Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Reapply "drm/qxl: simplify qxl_fence_wait"<br /> <br /> This reverts commit 07ed11afb68d94eadd4ffc082b97c2331307c5ea.<br /> <br /> Stephen Rostedt reports:<br /> "I went to run my tests on my VMs and the tests hung on boot up.<br /> Unfortunately, the most I ever got out was:<br /> <br /> [ 93.607888] Testing event system initcall: OK<br /> [ 93.667730] Running tests on all trace events:<br /> [ 93.669757] Testing all events: OK<br /> [ 95.631064] ------------[ cut here ]------------<br /> Timed out after 60 seconds"<br /> <br /> and further debugging points to a possible circular locking dependency<br /> between the console_owner locking and the worker pool locking.<br /> <br /> Reverting the commit allows Steve&amp;#39;s VM to boot to completion again.<br /> <br /> [ This may obviously result in the "[TTM] Buffer eviction failed"<br /> messages again, which was the reason for that original revert. But at<br /> this point this seems preferable to a non-booting system... ]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/smc: fix neighbour and rtable leak in smc_ib_find_route()<br /> <br /> In smc_ib_find_route(), the neighbour found by neigh_lookup() and rtable<br /> resolved by ip_route_output_flow() are not released or put before return.<br /> It may cause the refcount leak, so fix it.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> qibfs: fix dentry leak<br /> <br /> simple_recursive_removal() drops the pinning references to all positives<br /> in subtree. For the cases when its argument has been kept alive by<br /> the pinning alone that&amp;#39;s exactly the right thing to do, but here<br /> the argument comes from dcache lookup, that needs to be balanced by<br /> explicit dput().<br /> <br /> Fucked-up-by: Al Viro

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe/xe_migrate: Cast to output precision before multiplying operands<br /> <br /> Addressing potential overflow in result of multiplication of two lower<br /> precision (u32) operands before widening it to higher precision<br /> (u64).<br /> <br /> -v2<br /> Fix commit message and description. (Rodrigo)<br /> <br /> (cherry picked from commit 34820967ae7b45411f8f4f737c2d63b0c608e0d7)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> amd/amdkfd: sync all devices to wait all processes being evicted<br /> <br /> If there are more than one device doing reset in parallel, the first<br /> device will call kfd_suspend_all_processes() to evict all processes<br /> on all devices, this call takes time to finish. other device will<br /> start reset and recover without waiting. if the process has not been<br /> evicted before doing recover, it will be restored, then caused page<br /> fault.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> phonet: fix rtm_phonet_notify() skb allocation<br /> <br /> fill_route() stores three components in the skb:<br /> <br /> - struct rtmsg<br /> - RTA_DST (u8)<br /> - RTA_OIF (u32)<br /> <br /> Therefore, rtm_phonet_notify() should use<br /> <br /> NLMSG_ALIGN(sizeof(struct rtmsg)) +<br /> nla_total_size(1) +<br /> nla_total_size(4)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/qeth: Fix kernel panic after setting hsuid<br /> <br /> Symptom:<br /> When the hsuid attribute is set for the first time on an IQD Layer3<br /> device while the corresponding network interface is already UP,<br /> the kernel will try to execute a napi function pointer that is NULL.<br /> <br /> Example:<br /> ---------------------------------------------------------------------------<br /> [ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP<br /> [ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6<br /> nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de<br /> s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod<br /> qdio ccwgroup pkey zcrypt<br /> [ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1<br /> [ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)<br /> [ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)<br /> [ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3<br /> [ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000<br /> [ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80<br /> [ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8<br /> [ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68<br /> [ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal<br /> &gt;0000000000000002: 0000 illegal<br /> 0000000000000004: 0000 illegal<br /> 0000000000000006: 0000 illegal<br /> 0000000000000008: 0000 illegal<br /> 000000000000000a: 0000 illegal<br /> 000000000000000c: 0000 illegal<br /> 000000000000000e: 0000 illegal<br /> [ 2057.572800] Call Trace:<br /> [ 2057.572801] ([] 0xec639700)<br /> [ 2057.572803] [] net_rx_action+0x2ba/0x398<br /> [ 2057.572809] [] __do_softirq+0x11e/0x3a0<br /> [ 2057.572813] [] do_softirq_own_stack+0x3c/0x58<br /> [ 2057.572817] ([] do_softirq.part.1+0x56/0x60)<br /> [ 2057.572822] [] __local_bh_enable_ip+0x80/0x98<br /> [ 2057.572825] [] __dev_queue_xmit+0x2be/0xd70<br /> [ 2057.572827] [] afiucv_hs_send+0x24e/0x300 [af_iucv]<br /> [ 2057.572830] [] iucv_send_ctrl+0x102/0x138 [af_iucv]<br /> [ 2057.572833] [] iucv_sock_connect+0x37a/0x468 [af_iucv]<br /> [ 2057.572835] [] __sys_connect+0xa0/0xd8<br /> [ 2057.572839] [] sys_socketcall+0x228/0x348<br /> [ 2057.572841] [] system_call+0x2a6/0x2c8<br /> [ 2057.572843] Last Breaking-Event-Address:<br /> [ 2057.572844] [] __napi_poll+0x4c/0x1d8<br /> [ 2057.572846]<br /> [ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt<br /> -------------------------------------------------------------------------------------------<br /> <br /> Analysis:<br /> There is one napi structure per out_q: card-&gt;qdio.out_qs[i].napi<br /> The napi.poll functions are set during qeth_open().<br /> <br /> Since<br /> commit 1cfef80d4c2b ("s390/qeth: Don&amp;#39;t call dev_close/dev_open (DOWN/UP)")<br /> qeth_set_offline()/qeth_set_online() no longer call dev_close()/<br /> dev_open(). So if qeth_free_qdio_queues() cleared<br /> card-&gt;qdio.out_qs[i].napi.poll while the network interface was UP and the<br /> card was offline, they are not set again.<br /> <br /> Reproduction:<br /> chzdev -e $devno layer2=0<br /> ip link set dev $network_interface up<br /> echo 0 &gt; /sys/bus/ccw<br /> ---truncated---

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> spi: fix null pointer dereference within spi_sync<br /> <br /> If spi_sync() is called with the non-empty queue and the same spi_message<br /> is then reused, the complete callback for the message remains set while<br /> the context is cleared, leading to a null pointer dereference when the<br /> callback is invoked from spi_finalize_current_message().<br /> <br /> With function inlining disabled, the call stack might look like this:<br /> <br /> _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58<br /> complete_with_flags from spi_complete+0x8/0xc<br /> spi_complete from spi_finalize_current_message+0xec/0x184<br /> spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474<br /> spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230<br /> __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4<br /> __spi_transfer_message_noqueue from __spi_sync+0x204/0x248<br /> __spi_sync from spi_sync+0x24/0x3c<br /> spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd]<br /> mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154<br /> _regmap_raw_read from _regmap_bus_read+0x44/0x70<br /> _regmap_bus_read from _regmap_read+0x60/0xd8<br /> _regmap_read from regmap_read+0x3c/0x5c<br /> regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd]<br /> mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd]<br /> mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78<br /> irq_thread_fn from irq_thread+0x118/0x1f4<br /> irq_thread from kthread+0xd8/0xf4<br /> kthread from ret_from_fork+0x14/0x28<br /> <br /> Fix this by also setting message-&gt;complete to NULL when the transfer is<br /> complete.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/cio: Ensure the copied buf is NUL terminated<br /> <br /> Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from<br /> userspace to that buffer. Later, we use scanf on this buffer but we don&amp;#39;t<br /> ensure that the string is terminated inside the buffer, this can lead to<br /> OOB read when using scanf. Fix this issue by using memdup_user_nul instead.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> thermal/debugfs: Prevent use-after-free from occurring after cdev removal<br /> <br /> Since thermal_debug_cdev_remove() does not run under cdev-&gt;lock, it can<br /> run in parallel with thermal_debug_cdev_state_update() and it may free<br /> the struct thermal_debugfs object used by the latter after it has been<br /> checked against NULL.<br /> <br /> If that happens, thermal_debug_cdev_state_update() will access memory<br /> that has been freed already causing the kernel to crash.<br /> <br /> Address this by using cdev-&gt;lock in thermal_debug_cdev_remove() around<br /> the cdev-&gt;debugfs value check (in case the same cdev is removed at the<br /> same time in two different threads) and its reset to NULL.<br /> <br /> Cc :6.8+ # 6.8+

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ice: ensure the copied buf is NUL terminated<br /> <br /> Currently, we allocate a count-sized kernel buffer and copy count bytes<br /> from userspace to that buffer. Later, we use sscanf on this buffer but we<br /> don&amp;#39;t ensure that the string is terminated inside the buffer, this can lead<br /> to OOB read when using sscanf. Fix this issue by using memdup_user_nul<br /> instead of memdup_user.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> efi/unaccepted: touch soft lockup during memory accept<br /> <br /> Commit 50e782a86c98 ("efi/unaccepted: Fix soft lockups caused by<br /> parallel memory acceptance") has released the spinlock so other CPUs can<br /> do memory acceptance in parallel and not triggers softlockup on other<br /> CPUs.<br /> <br /> However the softlock up was intermittent shown up if the memory of the<br /> TD guest is large, and the timeout of softlockup is set to 1 second:<br /> <br /> RIP: 0010:_raw_spin_unlock_irqrestore<br /> Call Trace:<br /> ? __hrtimer_run_queues<br /> <br /> ? hrtimer_interrupt<br /> ? watchdog_timer_fn<br /> ? __sysvec_apic_timer_interrupt<br /> ? __pfx_watchdog_timer_fn<br /> ? sysvec_apic_timer_interrupt<br /> <br /> ? __hrtimer_run_queues<br /> <br /> ? hrtimer_interrupt<br /> ? asm_sysvec_apic_timer_interrupt<br /> ? _raw_spin_unlock_irqrestore<br /> ? __sysvec_apic_timer_interrupt<br /> ? sysvec_apic_timer_interrupt<br /> accept_memory<br /> try_to_accept_memory<br /> do_huge_pmd_anonymous_page<br /> get_page_from_freelist<br /> __handle_mm_fault<br /> __alloc_pages<br /> __folio_alloc<br /> ? __tdx_hypercall<br /> handle_mm_fault<br /> vma_alloc_folio<br /> do_user_addr_fault<br /> do_huge_pmd_anonymous_page<br /> exc_page_fault<br /> ? __do_huge_pmd_anonymous_page<br /> asm_exc_page_fault<br /> __handle_mm_fault<br /> <br /> When the local irq is enabled at the end of accept_memory(), the<br /> softlockup detects that the watchdog on single CPU has not been fed for<br /> a while. That is to say, even other CPUs will not be blocked by<br /> spinlock, the current CPU might be stunk with local irq disabled for a<br /> while, which hurts not only nmi watchdog but also softlockup.<br /> <br /> Chao Gao pointed out that the memory accept could be time costly and<br /> there was similar report before. Thus to avoid any softlocup detection<br /> during this stage, give the softlockup a flag to skip the timeout check<br /> at the end of accept_memory(), by invoking touch_softlockup_watchdog().