ? start_flush_work+0x20/0x7b0<br /> [ 44.176375 ] start_flush_work+0x33/0x7b0<br /> [ 44.176672 ] ? trace_irq_enable_rcuidle+0x85/0x170<br /> [ 44.177034 ] ? kasan_quarantine_put+0xaa/0x1f0<br /> [ 44.177372 ] ? kasan_quarantine_put+0xaa/0x1f0<br /> [ 44.177711 ] __flush_work+0x11a/0x1a0<br /> [ 44.177991 ] ? flush_work+0x20/0x20<br /> [ 44.178257 ] ? lock_release+0x13c/0x8f0<br /> [ 44.178550 ] ? __kasan_check_write+0x14/0x20<br /> [ 44.178872 ] ? do_raw_spin_lock+0x148/0x360<br /> [ 44.179187 ] ? read_lock_is_recursive+0x20/0x20<br /> [ 44.179530 ] ? __kasan_check_read+0x11/0x20<br /> [ 44.179846 ] ? do_raw_spin_unlock+0x55/0x900<br /> [ 44.180168 ] ? ____kasan_slab_free+0x116/0x140<br /> [ 44.180505 ] ? _raw_spin_unlock_irqrestore+0x41/0x60<br /> [ 44.180878 ] ? skb_queue_purge+0x1a3/0x1c0<br /> [ 44.181189 ] ? kfree+0x13e/0x290<br /> [ 44.181438 ] flush_work+0x17/0x20<br /> [ 44.181695 ] mISDN_freedchannel+0xe8/0x100<br /> [ 44.182006 ] isac_release+0x210/0x260 [mISDNipac]<br /> [ 44.182366 ] nj_release+0xf6/0x500 [netjet]<br /> [ 44.182685 ] nj_remove+0x48/0x70 [netjet]<br /> [ 44.182989 ] pci_device_remove+0xa9/0x250

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mm, slub: fix potential use-after-free in slab_debugfs_fops<br /> <br /> When sysfs_slab_add failed, we shouldn&amp;#39;t call debugfs_slab_add() for s<br /> because s will be freed soon. And slab_debugfs_fops will use s later<br /> leading to a use-after-free.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm: mxsfb: Fix NULL pointer dereference crash on unload<br /> <br /> The mxsfb-&gt;crtc.funcs may already be NULL when unloading the driver,<br /> in which case calling mxsfb_irq_disable() via drm_irq_uninstall() from<br /> mxsfb_unload() leads to NULL pointer dereference.<br /> <br /> Since all we care about is masking the IRQ and mxsfb-&gt;base is still<br /> valid, just use that to clear and mask the IRQ.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ice: fix locking for Tx timestamp tracking flush<br /> <br /> Commit 4dd0d5c33c3e ("ice: add lock around Tx timestamp tracker flush")<br /> added a lock around the Tx timestamp tracker flow which is used to<br /> cleanup any left over SKBs and prepare for device removal.<br /> <br /> This lock is problematic because it is being held around a call to<br /> ice_clear_phy_tstamp. The clear function takes a mutex to send a PHY<br /> write command to firmware. This could lead to a deadlock if the mutex<br /> actually sleeps, and causes the following warning on a kernel with<br /> preemption debugging enabled:<br /> <br /> [ 715.419426] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:573<br /> [ 715.427900] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 3100, name: rmmod<br /> [ 715.435652] INFO: lockdep is turned off.<br /> [ 715.439591] Preemption disabled at:<br /> [ 715.439594] [] 0x0<br /> [ 715.446678] CPU: 52 PID: 3100 Comm: rmmod Tainted: G W OE 5.15.0-rc4+ #42 bdd7ec3018e725f159ca0d372ce8c2c0e784891c<br /> [ 715.458058] Hardware name: Intel Corporation S2600STQ/S2600STQ, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020<br /> [ 715.468483] Call Trace:<br /> [ 715.470940] dump_stack_lvl+0x6a/0x9a<br /> [ 715.474613] ___might_sleep.cold+0x224/0x26a<br /> [ 715.478895] __mutex_lock+0xb3/0x1440<br /> [ 715.482569] ? stack_depot_save+0x378/0x500<br /> [ 715.486763] ? ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.494979] ? kfree+0xc1/0x520<br /> [ 715.498128] ? mutex_lock_io_nested+0x12a0/0x12a0<br /> [ 715.502837] ? kasan_set_free_info+0x20/0x30<br /> [ 715.507110] ? __kasan_slab_free+0x10b/0x140<br /> [ 715.511385] ? slab_free_freelist_hook+0xc7/0x220<br /> [ 715.516092] ? kfree+0xc1/0x520<br /> [ 715.519235] ? ice_deinit_lag+0x16c/0x220 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.527359] ? ice_remove+0x1cf/0x6a0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.535133] ? pci_device_remove+0xab/0x1d0<br /> [ 715.539318] ? __device_release_driver+0x35b/0x690<br /> [ 715.544110] ? driver_detach+0x214/0x2f0<br /> [ 715.548035] ? bus_remove_driver+0x11d/0x2f0<br /> [ 715.552309] ? pci_unregister_driver+0x26/0x250<br /> [ 715.556840] ? ice_module_exit+0xc/0x2f [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.564799] ? __do_sys_delete_module.constprop.0+0x2d8/0x4e0<br /> [ 715.570554] ? do_syscall_64+0x3b/0x90<br /> [ 715.574303] ? entry_SYSCALL_64_after_hwframe+0x44/0xae<br /> [ 715.579529] ? start_flush_work+0x542/0x8f0<br /> [ 715.583719] ? ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.591923] ice_sq_send_cmd+0x78/0x14c0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.599960] ? wait_for_completion_io+0x250/0x250<br /> [ 715.604662] ? lock_acquire+0x196/0x200<br /> [ 715.608504] ? do_raw_spin_trylock+0xa5/0x160<br /> [ 715.612864] ice_sbq_rw_reg+0x1e6/0x2f0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.620813] ? ice_reset+0x130/0x130 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.628497] ? __debug_check_no_obj_freed+0x1e8/0x3c0<br /> [ 715.633550] ? trace_hardirqs_on+0x1c/0x130<br /> [ 715.637748] ice_write_phy_reg_e810+0x70/0xf0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.646220] ? do_raw_spin_trylock+0xa5/0x160<br /> [ 715.650581] ? ice_ptp_release+0x910/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.658797] ? ice_ptp_release+0x255/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.667013] ice_clear_phy_tstamp+0x2c/0x110 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.675403] ice_ptp_release+0x408/0x910 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.683440] ice_remove+0x560/0x6a0 [ice 9a7e1ec00971c89ecd3fe0d4dc7da2b3786a421d]<br /> [ 715.691037] ? _raw_spin_unlock_irqrestore+0x46/0x73<br /> [ 715.696005] pci_device_remove+0xab/0x1d0<br /> [ 715.700018] __device_release_driver+0x35b/0x690<br /> [ 715.704637] driver_detach+0x214/0x2f0<br /> [ 715.708389] bus_remove_driver+0x11d/0x2f0<br /> [ 715.712489] pci_unregister_driver+0x26/0x250<br /> [ 71<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> KVM: arm64: Fix host stage-2 PGD refcount<br /> <br /> The KVM page-table library refcounts the pages of concatenated stage-2<br /> PGDs individually. However, when running KVM in protected mode, the<br /> host&amp;#39;s stage-2 PGD is currently managed by EL2 as a single high-order<br /> compound page, which can cause the refcount of the tail pages to reach 0<br /> when they shouldn&amp;#39;t, hence corrupting the page-table.<br /> <br /> Fix this by introducing a new hyp_split_page() helper in the EL2 page<br /> allocator (matching the kernel&amp;#39;s split_page() function), and make use of<br /> it from host_s2_zalloc_pages_exact().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value<br /> <br /> Currently, when the rule related to IDLETIMER is added, idletimer_tg timer<br /> structure is initialized by kmalloc on executing idletimer_tg_create<br /> function. However, in this process timer-&gt;timer_type is not defined to<br /> a specific value. Thus, timer-&gt;timer_type has garbage value and it occurs<br /> kernel panic. So, this commit fixes the panic by initializing<br /> timer-&gt;timer_type using kzalloc instead of kmalloc.<br /> <br /> Test commands:<br /> # iptables -A OUTPUT -j IDLETIMER --timeout 1 --label test<br /> $ cat /sys/class/xt_idletimer/timers/test<br /> Killed<br /> <br /> Splat looks like:<br /> BUG: KASAN: user-memory-access in alarm_expires_remaining+0x49/0x70<br /> Read of size 8 at addr 0000002e8c7bc4c8 by task cat/917<br /> CPU: 12 PID: 917 Comm: cat Not tainted 5.14.0+ #3 79940a339f71eb14fc81aee1757a20d5bf13eb0e<br /> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014<br /> Call Trace:<br /> dump_stack_lvl+0x6e/0x9c<br /> kasan_report.cold+0x112/0x117<br /> ? alarm_expires_remaining+0x49/0x70<br /> __asan_load8+0x86/0xb0<br /> alarm_expires_remaining+0x49/0x70<br /> idletimer_tg_show+0xe5/0x19b [xt_IDLETIMER 11219304af9316a21bee5ba9d58f76a6b9bccc6d]<br /> dev_attr_show+0x3c/0x60<br /> sysfs_kf_seq_show+0x11d/0x1f0<br /> ? device_remove_bin_file+0x20/0x20<br /> kernfs_seq_show+0xa4/0xb0<br /> seq_read_iter+0x29c/0x750<br /> kernfs_fop_read_iter+0x25a/0x2c0<br /> ? __fsnotify_parent+0x3d1/0x570<br /> ? iov_iter_init+0x70/0x90<br /> new_sync_read+0x2a7/0x3d0<br /> ? __x64_sys_llseek+0x230/0x230<br /> ? rw_verify_area+0x81/0x150<br /> vfs_read+0x17b/0x240<br /> ksys_read+0xd9/0x180<br /> ? vfs_write+0x460/0x460<br /> ? do_syscall_64+0x16/0xc0<br /> ? lockdep_hardirqs_on+0x79/0x120<br /> __x64_sys_read+0x43/0x50<br /> do_syscall_64+0x3b/0xc0<br /> entry_SYSCALL_64_after_hwframe+0x44/0xae<br /> RIP: 0033:0x7f0cdc819142<br /> Code: c0 e9 c2 fe ff ff 50 48 8d 3d 3a ca 0a 00 e8 f5 19 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24<br /> RSP: 002b:00007fff28eee5b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000<br /> RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f0cdc819142<br /> RDX: 0000000000020000 RSI: 00007f0cdc032000 RDI: 0000000000000003<br /> RBP: 00007f0cdc032000 R08: 00007f0cdc031010 R09: 0000000000000000<br /> R10: 0000000000000022 R11: 0000000000000246 R12: 00005607e9ee31f0<br /> R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_tables: skip netdev events generated on netns removal<br /> <br /> syzbot reported following (harmless) WARN:<br /> <br /> WARNING: CPU: 1 PID: 2648 at net/netfilter/core.c:468<br /> nft_netdev_unregister_hooks net/netfilter/nf_tables_api.c:230 [inline]<br /> nf_tables_unregister_hook include/net/netfilter/nf_tables.h:1090 [inline]<br /> __nft_release_basechain+0x138/0x640 net/netfilter/nf_tables_api.c:9524<br /> nft_netdev_event net/netfilter/nft_chain_filter.c:351 [inline]<br /> nf_tables_netdev_event+0x521/0x8a0 net/netfilter/nft_chain_filter.c:382<br /> <br /> reproducer:<br /> unshare -n bash -c &amp;#39;ip link add br0 type bridge; nft add table netdev t ; \<br /> nft add chain netdev t ingress \{ type filter hook ingress device "br0" \<br /> priority 0\; policy drop\; \}&amp;#39;<br /> <br /> Problem is that when netns device exit hooks create the UNREGISTER<br /> event, the .pre_exit hook for nf_tables core has already removed the<br /> base hook. Notifier attempts to do this again.<br /> <br /> The need to do base hook unregister unconditionally was needed in the past,<br /> because notifier was last stage where reg-&gt;dev dereference was safe.<br /> <br /> Now that nf_tables does the hook removal in .pre_exit, this isn&amp;#39;t<br /> needed anymore.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ice: Avoid crash from unnecessary IDA free<br /> <br /> In the remove path, there is an attempt to free the aux_idx IDA whether<br /> it was allocated or not. This can potentially cause a crash when<br /> unloading the driver on systems that do not initialize support for RDMA.<br /> But, this free cannot be gated by the status bit for RDMA, since it is<br /> allocated if the driver detects support for RDMA at probe time, but the<br /> driver can enter into a state where RDMA is not supported after the IDA<br /> has been allocated at probe time and this would lead to a memory leak.<br /> <br /> Initialize aux_idx to an invalid value and check for a valid value when<br /> unloading to determine if an IDA free is necessary.