Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe: Free job before xe_exec_queue_put<br /> <br /> Free job depends on job-&gt;vm being valid, the last xe_exec_queue_put can<br /> destroy the VM. Prevent UAF by freeing job before xe_exec_queue_put.<br /> <br /> (cherry picked from commit 32a42c93b74c8ca6d0915ea3eba21bceff53042f)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe: Fix missing workqueue destroy in xe_gt_pagefault<br /> <br /> On driver reload we never free up the memory for the pagefault and<br /> access counter workqueues. Add those destroy calls here.<br /> <br /> (cherry picked from commit 7586fc52b14e0b8edd0d1f8a434e0de2078b7b2b)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/xe: Fix opregion leak<br /> <br /> Being part o the display, ideally the setup and cleanup would be done by<br /> display itself. However this is a bigger refactor that needs to be done<br /> on both i915 and xe. For now, just fix the leak:<br /> <br /> unreferenced object 0xffff8881a0300008 (size 192):<br /> comm "modprobe", pid 4354, jiffies 4295647021<br /> hex dump (first 32 bytes):<br /> 00 00 87 27 81 88 ff ff 18 80 9b 00 00 c9 ff ff ...&amp;#39;............<br /> 18 81 9b 00 00 c9 ff ff 00 00 00 00 00 00 00 00 ................<br /> backtrace (crc 99260e31):<br /> [] kmemleak_alloc+0x4b/0x80<br /> [] kmalloc_trace_noprof+0x312/0x3d0<br /> [] intel_opregion_setup+0x89/0x700 [xe]<br /> [] xe_display_init_noirq+0x2f/0x90 [xe]<br /> [] xe_device_probe+0x7a3/0xbf0 [xe]<br /> [] xe_pci_probe+0x333/0x5b0 [xe]<br /> [] local_pci_probe+0x48/0xb0<br /> [] pci_device_probe+0xc8/0x280<br /> [] really_probe+0xf8/0x390<br /> [] __driver_probe_device+0x8a/0x170<br /> [] driver_probe_device+0x23/0xb0<br /> [] __driver_attach+0xc7/0x190<br /> [] bus_for_each_dev+0x7d/0xd0<br /> [] driver_attach+0x1e/0x30<br /> [] bus_add_driver+0x117/0x250<br /> <br /> (cherry picked from commit 6f4e43a2f771b737d991142ec4f6d4b7ff31fbb4)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> workqueue: Fix UBSAN &amp;#39;subtraction overflow&amp;#39; error in shift_and_mask()<br /> <br /> UBSAN reports the following &amp;#39;subtraction overflow&amp;#39; error when booting<br /> in a virtual machine on Android:<br /> <br /> | Internal error: UBSAN: integer subtraction overflow: 00000000f2005515 [#1] PREEMPT SMP<br /> | Modules linked in:<br /> | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-00006-g3cbe9e5abd46-dirty #4<br /> | Hardware name: linux,dummy-virt (DT)<br /> | pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> | pc : cancel_delayed_work+0x34/0x44<br /> | lr : cancel_delayed_work+0x2c/0x44<br /> | sp : ffff80008002ba60<br /> | x29: ffff80008002ba60 x28: 0000000000000000 x27: 0000000000000000<br /> | x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000<br /> | x23: 0000000000000000 x22: 0000000000000000 x21: ffff1f65014cd3c0<br /> | x20: ffffc0e84c9d0da0 x19: ffffc0e84cab3558 x18: ffff800080009058<br /> | x17: 00000000247ee1f8 x16: 00000000247ee1f8 x15: 00000000bdcb279d<br /> | x14: 0000000000000001 x13: 0000000000000075 x12: 00000a0000000000<br /> | x11: ffff1f6501499018 x10: 00984901651fffff x9 : ffff5e7cc35af000<br /> | x8 : 0000000000000001 x7 : 3d4d455453595342 x6 : 000000004e514553<br /> | x5 : ffff1f6501499265 x4 : ffff1f650ff60b10 x3 : 0000000000000620<br /> | x2 : ffff80008002ba78 x1 : 0000000000000000 x0 : 0000000000000000<br /> | Call trace:<br /> | cancel_delayed_work+0x34/0x44<br /> | deferred_probe_extend_timeout+0x20/0x70<br /> | driver_register+0xa8/0x110<br /> | __platform_driver_register+0x28/0x3c<br /> | syscon_init+0x24/0x38<br /> | do_one_initcall+0xe4/0x338<br /> | do_initcall_level+0xac/0x178<br /> | do_initcalls+0x5c/0xa0<br /> | do_basic_setup+0x20/0x30<br /> | kernel_init_freeable+0x8c/0xf8<br /> | kernel_init+0x28/0x1b4<br /> | ret_from_fork+0x10/0x20<br /> | Code: f9000fbf 97fffa2f 39400268 37100048 (d42aa2a0)<br /> | ---[ end trace 0000000000000000 ]---<br /> | Kernel panic - not syncing: UBSAN: integer subtraction overflow: Fatal exception<br /> <br /> This is due to shift_and_mask() using a signed immediate to construct<br /> the mask and being called with a shift of 31 (WORK_OFFQ_POOL_SHIFT) so<br /> that it ends up decrementing from INT_MIN.<br /> <br /> Use an unsigned constant &amp;#39;1U&amp;#39; to generate the mask in shift_and_mask().

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bnxt_en: Fix double DMA unmapping for XDP_REDIRECT<br /> <br /> Remove the dma_unmap_page_attrs() call in the driver&amp;#39;s XDP_REDIRECT<br /> code path. This should have been removed when we let the page pool<br /> handle the DMA mapping. This bug causes the warning:<br /> <br /> WARNING: CPU: 7 PID: 59 at drivers/iommu/dma-iommu.c:1198 iommu_dma_unmap_page+0xd5/0x100<br /> CPU: 7 PID: 59 Comm: ksoftirqd/7 Tainted: G W 6.8.0-1010-gcp #11-Ubuntu<br /> Hardware name: Dell Inc. PowerEdge R7525/0PYVT1, BIOS 2.15.2 04/02/2024<br /> RIP: 0010:iommu_dma_unmap_page+0xd5/0x100<br /> Code: 89 ee 48 89 df e8 cb f2 69 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9 31 f6 31 ff 45 31 c0 e9 ab 17 71 00 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 31 d2 31 c9<br /> RSP: 0018:ffffab1fc0597a48 EFLAGS: 00010246<br /> RAX: 0000000000000000 RBX: ffff99ff838280c8 RCX: 0000000000000000<br /> RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000<br /> RBP: ffffab1fc0597a78 R08: 0000000000000002 R09: ffffab1fc0597c1c<br /> R10: ffffab1fc0597cd3 R11: ffff99ffe375acd8 R12: 00000000e65b9000<br /> R13: 0000000000000050 R14: 0000000000001000 R15: 0000000000000002<br /> FS: 0000000000000000(0000) GS:ffff9a06efb80000(0000) knlGS:0000000000000000<br /> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br /> CR2: 0000565c34c37210 CR3: 00000005c7e3e000 CR4: 0000000000350ef0<br /> ? show_regs+0x6d/0x80<br /> ? __warn+0x89/0x150<br /> ? iommu_dma_unmap_page+0xd5/0x100<br /> ? report_bug+0x16a/0x190<br /> ? handle_bug+0x51/0xa0<br /> ? exc_invalid_op+0x18/0x80<br /> ? iommu_dma_unmap_page+0xd5/0x100<br /> ? iommu_dma_unmap_page+0x35/0x100<br /> dma_unmap_page_attrs+0x55/0x220<br /> ? bpf_prog_4d7e87c0d30db711_xdp_dispatcher+0x64/0x9f<br /> bnxt_rx_xdp+0x237/0x520 [bnxt_en]<br /> bnxt_rx_pkt+0x640/0xdd0 [bnxt_en]<br /> __bnxt_poll_work+0x1a1/0x3d0 [bnxt_en]<br /> bnxt_poll+0xaa/0x1e0 [bnxt_en]<br /> __napi_poll+0x33/0x1e0<br /> net_rx_action+0x18a/0x2f0

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails<br /> <br /> If the dpu_format_populate_layout() fails, then FB is prepared, but not<br /> cleaned up. This ends up leaking the pin_count on the GEM object and<br /> causes a splat during DRM file closure:<br /> <br /> msm_obj-&gt;pin_count<br /> WARNING: CPU: 2 PID: 569 at drivers/gpu/drm/msm/msm_gem.c:121 update_lru_locked+0xc4/0xcc<br /> [...]<br /> Call trace:<br /> update_lru_locked+0xc4/0xcc<br /> put_pages+0xac/0x100<br /> msm_gem_free_object+0x138/0x180<br /> drm_gem_object_free+0x1c/0x30<br /> drm_gem_object_handle_put_unlocked+0x108/0x10c<br /> drm_gem_object_release_handle+0x58/0x70<br /> idr_for_each+0x68/0xec<br /> drm_gem_release+0x28/0x40<br /> drm_file_free+0x174/0x234<br /> drm_release+0xb0/0x160<br /> __fput+0xc0/0x2c8<br /> __fput_sync+0x50/0x5c<br /> __arm64_sys_close+0x38/0x7c<br /> invoke_syscall+0x48/0x118<br /> el0_svc_common.constprop.0+0x40/0xe0<br /> do_el0_svc+0x1c/0x28<br /> el0_svc+0x4c/0x120<br /> el0t_64_sync_handler+0x100/0x12c<br /> el0t_64_sync+0x190/0x194<br /> irq event stamp: 129818<br /> hardirqs last enabled at (129817): [] console_unlock+0x118/0x124<br /> hardirqs last disabled at (129818): [] el1_dbg+0x24/0x8c<br /> softirqs last enabled at (129808): [] handle_softirqs+0x4c8/0x4e8<br /> softirqs last disabled at (129785): [] __do_softirq+0x14/0x20<br /> <br /> Patchwork: https://patchwork.freedesktop.org/patch/600714/

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: flowtable: validate vlan header<br /> <br /> Ensure there is sufficient room to access the protocol field of the<br /> VLAN header, validate it once before the flowtable lookup.<br /> <br /> =====================================================<br /> BUG: KMSAN: uninit-value in nf_flow_offload_inet_hook+0x45a/0x5f0 net/netfilter/nf_flow_table_inet.c:32<br /> nf_flow_offload_inet_hook+0x45a/0x5f0 net/netfilter/nf_flow_table_inet.c:32<br /> nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]<br /> nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626<br /> nf_hook_ingress include/linux/netfilter_netdev.h:34 [inline]<br /> nf_ingress net/core/dev.c:5440 [inline]

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: prevent possible UAF in ip6_xmit()<br /> <br /> If skb_expand_head() returns NULL, skb has been freed<br /> and the associated dst/idev could also have been freed.<br /> <br /> We must use rcu_read_lock() to prevent a possible UAF.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: dsa: mv88e6xxx: Fix out-of-bound access<br /> <br /> If an ATU violation was caused by a CPU Load operation, the SPID could<br /> be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array).

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mptcp: pm: avoid possible UaF when selecting endp<br /> <br /> select_local_address() and select_signal_address() both select an<br /> endpoint entry from the list inside an RCU protected section, but return<br /> a reference to it, to be read later on. If the entry is dereferenced<br /> after the RCU unlock, reading info could cause a Use-after-Free.<br /> <br /> A simple solution is to copy the required info while inside the RCU<br /> protected section to avoid any risk of UaF later. The address ID might<br /> need to be modified later to handle the ID0 case later, so a copy seems<br /> OK to deal with.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/amdgpu: Validate TA binary size<br /> <br /> Add TA binary size validation to avoid OOB write.<br /> <br /> (cherry picked from commit c0a04e3570d72aaf090962156ad085e37c62e442)

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: fix possible UAF in ip6_finish_output2()<br /> <br /> If skb_expand_head() returns NULL, skb has been freed<br /> and associated dst/idev could also have been freed.<br /> <br /> We need to hold rcu_read_lock() to make sure the dst and<br /> associated idev are alive.