Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:2135-1

Опубликовано: 21 июн. 2024
Источник: suse-cvrf

Описание

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 Azure kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

  • CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).

  • CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).

  • CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).

  • CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).

  • CVE-2023-0160: Fixed deadlock flaw in BPF that could allow a local user to potentially crash the system (bsc#1209657).

  • CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).

  • CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).

  • CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).

  • CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).

  • CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).

  • CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).

  • CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).

  • CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).

  • CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).

  • CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).

  • CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).

  • CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).

  • CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).

  • CVE-2024-26906: Disallowed vsyscall page read for copy_from_kernel_nofault() (bsc#1223202).

  • CVE-2024-26816: Ignore relocations in .notes section when building with CONFIG_XEN_PV=y (bsc#1222624).

  • CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).

  • CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).

  • CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).

  • CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).

  • CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).

  • CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).

  • CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).

  • CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).

  • CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).

  • CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).

  • CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).

  • CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).

  • CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).

  • CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).

  • CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).

  • CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).

  • CVE-2024-26642: Fixed the set of anonymous timeout flag in netfilter nf_tables (bsc#1221830).

  • CVE-2024-26614: Fixed the initialization of accept_queue's spinlocks (bsc#1221293).

  • CVE-2024-25739: Fixed possible crash in create_empty_lvol() in drivers/mtd/ubi/vtbl.c (bsc#1219834).

  • CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).

  • CVE-2024-36030: Fix the double free in rvu_npc_freemem() (bsc#1225712)

  • CVE-2023-52698: Fix memory leak in netlbl_calipso_add_pass() (bsc#1224621)

  • CVE-2024-26860: Fix a memory leak when rechecking the data (bsc#1223077).

  • CVE-2023-52772: Fix use-after-free in unix_stream_read_actor() (bsc#1224989).

  • CVE-2024-27431: Zero-initialise xdp_rxq_info struct before running XDP program (bsc#1224718).

  • CVE-2024-35860: Support deferring bpf_link dealloc to after RCU grace period BPF link for some program types (bsc#1224531).

  • CVE-2024-35964: Fix not validating setsockopt user input Check user input length before copying data (bsc#1224581).

  • CVE-2023-0160: Prevent lock inversion deadlock in map delete elem (bsc#1209657).

  • CVE-2024-35903: Fix IP after emitting call depth accounting Adjust the IP passed to emit_patch so it calculates the correct offset for the CALL instruction if x86_call_depth_emit_accounting emits code (bsc#1224493).

  • CVE-2024-35931: Skip do PCI error slot reset during RAS recovery (bsc#1224652).

  • CVE-2024-35877: Fix VM_PAT handling in COW mappings (bsc#1224525).

  • CVE-2024-35969: Fix race condition between ipv6_get_ifaddr and ipv6_del_addr (bsc#1224580)

  • CVE-2024-35852: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as supposedly it means that the migration ended (bsc#1224502).

  • CVE-2024-36006: Fix incorrect list API usage (bsc#1224541).

  • CVE-2024-36007: Fix warning during rehash (bsc#1224543).

  • CVE-2024-35872: Fix GUP-fast succeeding on secretmem folios (bsc#1224530).

  • CVE-2024-35956: Fix qgroup prealloc rsv leak in subvolume operations (bsc#1224674)

  • CVE-2023-52771: Fix delete_endpoint() vs parent unregistration race (bsc#1225007).

  • CVE-2024-27408: Add sync read before starting the DMA transfer in remote setup (bsc#1224430).

  • CVE-2024-35943: Add a null pointer check to the omap_prm_domain_init devm_kasprintf()returns a pointer to dynamically allocated memory which can be NULL upon failure (bsc#1224649).

  • CVE-2024-35921: Fix oops when HEVC init fails (bsc#1224477).

  • CVE-2023-52860: Use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process (bsc#1224936).

  • CVE-2024-35991: kABI workaround for struct idxd_evl (bsc#1224553).

  • CVE-2024-35854: Fix possible use-after-free during rehash (bsc#1224636).

  • CVE-2024-27418: Take ownership of skb in mctp_local_output (bsc#1224720)

  • CVE-2024-27417: Fix potential 'struct net' leak in inet6_rtm_getaddr() (bsc#1224721).

  • CVE-2024-35905: Protect against int overflow for stack access size (bsc#1224488).

  • CVE-2024-35917: Fix bpf_plt pointer arithmetic (bsc#1224481).

  • CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put() to nsure the value passed to scarlett2_mixer_ctl_put() is between 0 and SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside scarlett2_mixer_values[] (bsc#1224727).

  • CVE-2023-52680: Add missing error checks to *_ctl_get() because the ctl_get() functions which call scarlett2_update() were not checking the return value (bsc#1224608).

  • CVE-2023-52692: Add missing error check to scarlett2_usb_set_config() scarlett2_usb_set_config() calls scarlett2_usb_get() but was not checking the result (bsc#1224628).

  • CVE-2024-35944: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in dg_dispatch_as_host' bug (bsc#1224648).

  • CVE-2024-26923: Suppress false-positive lockdep splat for spin_lock() in __unix_gc() (bsc#1223384).

  • CVE-2023-52659: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (bsc#1224442).

  • CVE-2024-21823: Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may have allowed an authorized user to potentially enable denial of service via local access (bsc#1223625).

  • CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).

  • CVE-2024-27395: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu (bsc#1224098).

  • CVE-2023-52483: Perform route lookups under a RCU read-side lock (bsc#1220738).

  • CVE-2024-27396: Fix Use-After-Free in gtp_dellink (bsc#1224096).

  • CVE-2024-26632: Fix iterating over an empty bio with bio_for_each_folio_all (bsc#1221635).

  • CVE-2024-27401: Ensure that packet_buffer_get respects the user_length provided. (bsc#1224181).

  • CVE-2024-26775: Avoid potential deadlock at set_capacity (bsc#1222627).

  • CVE-2024-26958: Fix UAF in direct writes (bsc#1223653).

  • CVE-2024-26643: Mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allowed it to collect elements from anonymous sets with timeouts while it is being released from the commit path. (bsc#1221829).

  • CVE-2023-52618: Check for unlikely string overflow (bsc#1221615).

  • CVE-2023-6238: Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memory corruption (bsc#1217384).

  • CVE-2024-26946: Use copy_from_kernel_nofault() to read from unsafe address Read from an unsafe address with copy_from_kernel_nofault() in arch_adjust_kprobe_addr() because this function is used before checking the address is in text or not (bsc#1223669).

  • CVE-2024-26945: Fix nr_cpus nr_iaa case If nr_cpus nr_iaa, the calculated cpus_per_iaa will be 0, which causes a divide-by-0 in rebalance_wq_table() (bsc#1223732).

  • CVE-2024-26679: Read sk->sk_family once in inet_recv_error() inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning (bsc#1222385).

  • CVE-2024-26791: Properly validate device names (bsc#1222793)

  • CVE-2023-52641: Add NULL ptr dereference checking at the end of attr_allocate_frame() (bsc#1222303)

  • CVE-2024-26726: Do not drop extent_map for free space inode on write error (bsc#1222532)

  • CVE-2024-27022: Defer linking file vma until vma is fully initialized (bsc#1223774).

  • CVE-2024-26899: Fix deadlock between bd_link_disk_holder and partition scan (bsc#1223045).

  • CVE-2024-26638: Always initialize struct msghdr completely (bsc#1221649).

  • CVE-2024-26909: Fix drm bridge use-after-free A recent DRM series purporting to simplify support (bsc#1223143).

  • CVE-2024-26674: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups (bsc#1222378).

  • CVE-2024-26832: Fix missing folio cleanup in writeback race path (bsc#1223007).

  • CVE-2024-26844: Fix WARNING in _copy_from_iter (bsc#1223015).

  • CVE-2024-26774: Avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt (bsc#1222622).

  • CVE-2024-26815: Properly check TCA_TAPRIO_TC_ENTRY_INDEX (bsc#1222635).

  • cve-2024-267600: Fix bio_put() for error case (bsc#1222596).

  • CVE-2024-26731: Fix NULL pointer dereference in sk_psock_verdict_data_ready() (bsc#1222371).

  • CVE-2024-26740: Use the backlog for mirred ingress (bsc#1222563).

  • CVE-2023-52640: Fix oob in ntfs_listxattr The length of name cannot exceed the space occupied by ea (bsc#1222301).

  • CVE-2023-52631: Fix a NULL dereference bug (bsc#1222264).

  • CVE-2023-52458: Add check that partition length needs to be aligned with block size (bsc#1220428).

  • CVE-2023-6270: Fix the potential use-after-free problem in aoecmd_cfg_pkts (bsc#1218562).

  • CVE-2024-26805: Fix kernel-infoleak-after-free in __skb_datagram_iter (bsc#1222630).

  • CVE-2024-26991: Do not overflow lpage_info when checking attributes (bsc#1223695).

  • CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).

  • CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).

  • CVE-2024-26822: Set correct id, uid and cruid for multiuser automounts (bsc#1223011).

  • CVE-2023-52434: Fixed potential OOBs in smb2_parse_contexts() (bsc#1220148).

  • CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).

  • CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).

  • CVE-2024-35861: Fixed potential UAF in cifs_signal_cifsd_for_reconnect() (bsc#1224766).

  • CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted() (bsc#1224764).

  • CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).

  • CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break() (bsc#1224668).

  • CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break() (bsc#1224765).

  • CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).

  • CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).

  • CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key() (bsc#1224667).

  • CVE-2024-35869: Guarantee refcounted children from parent session (bsc#1224679).

  • CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).

  • CVE-2024-26692: Fixed regression in writes when non-standard maximum write size negotiated (bsc#1222464).

  • CVE-2024-27036: Fixed writeback data corruption (bsc#1223810).

The following non-security bugs were fixed:

  • 9p: add missing locking around taking dentry fid list (git-fixes)
  • ACPI: CPPC: Fix access width used for PCC registers (git-fixes).
  • ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro (git-fixes).
  • ACPI: CPPC: Use access_width over bit_width for system memory accesses (stable-fixes).
  • ACPI: Fix Generic Initiator Affinity _OSC bit (git-fixes).
  • ACPI: LPSS: Advertise number of chip selects via property (git-fixes).
  • ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC (git-fixes).
  • ACPI: bus: Indicate support for _TFP thru _OSC (git-fixes).
  • ACPI: bus: Indicate support for the Generic Event Device thru _OSC (git-fixes).
  • ACPI: disable -Wstringop-truncation (git-fixes).
  • ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override (stable-fixes).
  • ACPI: resource: Do IRQ override on Lunnen Ground laptops (stable-fixes).
  • ACPI: scan: Do not increase dep_unmet for already met dependencies (git-fixes).
  • ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7 (bsc#1217750).
  • ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes).
  • ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields() (git-fixes).
  • ALSA/hda: intel-dsp-config: reduce log verbosity (git-fixes).
  • ALSA: Fix deadlocks with kctl removals at disconnection (stable-fixes).
  • ALSA: aoa: avoid false-positive format truncation warning (git-fixes).
  • ALSA: core: Fix NULL module pointer assignment at card init (git-fixes).
  • ALSA: core: Remove debugfs at disconnection (git-fixes).
  • ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter (stable-fixes).
  • ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup (git-fixes).
  • ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC (stable-fixes).
  • ALSA: hda/realtek - Fix inactive headset mic jack (stable-fixes).
  • ALSA: hda/realtek - Set GPIO3 to default at S4 state for Thinkpad with ALC1318 (stable-fixes).
  • ALSA: hda/realtek - fixed headset Mic not show (stable-fixes).
  • ALSA: hda/realtek: Add quirk for HP SnowWhite laptops (stable-fixes).
  • ALSA: hda/realtek: Add quirk for HP Spectre x360 14 eu0000 (stable-fixes).
  • ALSA: hda/realtek: Add quirks for ASUS Laptops using CS35L56 (stable-fixes).
  • ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41 (stable-fixes).
  • ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N (stable-fixes).
  • ALSA: hda/realtek: Add quirks for Lenovo 13X (stable-fixes).
  • ALSA: hda/realtek: Add quirks for some Clevo laptops (stable-fixes).
  • ALSA: hda/realtek: Add sound quirks for Lenovo Legion slim 7 16ARHA7 models (stable-fixes).
  • ALSA: hda/realtek: Add support for ASUS Zenbook 2024 HN7306W (stable-fixes).
  • ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp (git-fixes).
  • ALSA: hda/realtek: Drop doubly quirk entry for 103c:8a2e (git-fixes).
  • ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897 (stable-fixes).
  • ALSA: hda/realtek: Fix build error without CONFIG_PM (stable-fixes).
  • ALSA: hda/realtek: Fix conflicting PCI SSID 17aa:386f for Lenovo Legion models (bsc#1223462).
  • ALSA: hda/realtek: Fix internal speakers for Legion Y9000X 2022 IAH7 (stable-fixes).
  • ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU (stable-fixes).
  • ALSA: hda/realtek: Fix volumn control of ThinkBook 16P Gen4 (git-fixes).
  • ALSA: hda/realtek: Fixes for Asus GU605M and GA403U sound (stable-fixes).
  • ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone (git-fixes).
  • ALSA: hda/realtek: cs35l41: Support ASUS ROG G634JYR (stable-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs do not work for ProBook 440/460 G11 (stable-fixes).
  • ALSA: hda/realtek: fix the hp playback volume issue for LG machines (stable-fixes).
  • ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad ICE-1 (stable-fixes).
  • ALSA: hda/tas2781: add locks to kcontrols (git-fixes).
  • ALSA: hda/tas2781: correct the register for pow calibrated data (git-fixes).
  • ALSA: hda/tas2781: remove digital gain kcontrol (git-fixes).
  • ALSA: hda: Add Intel BMG PCI ID and HDMI codec vid (stable-fixes).
  • ALSA: hda: clarify Copyright information (stable-fixes).
  • ALSA: hda: cs35l41: Add support for ASUS ROG 2024 Laptops (stable-fixes).
  • ALSA: hda: cs35l41: Ignore errors when configuring IRQs (stable-fixes).
  • ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim 7 16ARHA7 (git-fixes).
  • ALSA: hda: cs35l41: Remove redundant argument to cs35l41_request_firmware_file() (stable-fixes).
  • ALSA: hda: cs35l41: Set the max PCM Gain using tuning setting (stable-fixes).
  • ALSA: hda: cs35l41: Support HP Omen models without _DSD (stable-fixes).
  • ALSA: hda: cs35l41: Support Lenovo 13X laptop without _DSD (stable-fixes).
  • ALSA: hda: cs35l41: Update DSP1RX5/6 Sources for DSP config (stable-fixes).
  • ALSA: hda: cs35l56: Add ACPI device match tables (git-fixes).
  • ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot() (stable-fixes).
  • ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance (git-fixes).
  • ALSA: hda: cs35l56: Set the init_done flag before component_add() (git-fixes).
  • ALSA: hda: hda_cs_dsp_ctl: Remove notification of driver write (stable-fixes).
  • ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection (stable-fixes).
  • ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() (git-fixes).
  • ALSA: line6: Zero-initialize message buffers (stable-fixes).
  • ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support (stable-fixes).
  • ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support (stable-fixes).
  • ALSA: scarlett2: Add correct product series name to messages (stable-fixes).
  • ALSA: scarlett2: Add missing error check to scarlett2_config_save() (git-fixes).
  • ALSA: scarlett2: Add support for Clarett 8Pre USB (stable-fixes).
  • ALSA: scarlett2: Default mixer driver to enabled (stable-fixes).
  • ALSA: scarlett2: Move USB IDs out from device_info struct (stable-fixes).
  • ALSA: seq: Do not clear bank selection at event -> UMP MIDI2 conversion (git-fixes).
  • ALSA: seq: Fix incorrect UMP type for system messages (git-fixes).
  • ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion (git-fixes).
  • ALSA: seq: Fix yet another spot for system message conversion (git-fixes).
  • ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages (git-fixes).
  • ALSA: seq: ump: Fix swapped song position pointer data (git-fixes).
  • ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs (git-fixes).
  • ALSA: timer: Set lower bound of start tick time (stable-fixes).
  • ALSA: ump: Do not accept an invalid UMP protocol number (git-fixes).
  • ALSA: ump: Do not clear bank selection after sending a program change (git-fixes).
  • ALSA: ump: Set default protocol when not given explicitly (git-fixes).
  • ALSA: usb-audio: Add sampling rates support for Mbox3 (stable-fixes).
  • ALSA: usb-audio: Fix for sampling rates support for Mbox3 (stable-fixes).
  • ARM: 9381/1: kasan: clear stale stack poison (git-fixes).
  • ARM: OMAP2+: fix N810 MMC gpiod table (git-fixes).
  • ARM: OMAP2+: fix USB regression on Nokia N8x0 (git-fixes).
  • ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init (git-fixes).
  • ARM: imx_v6_v7_defconfig: Restore CONFIG_BACKLIGHT_CLASS_DEVICE (git-fixes).
  • ARM: prctl: reject PR_SET_MDWE on pre-ARMv6 (stable-fixes).
  • ARM: s5pv210: fix pm.c kernel-doc warning (git-fixes).
  • ASoC: Intel: Disable route checks for Skylake boards (git-fixes).
  • ASoC: Intel: avs: Fix ASRC module initialization (git-fixes).
  • ASoC: Intel: avs: Fix potential integer overflow (git-fixes).
  • ASoC: Intel: avs: Populate board selection with new I2S entries (stable-fixes).
  • ASoC: Intel: avs: Set name of control as in topology (git-fixes).
  • ASoC: Intel: avs: Test result of avs_get_module_entry() (git-fixes).
  • ASoC: Intel: avs: ssm4567: Do not ignore route checks (git-fixes).
  • ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too (git-fixes).
  • ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops (stable-fixes).
  • ASoC: SOF: Intel: add default firmware library path for LNL (git-fixes).
  • ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend (stable-fixes).
  • ASoC: SOF: Intel: lnl: Correct rom_status_reg (git-fixes).
  • ASoC: SOF: Intel: mtl: Correct rom_status_reg (git-fixes).
  • ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed (git-fixes).
  • ASoC: SOF: Intel: mtl: Implement firmware boot state check (git-fixes).
  • ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails (stable-fixes).
  • ASoC: SOF: amd: Optimize quirk for Valve Galileo (stable-fixes).
  • ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend (stable-fixes).
  • ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension (git-fixes).
  • ASoC: acp: Support microphone from device Acer 315-24p (git-fixes).
  • ASoC: amd: acp: fix for acp_init function error handling (git-fixes).
  • ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table (stable-fixes).
  • ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE (stable-fixes).
  • ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2 (stable-fixes).
  • ASoC: amd: yc: Revert 'Fix non-functional mic on Lenovo 21J2' (stable-fixes).
  • ASoC: codecs: wsa881x: set clk_stop_mode1 flag (git-fixes).
  • ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config (git-fixes).
  • ASoC: cs35l56: Fix unintended bus access while resetting amp (git-fixes).
  • ASoC: cs35l56: Prevent overwriting firmware ASP config (git-fixes).
  • ASoC: da7219-aad: fix usage of device_get_named_child_node() (git-fixes).
  • ASoC: kirkwood: Fix potential NULL dereference (git-fixes).
  • ASoC: mediatek: Assign dummy when codec not specified for a DAI link (git-fixes).
  • ASoC: mediatek: mt8192: fix register configuration for tdm (git-fixes).
  • ASoC: meson: axg-card: make links nonatomic (git-fixes).
  • ASoC: meson: axg-fifo: use FIELD helpers (stable-fixes).
  • ASoC: meson: axg-fifo: use threaded irq to check periods (git-fixes).
  • ASoC: meson: axg-tdm-interface: manage formatters in trigger (git-fixes).
  • ASoC: meson: cards: select SND_DYNAMIC_MINORS (git-fixes).
  • ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw (git-fixes).
  • ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates (git-fixes).
  • ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating (git-fixes).
  • ASoC: rt5645: Make LattePanda board DMI match more precise (stable-fixes).
  • ASoC: rt5682-sdw: fix locking sequence (git-fixes).
  • ASoC: rt711-sdca: fix locking sequence (git-fixes).
  • ASoC: rt711-sdw: fix locking sequence (git-fixes).
  • ASoC: rt712-sdca-sdw: fix locking sequence (git-fixes).
  • ASoC: rt715-sdca: volume step modification (git-fixes).
  • ASoC: rt715: add vendor clear control register (git-fixes).
  • ASoC: rt722-sdca-sdw: fix locking sequence (git-fixes).
  • ASoC: rt722-sdca: add headset microphone vrefo setting (git-fixes).
  • ASoC: rt722-sdca: modify channel number to support 4 channels (git-fixes).
  • ASoC: soc-core.c: Skip dummy codec when adding platforms (stable-fixes).
  • ASoC: tas2552: Add TX path for capturing AUDIO-OUT data (git-fixes).
  • ASoC: tas2781: Fix a warning reported by robot kernel test (git-fixes).
  • ASoC: tas2781: Fix wrong loading calibrated data sequence (git-fixes).
  • ASoC: tas2781: mark dvc_tlv with __maybe_unused (git-fixes).
  • ASoC: tegra: Fix DSPK 16-bit playback (git-fixes).
  • ASoC: ti: Convert Pandora ASoC to GPIO descriptors (stable-fixes).
  • ASoC: ti: davinci-mcasp: Fix race condition during probe (git-fixes).
  • ASoC: tlv320adc3xxx: Do not strip remove function when driver is builtin (git-fixes).
  • ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).
  • ASoC: wm_adsp: Add missing MODULE_DESCRIPTION() (git-fixes).
  • ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl() (git-fixes).
  • Add alt-commit to a nouveau patch
  • Add cherry-picked id to amdgpu patch
  • Add cherry-picked id to amdgpu patch (git-fixes)
  • Add cherry-picked patch references to amdgpu patches
  • Add reference to L3 bsc#1225765 in BPF control flow graph and precision backtrack fixes (bsc#1225756) The L3 bsc#1225765 was created seperately since our customer requires PTF.
  • Bluetooth: Add new quirk for broken read key length on ATS2851 (stable-fixes).
  • Bluetooth: Fix TOCTOU in HCI debugfs implementation (git-fixes).
  • Bluetooth: Fix memory leak in hci_req_sync_complete() (git-fixes).
  • Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() (stable-fixes).
  • Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (git-fixes).
  • Bluetooth: HCI: Fix potential null-ptr-deref (git-fixes).
  • Bluetooth: ISO: Align broadcast sync_timeout with connection timeout (stable-fixes).
  • Bluetooth: ISO: Do not reject BT_ISO_QOS if parameters are unset (git-fixes).
  • Bluetooth: L2CAP: Fix not validating setsockopt user input (git-fixes).
  • Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() (git-fixes).
  • Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (bsc#1221504).
  • Bluetooth: RFCOMM: Fix not validating setsockopt user input (git-fixes).
  • Bluetooth: SCO: Fix not validating setsockopt user input (git-fixes).
  • Bluetooth: add quirk for broken address properties (git-fixes).
  • Bluetooth: btintel: Fix null ptr deref in btintel_read_version (stable-fixes).
  • Bluetooth: btintel: Fixe build regression (git-fixes).
  • Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 (stable-fixes).
  • Bluetooth: btusb: Fix triggering coredump implementation for QCA (git-fixes).
  • Bluetooth: hci_core: Cancel request on command timeout (stable-fixes).
  • Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE (git-fixes).
  • Bluetooth: hci_event: set the conn encrypted before conn establishes (stable-fixes).
  • Bluetooth: hci_sock: Fix not validating setsockopt user input (git-fixes).
  • Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync (git-fixes).
  • Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY (git-fixes).
  • Bluetooth: hci_sync: Use QoS to determine which PHY to scan (stable-fixes).
  • Bluetooth: l2cap: Do not double set the HCI_CONN_MGMT_CONNECTED bit (git-fixes).
  • Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (git-fixes).
  • Bluetooth: mgmt: Fix limited discoverable off timeout (stable-fixes).
  • Bluetooth: msft: fix slab-use-after-free in msft_do_close() (git-fixes).
  • Bluetooth: qca: Fix error code in qca_read_fw_build_info() (git-fixes).
  • Bluetooth: qca: add missing firmware sanity checks (git-fixes).
  • Bluetooth: qca: fix NULL-deref on non-serdev setup (git-fixes).
  • Bluetooth: qca: fix NULL-deref on non-serdev suspend (git-fixes).
  • Bluetooth: qca: fix NVM configuration parsing (git-fixes).
  • Bluetooth: qca: fix device-address endianness (git-fixes).
  • Bluetooth: qca: fix firmware check error path (git-fixes).
  • Bluetooth: qca: fix info leak when fetching fw build id (git-fixes).
  • Delete patches.suse/btrfs-qgroup-fix-qgroup-prealloc-rsv-leak-in-subvolu.patch. Quoting bsc#1225945#c11: 'So the upstream 6.5 kernel commit (1b53e51a4a8f ('btrfs: do not commit transaction for every subvol create') ) was never backported to SLE, so that fix eb96e221937a ('btrfs: fix unwritten extent buffer after snapshotting a new subvolume') was never backported.'
  • Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter matching sysfs file (git-fixes).
  • Drop usb gadget patch that was taken mistakenly and reverted (git-fixes)
  • EDAC/synopsys: Fix ECC status and IRQ control race condition (git-fixes).
  • Edit 'amdkfd: use calloc instead of kzalloc to avoid integer overflow' Reference CVE and bug numbers.
  • Enable CONFIG_FIPS_SIGNATURE_SELFTEST (bsc#1222771)
  • Enable new CONFIG_FIPS_SIGNATURE_SELFTEST_ECDSA.
  • Enable new CONFIG_FIPS_SIGNATURE_SELFTEST_RSA.
  • Fix a potential infinite loop in extract_user_to_sg() (git-fixes).
  • Fix build errors due to new UIO_MEM_DMA_COHERENT mess (git-fixes).
  • Fix patches.suse/coresight-etm4x-Add-ACPI-support-in-platform-driver.patch (bsc#1218779 bsc#1220587) Put back patch hunk which where missed because file rename drivers/acpi/acpi_amba.c -> drivers/acpi/arm64/amba.c
  • HID: amd_sfh: Handle 'no sensors' in PM operations (git-fixes).
  • HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up (git-fixes).
  • HID: input: avoid polling stylus battery on Chromebook Pompom (stable-fixes).
  • HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors (git-fixes).
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc (git-fixes).
  • HID: logitech-dj: allow mice to use all types of reports (git-fixes).
  • HID: multitouch: Add required quirk for Synaptics 0xcddc device (stable-fixes).
  • IB/mlx5: Use __iowrite64_copy() for write combining stores (git-fixes)
  • Input: cyapa - add missing input core locking to suspend/resume functions (git-fixes).
  • Input: gpio_keys_polled - suppress deferred probe error for gpio (stable-fixes).
  • Input: imagis - use FIELD_GET where applicable (stable-fixes).
  • Input: ims-pcu - fix printf string overflow (git-fixes).
  • Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation (git-fixes).
  • Input: synaptics-rmi4 - fail probing if memory allocation for 'phys' fails (stable-fixes).
  • Input: xpad - add additional HyperX Controller Identifiers (stable-fixes).
  • Input: xpad - add support for Snakebyte GAMEPADs (stable-fixes).
  • KEYS: trusted: Do not use WARN when encode fails (git-fixes).
  • KEYS: trusted: Fix memory leak in tpm2_key_encode() (git-fixes).
  • KVM: SVM: Add support for allowing zero SEV ASIDs (git-fixes).
  • KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (git-fixes).
  • KVM: SVM: Use unsigned integers when dealing with ASIDs (git-fixes).
  • KVM: VMX: Disable LBR virtualization if the CPU does not support LBR callstacks (git-fixes).
  • KVM: VMX: Report up-to-date exit qualification to userspace (git-fixes).
  • KVM: nVMX: Clear EXIT_QUALIFICATION when injecting an EPT Misconfig (git-fixes).
  • KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1224790).
  • KVM: x86/mmu: Do not force emulation of L2 accesses to non-APIC internal slots (git-fixes).
  • KVM: x86/mmu: Move private vs. shared check above slot validity checks (git-fixes).
  • KVM: x86/mmu: Restrict KVM_SW_PROTECTED_VM to the TDP MMU (git-fixes).
  • KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status (git-fixes).
  • KVM: x86/pmu: Allow programming events that match unsupported arch events (git-fixes).
  • KVM: x86/pmu: Always treat Fixed counters as available when supported (git-fixes).
  • KVM: x86/pmu: Apply 'fast' RDPMC only to Intel PMUs (git-fixes).
  • KVM: x86/pmu: Disable support for adaptive PEBS (git-fixes).
  • KVM: x86/pmu: Disallow 'fast' RDPMC for architectural Intel PMUs (git-fixes).
  • KVM: x86/pmu: Do not ignore bits 31:30 for RDPMC index on AMD (git-fixes).
  • KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms (git-fixes).
  • KVM: x86/pmu: Explicitly check NMI from guest to reducee false positives (git-fixes).
  • KVM: x86/pmu: Prioritize VMX interception over #GP on RDPMC due to bad index (git-fixes).
  • KVM: x86/pmu: Set enable bits for GP counters in PERF_GLOBAL_CTRL at 'RESET' (git-fixes).
  • KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled (git-fixes).
  • KVM: x86/xen: fix recursive deadlock in timer injection (git-fixes).
  • KVM: x86/xen: improve accuracy of Xen timers (git-fixes).
  • KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled (git-fixes).
  • KVM: x86/xen: remove WARN_ON_ONCE() with false positives in evtchn delivery (git-fixes).
  • KVM: x86: Allow, do not ignore, same-value writes to immutable MSRs (git-fixes).
  • KVM: x86: Fix broken debugregs ABI for 32 bit kernels (git-fixes).
  • KVM: x86: Fully re-initialize supported_mce_cap on vendor module load (git-fixes).
  • KVM: x86: Introduce __kvm_get_hypervisor_cpuid() helper (git-fixes).
  • KVM: x86: Mark target gfn of emulated atomic instruction as dirty (git-fixes).
  • KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled (git-fixes).
  • KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible (git-fixes).
  • KVM: x86: Update KVM_SW_PROTECTED_VM docs to make it clear they're a WIP (git-fixes).
  • KVM: x86: Use actual kvm_cpuid.base for clearing KVM_FEATURE_PV_UNHALT (git-fixes).
  • Move out-of-tree powerpc patch to the right section
  • Move the upstreamed BT fix patch to sorted section
  • Move the upstreamed BT patch into sorted section
  • Move upstreamed ACPI patch into sorted section
  • Move upstreamed HD-audio patch into sorted section
  • Move upstreamed USB fix into sorted section
  • Move upstreamed media patches into sorted section
  • Move upstreamed mm patches into sorted section
  • Move upstreamed patches into sorted section
  • Move upstreamed patches into sorted section
  • Move upstreamed patches into sorted section
  • Move upstreamed patches into sorted section
  • Move upstreamed powerpc patches into sorted section
  • Move upstreamed powerpc patches into sorted section
  • NFC: trf7970a: disable all regulators on removal (git-fixes).
  • NFS: Fix an off by one in root_nfs_cat() (git-fixes).
  • NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt (git-fixes).
  • NFS: Read unlock folio on nfs_page_create_from_folio() error (git-fixes).
  • NFSD: Convert the callback workqueue to use delayed_work (git-fixes).
  • NFSD: Fix nfsd_clid_class use of __string_len() macro (git-fixes).
  • NFSD: Reschedule CB operations when backchannel rpc_clnt is shut down (git-fixes).
  • NFSD: Reset cb_seq_status after NFS4ERR_DELAY (git-fixes).
  • NFSD: Retransmit callbacks after client reconnects (git-fixes).
  • NFSD: change LISTXATTRS cookie encoding to big-endian (git-fixes).
  • NFSD: fix LISTXATTRS returning a short list with eof=TRUE (git-fixes).
  • NFSD: fix LISTXATTRS returning more bytes than maxcount (git-fixes).
  • NFSD: fix nfsd4_listxattr_validate_cookie (git-fixes).
  • NFSv4.1/pnfs: fix NFS with TLS in pnfs (git-fixes).
  • NFSv4.2: fix listxattr maximum XDR buffer size (git-fixes).
  • NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (git-fixes).
  • Octeontx2-af: fix pause frame configuration in GMP mode (git-fixes).
  • PCI/AER: Block runtime suspend when handling errors (stable-fixes).
  • PCI/ASPM: Use RMW accessors for changing LNKCTL (git-fixes).
  • PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports (stable-fixes).
  • PCI/DPC: Use FIELD_GET() (stable-fixes).
  • PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 (git-fixes).
  • PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 (git-fixes).
  • PCI/PM: Drain runtime-idle callbacks before driver removal (stable-fixes).
  • PCI: Delay after FLR of Solidigm P44 Pro NVMe (stable-fixes).
  • PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge (stable-fixes).
  • PCI: Execute quirk_enable_clear_retrain_link() earlier (stable-fixes).
  • PCI: Fix typos in docs and comments (stable-fixes).
  • PCI: Make link retraining use RMW accessors for changing LNKCTL (git-fixes).
  • PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word() (stable-fixes).
  • PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host (git-fixes).
  • PCI: hv: Fix ring buffer size calculation (git-fixes).
  • PCI: qcom: Add support for sa8775p SoC (git-fixes).
  • PCI: qcom: Disable ASPM L0s for sc8280xp, sa8540p and sa8295p (git-fixes).
  • PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id (git-fixes).
  • PCI: rpaphp: Error out on busy status from get-sensor-state (bsc#1223369 ltc#205888).
  • PCI: switchtec: Add support for PCIe Gen5 devices (stable-fixes).
  • PCI: switchtec: Use normal comment style (stable-fixes).
  • PCI: tegra194: Fix probe path for Endpoint mode (git-fixes).
  • PM / devfreq: Synchronize devfreq_monitor_[start/stop] (stable-fixes).
  • PM: s2idle: Make sure CPUs will wakeup directly on resume (git-fixes).
  • Port 'certs: Add ECDSA signature verification self-test'.
  • Port 'certs: Move RSA self-test data to separate file'.
  • RAS/AMD/FMPM: Avoid NULL ptr deref in get_saved_records() (jsc#PED-7619).
  • RAS/AMD/FMPM: Fix build when debugfs is not enabled (jsc#PED-7619).
  • RAS/AMD/FMPM: Safely handle saved records of various sizes (jsc#PED-7619).
  • RDMA/IPoIB: Fix format truncation compilation errors (git-fixes)
  • RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes)
  • RDMA/cm: add timeout to cm_destroy_id wait (git-fixes)
  • RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw (git-fixes)
  • RDMA/hns: Add max_ah and cq moderation capacities in query_device() (git-fixes)
  • RDMA/hns: Fix GMV table pagesize (git-fixes)
  • RDMA/hns: Fix UAF for cq async event (git-fixes)
  • RDMA/hns: Fix deadlock on SRQ async events. (git-fixes)
  • RDMA/hns: Fix return value in hns_roce_map_mr_sg (git-fixes)
  • RDMA/hns: Modify the print level of CQE error (git-fixes)
  • RDMA/hns: Use complete parentheses in macros (git-fixes)
  • RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes).
  • RDMA/mlx5: Adding remote atomic access flag to updatable flags (git-fixes)
  • RDMA/mlx5: Change check for cacheable mkeys (git-fixes)
  • RDMA/mlx5: Fix port number for counter query in multi-port configuration (git-fixes)
  • RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent (git-fixes)
  • RDMA/rxe: Allow good work requests to be executed (git-fixes)
  • RDMA/rxe: Fix incorrect rxe_put in error path (git-fixes)
  • RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (git-fixes)
  • RDMA/rxe: Fix the problem 'mutex_destroy missing' (git-fixes)
  • README.BRANCH: Remove copy of branch name
  • Reapply 'drm/qxl: simplify qxl_fence_wait' (stable-fixes).
  • Refresh patches.suse/0002-PKCS-7-Check-codeSigning-EKU-for-kernel-module-and-k.patch (bsc#1222771). In preparation of enabling CONFIG_FIPS_SIGNATURE_SELFTEST, amend the missing 'usage' argument in the pkcs7_validate_trust() invocation from the PKCS#7 selftest.
  • Refresh patches.suse/ASoC-SOF-Intel-mtl-Implement-firmware-boot-state-che.patch.
  • Remove NTFSv3 from configs (bsc#1224429) References: bsc#1224429 comment#3 We only support fuse version of the NTFS-3g driver. Disable NTFSv3 from all configs. This was enabled in d016c04d731 ('Bump to 6.4 kernel (jsc#PED-4593)')
  • Rename patches.suse/Workaround-broken-chacha-crypto-fallback.patch to patches.suse/powerpc-crypto-chacha-p10-Fix-failure-on-non-Power10.patch.
  • Revert 'ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default' (stable-fixes).
  • Revert 'ASoC: SOF: Intel: hda-dai-ops: only allocate/release streams for first CPU DAI' (stable-fixes).
  • Revert 'ASoC: SOF: Intel: hda-dai-ops: reset device count for SoundWire DAIs' (stable-fixes).
  • Revert 'PCI/MSI: Provide IMS (Interrupt Message Store) support' (git-fixes).
  • Revert 'PCI/MSI: Provide pci_ims_alloc/free_irq()' (git-fixes).
  • Revert 'PCI/MSI: Provide stubs for IMS functions' (git-fixes).
  • Revert 'cifs: reconnect work should have reference on server struct' (git-fixes, bsc#1225172).
  • Revert 'drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()' (stable-fixes).
  • Revert 'drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR' (stable-fixes).
  • Revert 'drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices' (stable-fixes).
  • Revert 'drm/bridge: ti-sn65dsi83: Fix enable error path' (git-fixes).
  • Revert 'drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()' (stable-fixes).
  • Revert 'drm/qxl: simplify qxl_fence_wait' (git-fixes).
  • Revert 'iommu/amd: Enable PCI/IMS' (git-fixes).
  • Revert 'iommu/vt-d: Enable PCI/IMS' (git-fixes).
  • Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (git-fixes).
  • Revert 'net/mlx5e: Check the number of elements before walk TC rhashtable' (git-fixes).
  • Revert 'selinux: introduce an initial SID for early boot processes' (bsc#1208593) It caused a regression on ALP-current branch, kernel-obs-qa build failed.
  • Revert 'usb: cdc-wdm: close race between read and workqueue' (git-fixes).
  • Revert 'usb: phy: generic: Get the vbus supply' (git-fixes).
  • SEV: disable SEV-ES DebugSwap by default (git-fixes).
  • SUNRPC: fix a memleak in gss_import_v2_context (git-fixes).
  • SUNRPC: fix some memleaks in gssx_dec_option_array (git-fixes).
  • USB: UAS: return ENODEV when submit urbs fail with device not attached (stable-fixes).
  • USB: core: Add hub_get() and hub_put() routines (stable-fixes).
  • USB: core: Fix access violation during port device removal (git-fixes).
  • USB: core: Fix deadlock in port 'disable' sysfs attribute (stable-fixes).
  • USB: core: Fix deadlock in usb_deauthorize_interface() (git-fixes).
  • USB: serial: add device ID for VeriFone adapter (stable-fixes).
  • USB: serial: cp210x: add ID for MGP Instruments PDS100 (stable-fixes).
  • USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M (stable-fixes).
  • USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB (stable-fixes).
  • USB: serial: option: add Fibocom FM135-GL variants (stable-fixes).
  • USB: serial: option: add Lonsung U8300/U9300 product (stable-fixes).
  • USB: serial: option: add MeiG Smart SLM320 product (stable-fixes).
  • USB: serial: option: add Rolling RW101-GL and RW135-GL support (stable-fixes).
  • USB: serial: option: add Telit FN920C04 rmnet compositions (stable-fixes).
  • USB: serial: option: add support for Fibocom FM650/FG650 (stable-fixes).
  • USB: serial: option: support Quectel EM060K sub-models (stable-fixes).
  • Update patches.suse/Bluetooth-hci_sync-Don-t-double-print-name-in-add-re.patch (bsc#1216358). Added bugzilla reference
  • Update patches.suse/nvme-ensure-disabling-pairs-with-unquiesce.patch (jsc#PED-6252 jsc#PED-5728 jsc#PED-5062 jsc#PED-3535 bsc#1224534).
  • Update ath11k suspend patches from the latest subsystem tree (bsc#1207948).
  • Update config files. Disable N_GSM (jsc#PED-8240).
  • Update patches.suse/gpio-tegra186-Fix-tegra186_gpio_is_accessible-check.patch (git-fixes bsc#1223439)
  • Update patches.suse/powerpc-pseries-vas-Hold-mmap_mutex-after-mmap-lock-.patch (bsc#1012628 jsc#PED-542 git-fixes bsc#1213573 ltc#203238).
  • Update patches.suse/scsi-qedf-Don-t-process-stag-work-during-unload.patch (bsc#1214852)
  • Update patches.suse/scsi-qedf-Wait-for-stag-work-during-unload.patch (bsc#1214852)
  • VMCI: Fix an error handling path in vmci_guest_probe_device() (git-fixes).
  • VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (stable-fixes).
  • Workaround broken chacha crypto fallback (bsc#1218205).
  • accel/ivpu: Fix deadlock in context_xa (git-fixes).
  • admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET (git-fixes).
  • ahci: asm1064: asm1166: do not limit reported ports (git-fixes).
  • ahci: asm1064: correct count of reported ports (stable-fixes).
  • amd/amdkfd: sync all devices to wait all processes being evicted (stable-fixes).
  • amdkfd: use calloc instead of kzalloc to avoid integer overflow (stable-fixes).
  • arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H (git-fixes).
  • arm64/ptrace: Use saved floating point state type to determine SVE (git-fixes)
  • arm64/sve: Lower the maximum allocation for the SVE ptrace regset (git-fixes)
  • arm64: Add the arm64.no32bit_el0 command line option (jsc#PED-3184). Please note that some adjustments were needed since the upstream commit is based on kernel 6.9 which has idreg-override.c moved under arch/arm64/kernel/pi/.
  • arm64: bpf: fix 32bit unconditional bswap (git-fixes).
  • arm64: dts: Fix dtc interrupt_provider warnings (git-fixes)
  • arm64: dts: allwinner: Pine H64: correctly remove reg_gmac_3v3 (git-fixes)
  • arm64: dts: allwinner: h616: Fix I2C0 pins (git-fixes)
  • arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes)
  • arm64: dts: hi3798cv200: fix the size of GICR (git-fixes)
  • arm64: dts: imx8-ss-conn: fix usb lpcg indices (git-fixes)
  • arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order (git-fixes)
  • arm64: dts: imx8-ss-dma: fix adc lpcg indices (git-fixes)
  • arm64: dts: imx8-ss-dma: fix can lpcg indices (git-fixes)
  • arm64: dts: imx8-ss-dma: fix spi lpcg indices (git-fixes)
  • arm64: dts: imx8-ss-lsio: fix pwm lpcg indices (git-fixes)
  • arm64: dts: imx8qm-ss-dma: fix can lpcg indices (git-fixes)
  • arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes)
  • arm64: dts: microchip: sparx5: fix mdio reg (git-fixes)
  • arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)
  • arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)
  • arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro (git-fixes)
  • arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 (git-fixes)
  • arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for (git-fixes)
  • arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 (git-fixes)
  • arm64: dts: rockchip: fix rk3328 hdmi ports node (git-fixes)
  • arm64: dts: rockchip: fix rk3399 hdmi ports node (git-fixes)
  • arm64: dts: rockchip: regulator for sd needs to be always on for (git-fixes)
  • arm64: dts: rockchip: set PHY address of MT7531 switch to 0x1f (git-fixes)
  • arm64: hibernate: Fix level3 translation fault in swsusp_save() (git-fixes).
  • arm64: tegra: Correct Tegra132 I2C alias (git-fixes)
  • arm64: tegra: Set the correct PHY mode for MGBE (git-fixes)
  • arm_pmu: acpi: Add a representative platform device for TRBE (bsc#1220587)
  • arm_pmu: acpi: Refactor arm_spe_acpi_register_device() (bsc#1220587)
  • asm-generic: make sparse happy with odd-sized put_unaligned_*() (stable-fixes).
  • ata: libata-core: Allow command duration limits detection for ACS-4 drives (git-fixes).
  • ata: pata_legacy: make legacy_exit() work again (git-fixes).
  • ata: sata_gemini: Check clk_enable() result (stable-fixes).
  • ata: sata_mv: Fix PCI device ID table declaration compilation warning (git-fixes).
  • ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit (git-fixes).
  • autofs: use wake_up() instead of wake_up_interruptible(() (bsc#1224166).
  • ax25: Fix netdev refcount issue (git-fixes).
  • ax25: Fix reference count leak issue of net_device (git-fixes).
  • ax25: Fix reference count leak issues of ax25_dev (git-fixes).
  • ax25: fix use-after-free bugs caused by ax25_ds_del_timer (git-fixes).
  • batman-adv: Avoid infinite loop trying to resize local TT (git-fixes).
  • bitops: add missing prototype check (git-fixes).
  • blacklist.conf: workqueues: system-wide nr_active enforcement patchset; not worth the risk (bsc#1225580)
  • blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (bsc#1225605).
  • blk-cgroup: fix list corruption from resetting io stat (bsc#1225605).
  • block: fix q->blkg_list corruption during disk rebind (bsc#1223591).
  • bnx2x: Fix firmware version string character counts (git-fixes).
  • bnxt_en: Fix error recovery for RoCE ulp client (git-fixes).
  • bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() (git-fixes).
  • bnxt_en: Reset PTP tx_avail after possible firmware reset (git-fixes).
  • bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (git-fixes)
  • bootconfig: Fix the kerneldoc of _xbc_exit() (git-fixes).
  • bootconfig: use memblock_free_late to free xbc memory to buddy (git-fixes).
  • bootmem: use kmemleak_free_part_phys in free_bootmem_page (git-fixes).
  • bootmem: use kmemleak_free_part_phys in put_page_bootmem (git-fixes).
  • bpf, arm64: Fix incorrect runtime stats (git-fixes)
  • bpf, arm64: fix bug in BPF_LDX_MEMSX (git-fixes)
  • bpf, scripts: Correct GPL license name (git-fixes).
  • bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END (git-fixes).
  • bpf: fix precision backtracking instruction iteration (bsc#1225756).
  • bpf: handle ldimm64 properly in check_cfg() (bsc#1225756).
  • btrfs: add a helper to read the superblock metadata_uuid (git-fixes)
  • btrfs: add and use helper to check if block group is used (bsc#1220120).
  • btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (git-fixes)
  • btrfs: add new unused block groups to the list of unused block groups (bsc#1220120).
  • btrfs: allow to run delayed refs by bytes to be released instead of count (bsc#1220120).
  • btrfs: always clear PERTRANS metadata during commit (git-fixes)
  • btrfs: always print transaction aborted messages with an error level (git-fixes)
  • btrfs: always reserve space for delayed refs when starting transaction (bsc#1220120).
  • btrfs: assert correct lock is held at btrfs_select_ref_head() (bsc#1220120).
  • btrfs: assert delayed node locked when removing delayed item (git-fixes)
  • btrfs: avoid start and commit empty transaction when flushing qgroups (bsc#1220120).
  • btrfs: avoid start and commit empty transaction when starting qgroup rescan (bsc#1220120).
  • btrfs: avoid starting and committing empty transaction when flushing space (bsc#1220120).
  • btrfs: avoid starting new transaction when flushing delayed items and refs (bsc#1220120).
  • btrfs: check for BTRFS_FS_ERROR in pending ordered assert (git-fixes)
  • btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super (git-fixes)
  • btrfs: defrag: avoid unnecessary defrag caused by incorrect extent size (git-fixes)
  • btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args (git-fixes)
  • btrfs: do not allow non subvolume root targets for snapshot (git-fixes)
  • btrfs: do not arbitrarily slow down delalloc if we're committing (git-fixes)
  • btrfs: do not delete unused block group if it may be used soon (bsc#1220120).
  • btrfs: do not refill whole delayed refs block reserve when starting transaction (bsc#1220120).
  • btrfs: do not start transaction when joining with TRANS_JOIN_NOSTART (git-fixes)
  • btrfs: do not steal space from global rsv after a transaction abort (bsc#1220120).
  • btrfs: do not warn if discard range is not aligned to sector (git-fixes)
  • btrfs: ensure fiemap does not race with writes when FIEMAP_FLAG_SYNC is given (bsc#1223285).
  • btrfs: error out when COWing block using a stale transaction (git-fixes)
  • btrfs: error out when reallocating block for defrag using a stale transaction (git-fixes)
  • btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (git-fixes)
  • btrfs: fail priority metadata ticket with real fs error (bsc#1220120).
  • btrfs: file_remove_privs needs an exclusive lock in direct io write (git-fixes)
  • btrfs: fix 64bit compat send ioctl arguments not initializing version member (git-fixes)
  • btrfs: fix deadlock with fiemap and extent locking (bsc#1223285).
  • btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (git-fixes)
  • btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() (git-fixes)
  • btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)
  • btrfs: fix off-by-one chunk length calculation at contains_pending_extent() (git-fixes)
  • btrfs: fix off-by-one when checking chunk map includes logical address (git-fixes)
  • btrfs: fix race between ordered extent completion and fiemap (bsc#1223285).
  • btrfs: fix race when detecting delalloc ranges during fiemap (bsc#1223285).
  • btrfs: fix race when refilling delayed refs block reserve (git-fixes)
  • btrfs: fix start transaction qgroup rsv double free (git-fixes)
  • btrfs: fix stripe length calculation for non-zoned data chunk allocation (bsc#1217489).
  • btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range() (git-fixes) Dropped hunk in selftests (test_case_7), 92e1229b204d6.
  • btrfs: free qgroup rsv on io failure (git-fixes)
  • btrfs: free the allocated memory if btrfs_alloc_page_array() fails (git-fixes)
  • btrfs: get rid of label and goto at insert_delayed_ref() (bsc#1220120).
  • btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (git-fixes)
  • btrfs: handle errors properly in update_inline_extent_backref() (git-fixes)
  • btrfs: initialize key where it's used when running delayed data ref (bsc#1220120).
  • btrfs: log message if extent item not found when running delayed extent op (bsc#1220120).
  • btrfs: make btrfs_cleanup_fs_roots() static (bsc#1220120).
  • btrfs: make btrfs_destroy_delayed_refs() return void (bsc#1220120).
  • btrfs: make btrfs_destroy_marked_extents() return void (bsc#1220120).
  • btrfs: make btrfs_destroy_pinned_extent() return void (bsc#1220120).
  • btrfs: make error messages more clear when getting a chunk map (git-fixes)
  • btrfs: make find_first_extent_bit() return a boolean (bsc#1220120).
  • btrfs: make find_free_dev_extent() static (bsc#1220120).
  • btrfs: make insert_delayed_ref() return a bool instead of an int (bsc#1220120).
  • btrfs: merge find_free_dev_extent() and find_free_dev_extent_start() (bsc#1220120).
  • btrfs: move btrfs_free_excluded_extents() into block-group.c (bsc#1220120).
  • btrfs: open code trivial btrfs_add_excluded_extent() (bsc#1220120).
  • btrfs: output extra debug info if we failed to find an inline backref (git-fixes)
  • btrfs: pass a space_info argument to btrfs_reserve_metadata_bytes() (bsc#1220120).
  • btrfs: prevent transaction block reserve underflow when starting transaction (git-fixes)
  • btrfs: print available space across all block groups when dumping space info (bsc#1220120).
  • btrfs: print available space for a block group when dumping a space info (bsc#1220120).
  • btrfs: print block group super and delalloc bytes when dumping space info (bsc#1220120).
  • btrfs: print target number of bytes when dumping free space (bsc#1220120).
  • btrfs: qgroup: always free reserved space for extent records (bsc#1216196).
  • btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans (git-fixes)
  • btrfs: record delayed inode root in transaction (git-fixes)
  • btrfs: reject encoded write if inode has nodatasum flag set (git-fixes)
  • btrfs: release path before inode lookup during the ino lookup ioctl (git-fixes)
  • btrfs: remove pointless 'ref_root' variable from run_delayed_data_ref() (bsc#1220120).
  • btrfs: remove pointless in_tree field from struct btrfs_delayed_ref_node (bsc#1220120).
  • btrfs: remove pointless initialization at btrfs_delayed_refs_rsv_release() (bsc#1220120).
  • btrfs: remove redundant BUG_ON() from __btrfs_inc_extent_ref() (bsc#1220120).
  • btrfs: remove refs_to_add argument from __btrfs_inc_extent_ref() (bsc#1220120).
  • btrfs: remove refs_to_drop argument from __btrfs_free_extent() (bsc#1220120).
  • btrfs: remove the refcount warning/check at btrfs_put_delayed_ref() (bsc#1220120).
  • btrfs: remove unnecessary logic when running new delayed references (bsc#1220120).
  • btrfs: remove unnecessary prototype declarations at disk-io.c (bsc#1220120).
  • btrfs: remove unused is_head field from struct btrfs_delayed_ref_node (bsc#1220120).
  • btrfs: rename add_new_free_space() to btrfs_add_new_free_space() (bsc#1220120).
  • btrfs: reorder some members of struct btrfs_delayed_ref_head (bsc#1220120).
  • btrfs: reserve space for delayed refs on a per ref basis (bsc#1220120).
  • btrfs: reset destination buffer when read_extent_buffer() gets invalid range (git-fixes)
  • btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 (git-fixes)
  • btrfs: return -EUCLEAN if extent item is missing when searching inline backref (bsc#1220120).
  • btrfs: return real error when orphan cleanup fails due to a transaction abort (bsc#1220120).
  • btrfs: send: do not issue unnecessary zero writes for trailing hole (bsc#1222459).
  • btrfs: send: ensure send_fd is writable (git-fixes)
  • btrfs: send: handle path ref underflow in header iterate_inode_ref() (git-fixes)
  • btrfs: send: return EOPNOTSUPP on unknown flags (git-fixes)
  • btrfs: set page extent mapped after read_folio in relocate_one_page (git-fixes)
  • btrfs: simplify check for extent item overrun at lookup_inline_extent_backref() (bsc#1220120).
  • btrfs: stop doing excessive space reservation for csum deletion (bsc#1220120).
  • btrfs: store the error that turned the fs into error state (bsc#1220120).
  • btrfs: sysfs: validate scrub_speed_max value (git-fixes)
  • btrfs: tree-checker: fix inline ref size in error messages (git-fixes)
  • btrfs: update comment for btrfs_join_transaction_nostart() (bsc#1220120).
  • btrfs: update documentation for add_new_free_space() (bsc#1220120).
  • btrfs: use a bool to track qgroup record insertion when adding ref head (bsc#1220120).
  • btrfs: use a single switch statement when initializing delayed ref head (bsc#1220120).
  • btrfs: use a single variable for return value at lookup_inline_extent_backref() (bsc#1220120).
  • btrfs: use a single variable for return value at run_delayed_extent_op() (bsc#1220120).
  • btrfs: use bool type for delayed ref head fields that are used as booleans (bsc#1220120).
  • btrfs: use the correct superblock to compare fsid in btrfs_validate_super (git-fixes)
  • btrfs: use u64 for buffer sizes in the tree search ioctls (git-fixes)
  • btrfs: zoned: do not skip block groups with 100% zone unusable (bsc#1220120).
  • bus: mhi: ep: check the correct variable in mhi_ep_register_controller() (git-fixes).
  • ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE (bsc#1224866).
  • ceph: stop copying to iter at EOF on sync reads (bsc#1222606).
  • certs: Add ECDSA signature verification self-test (bsc#1222777).
  • certs: Move RSA self-test data to separate file (bsc#1222777).
  • cifs: Do not use certain unnecessary folio_*() functions (bsc#1225172).
  • cifs: account for primary channel in the interface list (bsc#1225172).
  • cifs: cifs_chan_is_iface_active should be called with chan_lock held (bsc#1225172).
  • cifs: distribute channels across interfaces based on speed (bsc#1225172).
  • cifs: do not pass cifs_sb when trying to add channels (bsc#1225172).
  • cifs: failure to add channel on iface should bump up weight (git-fixes, bsc#1225172).
  • cifs: fix charset issue in reconnection (bsc#1225172).
  • cifs: fix leak of iface for primary channel (git-fixes, bsc#1225172).
  • cifs: handle cases where a channel is closed (bsc#1225172).
  • cifs: handle cases where multiple sessions share connection (bsc#1225172).
  • cifs: reconnect work should have reference on server struct (bsc#1225172).
  • clk: Do not hold prepare_lock when calling kref_put() (stable-fixes).
  • clk: Get runtime PM before walking tree during disable_unused (git-fixes).
  • clk: Get runtime PM before walking tree for clk_summary (git-fixes).
  • clk: Initialize struct clk_core kref earlier (stable-fixes).
  • clk: Remove prepare_lock hold assertion in __clk_release() (git-fixes).
  • clk: Show active consumers of clocks in debugfs (stable-fixes).
  • clk: mediatek: Do a runtime PM get on controllers during probe (git-fixes).
  • clk: mediatek: mt8365-mm: fix DPI0 parent (git-fixes).
  • clk: mediatek: pllfh: Do not log error for missing fhctl node (git-fixes).
  • clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs (git-fixes).
  • clk: qcom: clk-alpha-pll: remove invalid Stromer register offset (git-fixes).
  • clk: qcom: dispcc-sm6350: fix DisplayPort clocks (git-fixes).
  • clk: qcom: dispcc-sm8450: fix DisplayPort clocks (git-fixes).
  • clk: qcom: dispcc-sm8550: fix DisplayPort clocks (git-fixes).
  • clk: qcom: mmcc-msm8998: fix venus clock issue (git-fixes).
  • clk: qcom: reset: Commonize the de/assert functions (stable-fixes).
  • clk: qcom: reset: Ensure write completion on reset de/assertion (git-fixes).
  • clk: renesas: r8a779a0: Fix CANFD parent clock (git-fixes).
  • clk: renesas: r9a07g043: Add clock and reset entry for PLIC (git-fixes).
  • clk: rs9: fix wrong default value for clock amplitude (git-fixes).
  • clk: samsung: exynosautov9: fix wrong pll clock id value (git-fixes).
  • clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (git-fixes).
  • clocksource/drivers/arm_global_timer: Fix maximum prescaler value (git-fixes).
  • clocksource/drivers/imx: Fix -Wunused-but-set-variable warning (git-fixes).
  • comedi: vmk80xx: fix incomplete endpoint checking (git-fixes).
  • coresight: trbe: Add a representative coresight_platform_data for (bsc#1220587)
  • coresight: trbe: Allocate platform data per device (bsc#1220587)
  • coresight: trbe: Enable ACPI based TRBE devices (bsc#1220587)
  • counter: linux/counter.h: fix Excess kernel-doc description warning (git-fixes).
  • cppc_cpufreq: Fix possible null pointer dereference (git-fixes).
  • cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations (git-fixes).
  • cpufreq: exit() callback is optional (git-fixes).
  • cpumask: Add for_each_cpu_from() (bsc#1225053).
  • crypto: bcm - Fix pointer arithmetic (git-fixes).
  • crypto: ccp - Add support for PCI device 0x156E (bsc#1223338).
  • crypto: ccp - Add support for PCI device 0x17E0 (bsc#1223338).
  • crypto: ccp - drop platform ifdef checks (git-fixes).
  • crypto: ecc - update ecc_gen_privkey for FIPS 186-5 (bsc#1222782).
  • crypto: ecdsa - Fix module auto-load on add-key (git-fixes).
  • crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init (git-fixes).
  • crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (git-fixes).
  • crypto: qat - fix ring to service map for dcc in 4xxx (git-fixes).
  • crypto: qat - improve error logging to be consistent across features (git-fixes).
  • crypto: qat - relocate and rename get_service_enabled() (stable-fixes).
  • crypto: qat - specify firmware files for 402xx (git-fixes).
  • crypto: rsa - add a check for allocation failure (bsc#1222775).
  • crypto: rsa - allow only odd e and restrict value in FIPS mode (bsc#1222775).
  • crypto: testmgr - remove unused xts4096 and xts512 algorithms from testmgr.c (bsc#1222769).
  • crypto: x86/nh-avx2 - add missing vzeroupper (git-fixes).
  • crypto: x86/sha256-avx2 - add missing vzeroupper (git-fixes).
  • crypto: x86/sha512-avx2 - add missing vzeroupper (git-fixes).
  • cxl/acpi: Fix load failures due to single window creation failure (git-fixes).
  • cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window (git-fixes).
  • cxl/trace: Properly initialize cxl_poison region name (git-fixes).
  • dax/bus.c: replace driver-core lock usage by a local rwsem (jsc#PED-5853).
  • dax/bus.c: replace several sprintf() with sysfs_emit() (jsc#PED-5853).
  • dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n (jsc#PED-5853).
  • device-dax: make dax_bus_type const (jsc#PED-5853).
  • dlm: fix user space lkb refcounting (git-fixes).
  • dm crypt: remove redundant state settings after waking up (jsc#PED-7542).
  • dm thin: add braces around conditional code that spans lines (jsc#PED-7542).
  • dm verity: set DM_TARGET_SINGLETON feature flag (jsc#PED-7542).
  • dm-integrity: set max_integrity_segments in dm_integrity_io_hints (jsc#PED-7542).
  • dm-multipath: dont't attempt SG_IO on non-SCSI-disks (bsc#1223575).
  • dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape (bsc#1219596) Also update diff context in patches.suse/dm-raid-fix-false-positive-for-requeue-needed-during-b25b.patch
  • dm-raid: add a new helper prepare_suspend() in md_personality (jsc#PED-7542).
  • dm-raid: really frozen sync_thread during suspend (jsc#PED-7542).
  • dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users (git-fixes).
  • dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list (jsc#PED-7542).
  • dma-buf/sw-sync: do not enable IRQ from sync_print_obj() (git-fixes).
  • dma-buf: Fix NULL pointer dereference in sanitycheck() (git-fixes).
  • dma-mapping: benchmark: fix node id validation (git-fixes).
  • dma-mapping: benchmark: handle NUMA_NO_NODE correctly (git-fixes).
  • dma: xilinx_dpdma: Fix locking (git-fixes).
  • dmaengine: axi-dmac: fix possible race in remove() (git-fixes).
  • dmaengine: idma64: Add check for dma_set_max_seg_size (git-fixes).
  • dmaengine: idxd: Avoid unnecessary destruction of file_ida (git-fixes).
  • dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (git-fixes).
  • dmaengine: owl: fix register access functions (git-fixes).
  • dmaengine: tegra186: Fix residual calculation (git-fixes).
  • docs: Restore 'smart quotes' for quotes (stable-fixes).
  • docs: kernel_include.py: Cope with docutils 0.21 (stable-fixes).
  • docs: netdev: Fix typo in Signed-off-by tag (git-fixes).
  • driver core: Introduce device_link_wait_removal() (stable-fixes).
  • drivers/nvme: Add quirks for device 126f:2262 (git-fixes).
  • drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() (stable-fixes).
  • drm/amd/display: Add dml2 copy functions (stable-fixes).
  • drm/amd/display: Allow dirty rects to be sent to dmub when abm is active (stable-fixes).
  • drm/amd/display: Atom Integrated System Info v2_2 for DCN35 (stable-fixes).
  • drm/amd/display: Change default size for dummy plane in DML2 (stable-fixes).
  • drm/amd/display: Do not recursively call manual trigger programming (stable-fixes).
  • drm/amd/display: Enable colorspace property for MST connectors (git-fixes).
  • drm/amd/display: Fix bounds check for dcn35 DcfClocks (git-fixes).
  • drm/amd/display: Fix division by zero in setup_dsc_config (stable-fixes).
  • drm/amd/display: Fix idle check for shared firmware state (stable-fixes).
  • drm/amd/display: Fix incorrect DSC instance for MST (stable-fixes).
  • drm/amd/display: Fix nanosec stat overflow (stable-fixes).
  • drm/amd/display: Fix noise issue on HDMI AV mute (stable-fixes).
  • drm/amd/display: Fix potential index out of bounds in color transformation function (git-fixes).
  • drm/amd/display: Handle Y carry-over in VCP X.Y calculation (stable-fixes).
  • drm/amd/display: Init DPPCLK from SMU on dcn32 (stable-fixes).
  • drm/amd/display: Override min required DCFCLK in dml1_validate (stable-fixes).
  • drm/amd/display: Prevent crash when disable stream (stable-fixes).
  • drm/amd/display: Program VSC SDP colorimetry for all DP sinks >= 1.4 (stable-fixes).
  • drm/amd/display: Remove MPC rate control logic from DCN30 and above (stable-fixes).
  • drm/amd/display: Remove redundant condition in dcn35_calc_blocks_to_gate() (git-fixes).
  • drm/amd/display: Return the correct HDCP error code (stable-fixes).
  • drm/amd/display: Send DTBCLK disable message on first commit (git-fixes).
  • drm/amd/display: Set DCN351 BB and IP the same as DCN35 (stable-fixes).
  • drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST (stable-fixes).
  • drm/amd/display: Update odm when ODM combine is changed on an otg master pipe with no plane (stable-fixes).
  • drm/amd/display: Use freesync when DRM_EDID_FEATURE_CONTINUOUS_FREQ found (stable-fixes).
  • drm/amd/display: fix disable otg wa logic in DCN316 (stable-fixes).
  • drm/amd/display: fix input states translation error for dcn35 & dcn351 (stable-fixes).
  • drm/amd/display: handle range offsets in VRR ranges (stable-fixes).
  • drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 (stable-fixes).
  • drm/amd/swsmu: modify the gfx activity scaling (stable-fixes).
  • drm/amd: Flush GFXOFF requests in prepare stage (git-fixes).
  • drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects' (git-fixes).
  • drm/amdgpu/pm: Check the validity of overdiver power limit (git-fixes).
  • drm/amdgpu/pm: Fix NULL pointer dereference when get power limit (git-fixes).
  • drm/amdgpu/pm: Fix the error of pwm1_enable setting (stable-fixes).
  • drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 (stable-fixes).
  • drm/amdgpu: Assign correct bits for SDMA HDP flush (stable-fixes).
  • drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series (stable-fixes).
  • drm/amdgpu: Fix VCN allocation in CPX partition (stable-fixes).
  • drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible (git-fixes).
  • drm/amdgpu: Fix leak when GPU memory allocation fails (stable-fixes).
  • drm/amdgpu: Refine IB schedule error logging (stable-fixes).
  • drm/amdgpu: Reset dGPU if suspend got aborted (stable-fixes).
  • drm/amdgpu: always force full reset for SOC21 (stable-fixes).
  • drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag (stable-fixes).
  • drm/amdgpu: drop setting buffer funcs in sdma442 (git-fixes).
  • drm/amdgpu: fix deadlock while reading mqd from debugfs (git-fixes).
  • drm/amdgpu: fix doorbell regression (git-fixes).
  • drm/amdgpu: fix incorrect number of active RBs for gfx11 (stable-fixes).
  • drm/amdgpu: fix mmhub client id out-of-bounds access (git-fixes).
  • drm/amdgpu: fix use-after-free bug (stable-fixes).
  • drm/amdgpu: fix visible VRAM handling during faults (git-fixes).
  • drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2 (stable-fixes).
  • drm/amdgpu: make damage clips support configurable (stable-fixes).
  • drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 (git-fixes).
  • drm/amdgpu: remove invalid resource->start check v2 (git-fixes).
  • drm/amdgpu: validate the parameters of bo mapping operations more clearly (git-fixes).
  • drm/amdkfd: Check cgroup when returning DMABuf info (stable-fixes).
  • drm/amdkfd: Fix memory leak in create_process failure (git-fixes).
  • drm/amdkfd: Reset GPU on queue preemption failure (stable-fixes).
  • drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (git-fixes).
  • drm/amdkfd: fix TLB flush after unmap for GFX9.4.2 (stable-fixes).
  • drm/amdkfd: range check cp bad op exception interrupts (stable-fixes).
  • drm/arm/malidp: fix a possible null pointer dereference (git-fixes).
  • drm/ast: Fix soft lockup (git-fixes).
  • drm/bridge: Fix improper bridge init order with pre_enable_prev_first (git-fixes).
  • drm/bridge: anx7625: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: anx7625: Update audio status while detecting (git-fixes).
  • drm/bridge: dpc3433: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: icn6211: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: lt8912b: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: lt9611: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: lt9611uxc: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: tc358775: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: tc358775: fix support for jeida-18 and jeida-24 (git-fixes).
  • drm/buddy: check range allocation matches alignment (stable-fixes).
  • drm/client: Fully protect modes[] with dev->mode_config.mutex (stable-fixes).
  • drm/connector: Add \n to message about demoting connector force-probes (git-fixes).
  • drm/display: fix typo (git-fixes).
  • drm/exynos: do not return negative values from .get_modes() (stable-fixes).
  • drm/fbdev-generic: Do not set physical framebuffer address (git-fixes).
  • drm/gma500: Remove lid code (git-fixes).
  • drm/i915/audio: Fix audio time stamp programming for DP (stable-fixes).
  • drm/i915/bios: Fix parsing backlight BDB data (git-fixes).
  • drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() (stable-fixes).
  • drm/i915/cdclk: Fix CDCLK programming order when pipes are active (git-fixes).
  • drm/i915/display: Use i915_gem_object_get_dma_address to get dma address (stable-fixes).
  • drm/i915/dp: Fix the computation for compressed_bpp for DISPLAY < 13 (git-fixes).
  • drm/i915/dp: Remove support for UHBR13.5 (git-fixes).
  • drm/i915/dpt: Make DPT object unshrinkable (git-fixes).
  • drm/i915/dsb: Fix DSB vblank waits when using VRR (git-fixes).
  • drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order, mostly (git-fixes).
  • drm/i915/gt: Automate CCS Mode setting during engine resets (git-fixes).
  • drm/i915/gt: Disable HW load balancing for CCS (git-fixes).
  • drm/i915/gt: Disarm breadcrumbs if engines are already idle (git-fixes).
  • drm/i915/gt: Do not generate the command streamer for all the CCS (git-fixes).
  • drm/i915/gt: Enable only one CCS for compute workload (git-fixes).
  • drm/i915/gt: Fix CCS id's calculation for CCS mode setting (git-fixes).
  • drm/i915/gt: Reset queue_priority_hint on parking (git-fixes).
  • drm/i915/guc: avoid FIELD_PREP warning (git-fixes).
  • drm/i915/hwmon: Fix locking inversion in sysfs getter (git-fixes).
  • drm/i915/lspcon: Separate function to set expected mode (bsc#1193599).
  • drm/i915/lspcon: Separate lspcon probe and lspcon init (bsc#1193599).
  • drm/i915/mst: Limit MST+DSC to TGL+ (git-fixes).
  • drm/i915/mst: Reject FEC+MST on ICL (git-fixes).
  • drm/i915/mtl: Update workaround 14018575942 (git-fixes).
  • drm/i915/vrr: Disable VRR when using bigjoiner (stable-fixes).
  • drm/i915/vrr: Generate VRR 'safe window' for DSB (git-fixes).
  • drm/i915: Disable port sync when bigjoiner is used (stable-fixes).
  • drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed() (git-fixes).
  • drm/i915: Fix audio component initialization (git-fixes).
  • drm/i915: Include the PLL name in the debug messages (stable-fixes).
  • drm/i915: Pre-populate the cursor physical dma address (git-fixes).
  • drm/i915: Replace a memset() with zero initialization (stable-fixes).
  • drm/i915: Stop printing pipe name as hex (stable-fixes).
  • drm/i915: Suppress old PLL pipe_mask checks for MG/TC/TBT PLLs (stable-fixes).
  • drm/i915: Try to preserve the current shared_dpll for fastset on type-c ports (stable-fixes).
  • drm/i915: Use named initializers for DPLL info (stable-fixes).
  • drm/imx/ipuv3: do not return negative values from .get_modes() (stable-fixes).
  • drm/lcdif: Do not disable clocks on already suspended hardware (git-fixes).
  • drm/mediatek: Add 0 size check to mtk_drm_gem_obj (git-fixes).
  • drm/mediatek: Init ddp_comp with devm_kcalloc() (git-fixes).
  • drm/mediatek: dp: Fix mtk_dp_aux_transfer return value (git-fixes).
  • drm/meson: dw-hdmi: add bandgap setting for g12 (git-fixes).
  • drm/meson: dw-hdmi: power up phy on device init (git-fixes).
  • drm/meson: gate px_clk when setting rate (git-fixes).
  • drm/meson: vclk: fix calculation of 59.94 fractional rates (git-fixes).
  • drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails (git-fixes).
  • drm/msm/adreno: fix CP cycles stat retrieval on a7xx (git-fixes).
  • drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected (git-fixes).
  • drm/msm/dp: allow voltage swing / pre emphasis of 3 (git-fixes).
  • drm/msm/dp: fix typo in dp_display_handle_port_status_changed() (git-fixes).
  • drm/msm/dpu: Add callback function pointer check before its call (git-fixes).
  • drm/msm/dpu: Allow configuring multiple active DSC blocks (git-fixes).
  • drm/msm/dpu: Always flush the slave INTF on the CTL (git-fixes).
  • drm/msm/dpu: do not allow overriding data from catalog (git-fixes).
  • drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more sensible (git-fixes).
  • drm/msm/dpu: use devres-managed allocation for MDP TOP (stable-fixes).
  • drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk (git-fixes).
  • drm/msm: Add newlines to some debug prints (git-fixes).
  • drm/nouveau/disp: Fix missing backlight control on Macbook 5, 1 (bsc#1223838).
  • drm/nouveau/dp: Do not probe eDP ports twice harder (stable-fixes).
  • drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer() (git-fixes).
  • drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor() (stable-fixes).
  • drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations (git-fixes).
  • drm/omapdrm: Fix console by implementing fb_dirty (git-fixes).
  • drm/panel: do not return negative error codes from drm_panel_get_modes() (stable-fixes).
  • drm/panel: ili9341: Respect deferred probe (git-fixes).
  • drm/panel: ili9341: Use predefined error codes (git-fixes).
  • drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W flags (git-fixes).
  • drm/panel: ltk050h3146w: drop duplicate commands from LTK050H3148W init (git-fixes).
  • drm/panel: novatek-nt35950: Do not log an error when DSI host can't be found (git-fixes).
  • drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector (git-fixes).
  • drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel (git-fixes).
  • drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel (git-fixes).
  • drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel (git-fixes).
  • drm/panel: visionox-rm69299: do not unregister DSI device (git-fixes).
  • drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() (git-fixes).
  • drm/panfrost: fix power transition timeout warnings (git-fixes).
  • drm/prime: Unbreak virtgpu dma-buf export (git-fixes).
  • drm/probe-helper: warn about negative .get_modes() (stable-fixes).
  • drm/qxl: remove unused count variable from qxl_surface_id_alloc() (git-fixes).
  • drm/qxl: remove unused variable from qxl_process_single_command() (git-fixes).
  • drm/radeon: make -fstrict-flex-arrays=3 happy (git-fixes).
  • drm/radeon: silence UBSAN warning (v3) (stable-fixes).
  • drm/rockchip: vop2: Do not divide height twice for YUV (git-fixes).
  • drm/rockchip: vop2: Remove AR30 and AB30 format support (git-fixes).
  • drm/sched: fix null-ptr-deref in init entity (git-fixes).
  • drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (git-fixes).
  • drm/ttm: return ENOSPC from ttm_bo_mem_space v3 (stable-fixes).
  • drm/ttm: stop pooling cached NUMA pages v2 (git-fixes).
  • drm/vc4: do not check if plane->state->fb == state->fb (stable-fixes).
  • drm/vc4: hdmi: do not return negative values from .get_modes() (stable-fixes).
  • drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (git-fixes).
  • drm/vmwgfx: Enable DMA mappings with SEV (git-fixes).
  • drm/vmwgfx: Fix Legacy Display Unit (git-fixes).
  • drm/vmwgfx: Fix crtc's atomic check conditional (git-fixes).
  • drm/vmwgfx: Fix invalid reads in fence signaled events (git-fixes).
  • drm/vmwgfx: Fix prime import/export (git-fixes).
  • drm/vmwgfx: Sort primary plane formats by order of preference (git-fixes).
  • drm: Check output polling initialized before disabling (stable-fixes).
  • drm: Check polling initialized before enabling in drm_helper_probe_single_connector_modes (stable-fixes).
  • drm: Fix drm_fixp2int_round() making it add 0.5 (git-fixes).
  • drm: add drm_gem_object_is_shared_for_memory_stats() helper (stable-fixes).
  • drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference (git-fixes).
  • drm: nv04: Fix out of bounds access (git-fixes).
  • drm: panel-orientation-quirks: Add quirk for GPD Win Mini (stable-fixes).
  • drm: vc4: Fix possible null pointer dereference (git-fixes).
  • drm: zynqmp_dpsub: Always register bridge (git-fixes).
  • dt-bindings: clock: qcom: Add missing UFS QREF clocks (git-fixes)
  • dump_stack: Do not get cpu_sync for panic CPU (bsc#1225607).
  • dyndbg: fix old BUG_ON in >control parser (stable-fixes).
  • e1000e: Minor flow correction in e1000_shutdown function (git-fixes).
  • e1000e: Workaround for sporadic MDI error on Meteor Lake systems (git-fixes).
  • e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue (git-fixes).
  • ecryptfs: Fix buffer size for tag 66 packet (git-fixes)
  • ecryptfs: Reject casefold directory inodes (git-fixes)
  • efi/unaccepted: do not let /proc/vmcore try to access unaccepted memory (git-fixes).
  • efi/unaccepted: touch soft lockup during memory accept (git-fixes).
  • efi: disable mirror feature during crashkernel (stable-fixes).
  • efi: fix panic in kdump kernel (git-fixes).
  • efi: libstub: only free priv.runtime_map when allocated (git-fixes).
  • extcon: max8997: select IRQ_DOMAIN instead of depending on it (git-fixes).
  • fast_dput(): handle underflows gracefully (git-fixes)
  • fat: fix uninitialized field in nostale filehandles (git-fixes)
  • fbdev: fix incorrect address computation in deferred IO (git-fixes).
  • fbdev: savage: Handle err return when savagefb_check_var failed (git-fixes).
  • fbdev: sh7760fb: allow modular build (git-fixes).
  • fbdev: shmobile: fix snprintf truncation (git-fixes).
  • fbdev: sisfb: hide unused variables (git-fixes).
  • fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 (stable-fixes).
  • fbmon: prevent division by zero in fb_videomode_from_videomode() (stable-fixes).
  • firewire: core: use long bus reset on gap count error (stable-fixes).
  • firewire: ohci: mask bus reset interrupts between ISR and bottom half (stable-fixes).
  • firmware: arm_scmi: Make raw debugfs entries non-seekable (git-fixes).
  • firmware: dmi-id: add a release callback function (git-fixes).
  • firmware: raspberrypi: Use correct device for DMA mappings (git-fixes).
  • firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename() (stable-fixes).
  • fs/9p: only translate RWX permissions for plain 9P2000 (git-fixes)
  • fs/9p: translate O_TRUNC into OTRUNC (git-fixes)
  • fs: Fix error checking for d_hash_and_lookup() (git-fixes)
  • fs: indicate request originates from old mount API (git-fixes)
  • fs: relax mount_setattr() permission checks (git-fixes)
  • fsverity: skip PKCS#7 parser when keyring is empty (git-fixes)
  • ftrace: Fix possible use-after-free issue in ftrace_location() (git-fixes).
  • fuse: do not unhash root (bsc#1223946).
  • fuse: fix root lookup with nonzero generation (bsc#1223945).
  • geneve: fix header validation in geneve[6]_xmit_skb (git-fixes).
  • geneve: make sure to pull inner header in geneve_rx() (git-fixes).
  • gpio: cdev: check for NULL labels when sanitizing them for irqs (git-fixes).
  • gpio: cdev: fix missed label sanitizing in debounce_setup() (git-fixes).
  • gpio: cdev: sanitize the label before requesting the interrupt (stable-fixes).
  • gpio: crystalcove: Use -ENOTSUPP consistently (stable-fixes).
  • gpio: tangier: Use correct type for the IRQ chip data (git-fixes).
  • gpio: tegra186: Fix tegra186_gpio_is_accessible() check (git-fixes).
  • gpio: wcove: Use -ENOTSUPP consistently (stable-fixes).
  • gpiolib: cdev: fix uninitialised kfifo (git-fixes).
  • gpiolib: cdev: relocate debounce_period_us from struct gpio_desc (stable-fixes).
  • gpiolib: swnode: Remove wrong header inclusion (git-fixes).
  • gpu: host1x: Do not setup DMA for virtual devices (stable-fixes).
  • gtp: fix use-after-free and null-ptr-deref in gtp_newlink() (git-fixes).
  • hwmon: (amc6821) add of_match table (stable-fixes).
  • hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock (git-fixes).
  • hwmon: (corsair-cpro) Use a separate buffer for sending commands (git-fixes).
  • hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() (git-fixes).
  • hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor (git-fixes).
  • hwmon: (lm70) fix links in doc and comments (git-fixes).
  • hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us (git-fixes).
  • hwmon: (shtc1) Fix property misspelling (git-fixes).
  • hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init() (git-fixes).
  • i2c: cadence: Avoid fifo clear after start (git-fixes).
  • i2c: pxa: hide unused icr_bits[] variable (git-fixes).
  • i2c: smbus: fix NULL function pointer dereference (git-fixes).
  • i2c: synquacer: Fix an error handling path in synquacer_i2c_probe() (git-fixes).
  • i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame (git-fixes).
  • i3c: master: svc: fix invalidate IBI type and miss call client IBI handler (git-fixes).
  • i40e: Enforce software interrupt during busy-poll exit (git-fixes).
  • i40e: Fix VF MAC filter removal (git-fixes).
  • i40e: Fix firmware version comparison function (git-fixes).
  • i40e: disable NAPI right after disabling irqs when handling xsk_pool (git-fixes).
  • i40e: fix i40e_count_filters() to count only active/new filters (git-fixes).
  • i40e: fix vf may be used uninitialized in this function warning (git-fixes).
  • i915: make inject_virtual_interrupt() void (stable-fixes).
  • ice: Refactor FW data type and fix bitmap casting issue (git-fixes).
  • ice: fix enabling RX VLAN filtering (git-fixes).
  • ice: fix memory corruption bug with suspend and rebuild (git-fixes).
  • ice: fix stats being updated by way too large values (git-fixes).
  • ice: fix typo in assignment (git-fixes).
  • ice: fix uninitialized dplls mutex usage (git-fixes).
  • ice: reconfig host after changing MSI-X on VF (git-fixes).
  • ice: reorder disabling IRQ and NAPI in ice_qp_dis (git-fixes).
  • ice: use relative VSI index for VFs instead of PF VSI number (git-fixes).
  • ice: virtchnl: stop pretending to support RSS over AQ or registers (git-fixes).
  • ida: make 'ida_dump' static (git-fixes).
  • idma64: Do not try to serve interrupts when device is powered off (git-fixes).
  • idpf: disable local BH when scheduling napi for marker packets (git-fixes).
  • idpf: extend tx watchdog timeout (bsc#1224137).
  • idpf: fix kernel panic on unknown packet types (git-fixes).
  • igb: Fix missing time sync events (git-fixes).
  • igb: extend PTP timestamp adjustments to i211 (git-fixes).
  • igc: Fix missing time sync events (git-fixes).
  • igc: Remove stale comment about Tx timestamping (git-fixes).
  • igc: avoid returning frame twice in XDP_REDIRECT (git-fixes).
  • iio: accel: mxc4005: Interrupt handling fixes (git-fixes).
  • iio: adc: stm32: Fixing err code to not indicate success (git-fixes).
  • iio: core: Leave private pointer NULL when no private data supplied (git-fixes).
  • iio: dummy_evgen: remove Excess kernel-doc comments (git-fixes).
  • iio: gts-helper: Fix division loop (git-fixes).
  • iio: pressure: Fixes BME280 SPI driver data (git-fixes).
  • iio: pressure: dps310: support negative temperature values (git-fixes).
  • iio:imu: adis16475: Fix sync mode setting (git-fixes).
  • inet: frags: eliminate kernel-doc warning (git-fixes).
  • inet_diag: annotate data-races around inet_diag_table[] (git-fixes).
  • init/main.c: Fix potential static_command_line memory overflow (git-fixes).
  • init: open /initrd.image with O_LARGEFILE (stable-fixes).
  • input/touchscreen: imagis: Correct the maximum touch area value (stable-fixes).
  • intel: legacy: Partial revert of field get conversion (git-fixes).
  • interconnect: qcom: osm-l3: Replace custom implementation of COUNT_ARGS() (git-fixes).
  • interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment (git-fixes).
  • interconnect: qcom: sc8180x: Mark CO0 BCM keepalive (git-fixes).
  • interconnect: qcom: sm8550: Enable sync_state (git-fixes).
  • io_uring: kabi cookie remove (bsc#1217384).
  • iomap: clear the per-folio dirty bits on all writeback failures (git-fixes)
  • iommu/arm-smmu-v3: Check that the RID domain is S1 in SVA (git-fixes).
  • iommu/dma: Force swiotlb_max_mapping_size on an untrusted device (bsc#1224331)
  • iommu/dma: Trace bounce buffer usage when mapping buffers (git-fixes).
  • iommu/vt-d: Allocate local memory for page request queue (git-fixes).
  • iommu/vt-d: Fix wrong use of pasid config (git-fixes).
  • iommu/vt-d: Set SSADE when attaching to a parent with dirty tracking (git-fixes).
  • iommu: Map reserved memory as cacheable if device is coherent (git-fixes).
  • iommufd/iova_bitmap: Bounds check mapped::pages access (git-fixes).
  • iommufd/iova_bitmap: Consider page offset for the pages to be pinned (git-fixes).
  • iommufd/iova_bitmap: Switch iova_bitmap::bitmap to an u8 array (git-fixes).
  • iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest (git-fixes).
  • iommufd: Fix iopt_access_list_id overwrite bug (git-fixes).
  • iommufd: Reject non-zero data_type if no data_len is provided (git-fixes).
  • ionic: set adminq irq affinity (git-fixes).
  • ipv4: annotate data-races around fi->fib_dead (git-fixes).
  • irqchip/alpine-msi: Fix off-by-one in allocation error path (git-fixes).
  • irqchip/armada-370-xp: Suppress unused-function warning (git-fixes).
  • irqchip/gic-v3-its: Do not assume vPE tables are preallocated (git-fixes).
  • irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 (git-fixes).
  • irqchip/gic-v3-its: Prevent double free on error (git-fixes).
  • irqchip/loongson-pch-msi: Fix off-by-one on allocation error path (git-fixes).
  • irqchip/mbigen: Do not use bus_get_dev_root() to find the parent (git-fixes).
  • irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based on register's index (stable-fixes).
  • irqchip/renesas-rzg2l: Flush posted write in irq_eoi() (git-fixes).
  • irqchip/renesas-rzg2l: Implement restriction when writing ISCR register (stable-fixes).
  • irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type (git-fixes).
  • irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi() (stable-fixes).
  • irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi() (stable-fixes).
  • ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() (git-fixes).
  • ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able (git-fixes).
  • jffs2: prevent xattr node from overflowing the eraseblock (git-fixes).
  • kABI fix of KVM: x86/pmu: Allow programming events that match unsupported arch events (bsc#1225696).
  • kABI fix of KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible (git-fixes).
  • kABI workaround for cs35l56 (git-fixes).
  • kABI workaround for of driver changes (git-fixes).
  • kABI: Adjust trace_iterator.wait_index (git-fixes).
  • kabi fix of perf/x86/intel: Expose existence of callback support to KVM (git fixes).
  • kabi/severities: Remove mitigation-related symbols Those are used by the core kernel to implement CPU vulnerabilities mitigation and are not expected to be consumed by 3rd party users.
  • kabi/severities: ignore IMS functions They were dropped in previous patches. Noone is supposed to use them.
  • kabi/severities: ignore TAS2781 symbol drop, it's only locally used
  • kabi/severities: ignore Wangxun ethernet driver local symbols
  • kabi/severities: ignore brcmfmac-specific local symbols
  • kasan, fortify: properly rename memintrinsics (git-fixes).
  • kasan/test: avoid gcc warning for intentional overflow (git-fixes).
  • kasan: disable kasan_non_canonical_hook() for HW tags (git-fixes).
  • kasan: print the original fault addr when access invalid shadow (git-fixes).
  • kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 (stable-fixes).
  • kconfig: fix infinite loop when expanding a macro at the end of file (git-fixes).
  • kexec: do syscore_shutdown() in kernel_kexec (git-fixes).
  • kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).
  • kselftest: Add a ksft_perror() helper (stable-fixes).
  • kunit/fortify: Fix mismatched kvalloc()/vfree() usage (git-fixes).
  • leds: pwm: Disable PWM when going to suspend (git-fixes).
  • lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (git-fixes).
  • libnvdimm: Fix ACPI_NFIT in BLK_DEV_PMEM help (jsc#PED-5853).
  • libperf evlist: Avoid out-of-bounds access (git-fixes).
  • libsubcmd: Fix parse-options memory leak (git-fixes).
  • livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).
  • locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock (git-fixes)
  • lsm: fix the logic in security_inode_getsecctx() (git-fixes).
  • mac802154: fix llsec key resources release in mac802154_llsec_key_del (git-fixes).
  • maple_tree: fix mas_empty_area_rev() null pointer dereference (git-fixes).
  • md/dm-raid: do not call md_reap_sync_thread() directly (jsc#PED-7542).
  • md/raid1-10: add a helper raid1_check_read_range() (jsc#PED-7542).
  • md/raid1-10: factor out a new helper raid1_should_read_first() (jsc#PED-7542).
  • md/raid1: factor out choose_bb_rdev() from read_balance() (jsc#PED-7542).
  • md/raid1: factor out choose_slow_rdev() from read_balance() (jsc#PED-7542).
  • md/raid1: factor out helpers to add rdev to conf (jsc#PED-7542).
  • md/raid1: factor out helpers to choose the best rdev from read_balance() (jsc#PED-7542).
  • md/raid1: factor out read_first_rdev() from read_balance() (jsc#PED-7542).
  • md/raid1: factor out the code to manage sequential IO (jsc#PED-7542).
  • md/raid1: fix choose next idle in read_balance() (jsc#PED-7542).
  • md/raid1: record nonrot rdevs while adding/removing rdevs to conf (jsc#PED-7542).
  • md: Do not clear MD_CLOSING when the raid is about to stop (jsc#PED-7542).
  • md: add a new helper rdev_has_badblock() (jsc#PED-7542).
  • md: add a new helper reshape_interrupted() (jsc#PED-7542).
  • md: changed the switch of RAID_VERSION to if (jsc#PED-7542).
  • md: check mddev->pers before calling md_set_readonly() (jsc#PED-7542).
  • md: clean up invalid BUG_ON in md_ioctl (jsc#PED-7542).
  • md: clean up openers check in do_md_stop() and md_set_readonly() (jsc#PED-7542).
  • md: do not clear MD_RECOVERY_FROZEN for new dm-raid until resume (jsc#PED-7542).
  • md: export helper md_is_rdwr() (jsc#PED-7542).
  • md: export helpers to stop sync_thread (jsc#PED-7542).
  • md: factor out a helper to sync mddev (jsc#PED-7542).
  • md: fix kmemleak of rdev->serial (jsc#PED-7542).
  • md: get rdev->mddev with READ_ONCE() (jsc#PED-7542).
  • md: merge the check of capabilities into md_ioctl_valid() (jsc#PED-7542).
  • md: preserve KABI in struct md_personality (jsc#PED-7542).
  • md: remove redundant check of 'mddev->sync_thread' (jsc#PED-7542).
  • md: remove redundant md_wakeup_thread() (jsc#PED-7542).
  • md: return directly before setting did_set_md_closing (jsc#PED-7542).
  • md: sync blockdev before stopping raid or setting readonly (jsc#PED-7542).
  • md: use RCU lock to protect traversal in md_spares_need_change() (jsc#PED-7542).
  • media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries (git-fixes).
  • media: cadence: csi2rx: use match fwnode for media link (git-fixes).
  • media: cec: core: remove length check of Timer Status (stable-fixes).
  • media: dt-bindings: ovti,ov2680: Fix the power supply names (git-fixes).
  • media: flexcop-usb: fix sanity check of bNumEndpoints (git-fixes).
  • media: i2c: et8ek8: Do not strip remove function when driver is builtin (git-fixes).
  • media: ipu3-cio2: Request IRQ earlier (git-fixes).
  • media: mc: Fix flags handling when creating pad links (stable-fixes).
  • media: mc: Fix graph walk in media_pipeline_start (git-fixes).
  • media: mc: Rename pad variable to clarify intent (stable-fixes).
  • media: mc: mark the media devnode as registered from the, start (git-fixes).
  • media: ngene: Add dvb_ca_en50221_init return value check (git-fixes).
  • media: rcar-vin: work around -Wenum-compare-conditional warning (git-fixes).
  • media: rkisp1: Fix IRQ handling due to shared interrupts (stable-fixes).
  • media: sta2x11: fix irq handler cast (stable-fixes).
  • media: stk1160: fix bounds checking in stk1160_copy_video() (git-fixes).
  • media: sunxi: a83-mips-csi2: also select GENERIC_PHY (git-fixes).
  • media: uvcvideo: Add quirk for Logitech Rally Bar (git-fixes).
  • media: v4l2-subdev: Fix stream handling for crop API (git-fixes).
  • media: v4l: Do not turn on privacy LED if streamon fails (git-fixes).
  • mei: me: add arrow lake point H DID (stable-fixes).
  • mei: me: add arrow lake point S DID (stable-fixes).
  • mei: me: add lunar lake point M DID (stable-fixes).
  • mei: me: disable RPL-S on SPS and IGN firmwares (git-fixes).
  • mlxbf_gige: call request_irq() after NAPI initialized (git-fixes).
  • mlxbf_gige: stop PHY during open() error paths (git-fixes).
  • mlxbf_gige: stop interface during shutdown (git-fixes).
  • mlxsw: Use refcount_t for reference counting (git-fixes).
  • mm,page_owner: Defer enablement of static branch (bsc#1222366).
  • mm,page_owner: Fix accounting of pages when migrating (bsc#1222366).
  • mm,page_owner: Fix printing of stack records (bsc#1222366).
  • mm,page_owner: Fix refcount imbalance (bsc#1222366).
  • mm,page_owner: Update metadata for tail pages (bsc#1222366).
  • mm,page_owner: check for null stack_record before bumping its refcount (bsc#1222366).
  • mm,page_owner: drop unnecessary check (bsc#1222366).
  • mm,page_owner: fix recursion (bsc#1222366).
  • mm/slab: make __free(kfree) accept error pointers (git-fixes).
  • mm: memcg: do not periodically flush stats when memcg is disabled (bsc#1222525).
  • mm: memcg: use larger batches for proactive reclaim (bsc#1222522).
  • mm: page_owner: fix wrong information in dump_page_owner (git-fixes).
  • mm_init kABI workaround (git-fixes).
  • mmc: core: Add HS400 tuning in HS400es initialization (stable-fixes).
  • mmc: core: Avoid negative index with array access (git-fixes).
  • mmc: core: Initialize mmc_blk_ioc_data (git-fixes).
  • mmc: davinci: Do not strip remove function when driver is builtin (git-fixes).
  • mmc: omap: fix broken slot switch lookup (git-fixes).
  • mmc: omap: fix deferred probe (git-fixes).
  • mmc: omap: restore original power up/down steps (git-fixes).
  • mmc: sdhci-msm: pervent access to suspended controller (git-fixes).
  • mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc HS200 mode (git-fixes).
  • mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock (git-fixes).
  • mmc: sdhci_am654: Add OTAP/ITAP delay enable (git-fixes).
  • mmc: sdhci_am654: Add tuning algorithm for delay chain (git-fixes).
  • mmc: sdhci_am654: Fix ITAPDLY for HS400 timing (git-fixes).
  • mmc: sdhci_am654: Write ITAPDLY for DDR52 timing (git-fixes).
  • modpost: Add '.ltext' and '.ltext.*' to TEXT_SECTIONS (stable-fixes).
  • mptcp: Remove unnecessary test for __mptcp_init_sock() (git-fixes).
  • mptcp: annotate data-races around msk->rmem_fwd_alloc (git-fixes).
  • mptcp: fix bogus receive window shrinkage with multiple subflows (git-fixes).
  • mptcp: move __mptcp_error_report in protocol.c (git-fixes).
  • mptcp: process pending subflow error on close (git-fixes).
  • mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() (git-fixes).
  • mtd: diskonchip: work around ubsan link failure (stable-fixes).
  • mtd: rawnand: hynix: fixed typo (git-fixes).
  • mtd: spinand: Add support for 5-byte IDs (stable-fixes).
  • net/mlx5: Correctly compare pkt reformat ids (git-fixes).
  • net/mlx5: E-switch, Change flow rule destination checking (git-fixes).
  • net/mlx5: E-switch, store eswitch pointer before registering devlink_param (git-fixes).
  • net/mlx5: Fix fw reporter diagnose output (git-fixes).
  • net/mlx5: Fix peer devlink set for SF representor devlink port (git-fixes).
  • net/mlx5: Lag, restore buckets number to default after hash LAG deactivation (git-fixes).
  • net/mlx5: Properly link new fs rules into the tree (git-fixes).
  • net/mlx5: Register devlink first under devlink lock (git-fixes).
  • net/mlx5: Restore mistakenly dropped parts in register devlink flow (git-fixes).
  • net/mlx5: SF, Stop waiting for FW as teardown was called (git-fixes).
  • net/mlx5: offset comp irq index in name by one (git-fixes).
  • net/mlx5e: Change the warning when ignore_flow_level is not supported (git-fixes).
  • net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit (git-fixes).
  • net/mlx5e: Fix mlx5e_priv_init() cleanup flow (git-fixes).
  • net/mlx5e: HTB, Fix inconsistencies with QoS SQs number (git-fixes).
  • net/mlx5e: RSS, Block XOR hash with over 128 channels (git-fixes).
  • net/mlx5e: RSS, Block changing channels number when RXFH is configured (git-fixes).
  • net/mlx5e: Switch to using _bh variant of of spinlock API in port timestamping NAPI poll context (git-fixes).
  • net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (git-fixes).
  • net/smc: bugfix for smcr v2 server connect success statistic (git-fixes).
  • net/smc: fix documentation of buffer sizes (git-fixes).
  • net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add (git-fixes).
  • net/x25: fix incorrect parameter validation in the x25_getsockopt() function (git-fixes).
  • net: NSH: fix kernel-doc notation warning (git-fixes).
  • net: Use sockaddr_storage for getsockopt(SO_PEERNAME) (git-fixes).
  • net: add netdev_lockdep_set_classes() to virtual drivers (git-fixes).
  • net: annotate data-races around sk->sk_bind_phc (git-fixes).
  • net: annotate data-races around sk->sk_forward_alloc (git-fixes).
  • net: annotate data-races around sk->sk_lingertime (git-fixes).
  • net: annotate data-races around sk->sk_tsflags (git-fixes).
  • net: bonding: remove kernel-doc comment marker (git-fixes).
  • net: cfg802154: fix kernel-doc notation warnings (git-fixes).
  • net: dsa: microchip: fix register write order in ksz8_ind_write8() (git-fixes).
  • net: dsa: mt7530: fix handling of all link-local frames (git-fixes).
  • net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports (git-fixes).
  • net: dsa: mt7530: prevent possible incorrect XTAL frequency selection (git-fixes).
  • net: dsa: mt7530: trap link-local frames regardless of ST Port State (git-fixes).
  • net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45() (git-fixes).
  • net: ena: Fix incorrect descriptor free behavior (git-fixes).
  • net: ena: Fix potential sign extension issue (git-fixes).
  • net: ena: Move XDP code to its new files (git-fixes).
  • net: ena: Pass ena_adapter instead of net_device to ena_xmit_common() (git-fixes).
  • net: ena: Remove ena_select_queue (git-fixes).
  • net: ena: Set tx_info->xdpf value to NULL (git-fixes).
  • net: ena: Use tx_ring instead of xdp_ring for XDP channel TX (git-fixes).
  • net: ena: Wrong missing IO completions check order (git-fixes).
  • net: ethernet: mtk_eth_soc: fix PPE hanging issue (git-fixes).
  • net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio (git-fixes).
  • net: fec: Set mac_managed_pm during probe (git-fixes).
  • net: hns3: fix index limit to support all queue stats (git-fixes).
  • net: hns3: fix kernel crash when 1588 is received on HIP08 devices (git-fixes).
  • net: hns3: fix kernel crash when devlink reload during pf initialization (git-fixes).
  • net: hns3: fix port duplex configure error in IMP reset (git-fixes).
  • net: hns3: fix wrong judgment condition issue (git-fixes).
  • net: hns3: mark unexcuted loopback test result as UNEXECUTED (git-fixes).
  • net: hns3: tracing: fix hclgevf trace event strings (git-fixes).
  • net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (git-fixes).
  • net: ks8851: Handle softirqs at the end of IRQ thread to fix hang (git-fixes).
  • net: ks8851: Inline ks8851_rx_skb() (git-fixes).
  • net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs (git-fixes).
  • net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips (git-fixes).
  • net: libwx: fix memory leak on free page (git-fixes).
  • net: ll_temac: platform_get_resource replaced by wrong function (git-fixes).
  • net: llc: fix kernel-doc notation warnings (git-fixes).
  • net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes).
  • net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up (git-fixes).
  • net: nfc: remove inappropriate attrs check (stable-fixes).
  • net: pcs: xpcs: Return EINVAL in the internal methods (git-fixes).
  • net: phy: fix phy_read_poll_timeout argument type in genphy_loopback (git-fixes).
  • net: phy: micrel: Fix potential null pointer dereference (git-fixes).
  • net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping (git-fixes).
  • net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061 (git-fixes).
  • net: phy: phy_device: Prevent nullptr exceptions on ISR (git-fixes).
  • net: phy: phy_device: Prevent nullptr exceptions on ISR (stable-fixes).
  • net: ravb: Always process TX descriptor ring (git-fixes).
  • net: ravb: Let IP-specific receive function to interrogate descriptors (git-fixes).
  • net: smsc95xx: add support for SYS TEC USB-SPEmodule1 (git-fixes).
  • net: sparx5: Fix use after free inside sparx5_del_mact_entry (git-fixes).
  • net: sparx5: fix wrong config being used when reconfiguring PCS (git-fixes).
  • net: sparx5: flower: fix fragment flags handling (git-fixes).
  • net: stmmac: Fix incorrect dereference in interrupt handlers (git-fixes).
  • net: stmmac: dwmac-starfive: Add support for JH7100 SoC (git-fixes).
  • net: stmmac: fix rx queue priority assignment (git-fixes).
  • net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() (git-fixes).
  • net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes).
  • net: tls, fix WARNIING in __sk_msg_free (bsc#1221858).
  • net: tls: fix returned read length with async decrypt (bsc#1221858).
  • net: tls: fix use-after-free with partial reads and async (bsc#1221858).
  • net: usb: ax88179_178a: avoid the interface always configured as random address (git-fixes).
  • net: usb: ax88179_178a: avoid writing the mac address before first reading (git-fixes).
  • net: usb: ax88179_178a: fix link status when link is set to down/up (git-fixes).
  • net: usb: ax88179_178a: stop lying about skb->truesize (git-fixes).
  • net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM (git-fixes).
  • net: usb: smsc95xx: stop lying about skb->truesize (git-fixes).
  • net: usb: sr9700: stop lying about skb->truesize (git-fixes).
  • net: veth: do not manipulate GRO when using XDP (git-fixes).
  • net: wwan: t7xx: Split 64bit accesses to fix alignment issues (git-fixes).
  • net:usb:qmi_wwan: support Rolling modules (stable-fixes).
  • netfilter: nf_tables: disable toggling dormant table state more than once (git-fixes).
  • netfilter: nf_tables: uapi: Describe NFTA_RULE_CHAIN_ID (git-fixes).
  • netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes).
  • netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention (git-fixes).
  • nf_conntrack: fix -Wunused-const-variable= (git-fixes).
  • nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() (git-fixes).
  • nfc: nci: Fix kcov check in nci_rx_work() (git-fixes).
  • nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet (git-fixes).
  • nfc: nci: Fix uninit-value in nci_rx_work (git-fixes).
  • nfp: flower: handle acti_netdevs allocation failure (git-fixes).
  • nfs: fix panic when nfs4_ff_layout_prepare_ds() fails (git-fixes).
  • nfsd: Fix a regression in nfsd_setattr() (git-fixes).
  • nfsd: do not call locks_release_private() twice concurrently (git-fixes).
  • nfsd: use __fput_sync() to avoid delayed closing of files (bsc#1223380 bsc#1217408).
  • nilfs2: fix OOB in nilfs_set_de_type (git-fixes).
  • nilfs2: fix out-of-range warning (git-fixes).
  • nilfs2: fix potential bug in end_buffer_async_write (git-fixes).
  • nilfs2: fix unexpected freezing of nilfs_segctor_sync() (git-fixes).
  • nilfs2: fix use-after-free of timer for log writer thread (git-fixes).
  • nilfs2: make superblock data array index computation sparse friendly (git-fixes).
  • nouveau/dmem: handle kcalloc() allocation failure (git-fixes).
  • nouveau/gsp: do not check devinit disable on GSP (git-fixes).
  • nouveau/uvmm: fix addr/range calcs for remap operations (git-fixes).
  • nouveau: fix devinit paths to only handle display on GSP (git-fixes).
  • nouveau: fix function cast warning (git-fixes).
  • nouveau: fix instmem race condition around ptr stores (git-fixes).
  • nouveau: lock the client object tree (stable-fixes).
  • nouveau: reset the bo resource bus info after an eviction (git-fixes).
  • nvdimm/pmem: Treat alloc_dax() -EOPNOTSUPP failure as non-fatal (jsc#PED-5853).
  • nvdimm/pmem: fix leak on dax_add_host() failure (jsc#PED-5853).
  • nvdimm: make nvdimm_bus_type const (jsc#PED-5853).
  • nvme-fc: do not wait in vain when unloading module (git-fixes).
  • nvme-multipath: fix io accounting on failover (git-fixes).
  • nvme-pci: Add quirk for broken MSIs (git-fixes).
  • nvme-tcp: strict pdu pacing to avoid send stalls on TLS (bsc#1221858).
  • nvme: fix multipath batched completion accounting (git-fixes).
  • nvme: fix reconnection fail due to reserved tag allocation (git-fixes).
  • nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH (git-fixes).
  • nvmet-fc: abort command when there is no binding (git-fixes).
  • nvmet-fc: defer cleanup using RCU properly (git-fixes).
  • nvmet-fc: hold reference on hostport match (git-fixes).
  • nvmet-fc: release reference on target port (git-fixes).
  • nvmet-fcloop: swap the list_add_tail arguments (git-fixes).
  • nvmet-tcp: fix nvme tcp ida memory leak (git-fixes).++ kernel-source-azure.spec (revision 4)%define git_commit ba2f81d0ba1ad117dc6a5494a21d358f354126d7Release: <RELEASE>.gba2f81d
  • nvmet: fix ns enable/disable possible hang (git-fixes).
  • octeontx2-af: Add array index check (git-fixes).
  • octeontx2-af: Fix NIX SQ mode and BP config (git-fixes).
  • octeontx2-af: Fix devlink params (git-fixes).
  • octeontx2-af: Fix issue with loading coalesced KPU profiles (git-fixes).
  • octeontx2-af: Use matching wake_up API variant in CGX command interface (git-fixes).
  • octeontx2-af: Use separate handlers for interrupts (git-fixes).
  • octeontx2-pf: Fix transmit scheduler resource leak (git-fixes).
  • octeontx2-pf: Send UP messages to VF only when VF is up (git-fixes).
  • octeontx2-pf: Use default max_active works instead of one (git-fixes).
  • octeontx2-pf: Wait till detach_resources msg is complete (git-fixes).
  • octeontx2-pf: check negative error code in otx2_open() (git-fixes).
  • octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation (git-fixes).
  • octeontx2: Detect the mbox up or down message via register (git-fixes).
  • of: dynamic: Synchronize of_changeset_destroy() with the devlink removals (git-fixes).
  • of: module: add buffer overflow check in of_modalias() (git-fixes).
  • of: module: prevent NULL pointer dereference in vsnprintf() (stable-fixes).
  • of: property: Add in-ports/out-ports support to of_graph_get_port_parent() (stable-fixes).
  • of: property: Improve finding the consumer of a remote-endpoint property (git-fixes).
  • of: property: Improve finding the supplier of a remote-endpoint property (git-fixes).
  • of: property: fix typo in io-channels (git-fixes).
  • of: property: fw_devlink: Fix stupid bug in remote-endpoint parsing (git-fixes).
  • of: unittest: Fix compile in the non-dynamic case (git-fixes).
  • overflow: Allow non-type arg to type_max() and type_min() (stable-fixes).
  • peci: linux/peci.h: fix Excess kernel-doc description warning (git-fixes).
  • perf annotate: Fix annotation_calc_lines() to pass correct address to get_srcline() (git-fixes).
  • perf annotate: Get rid of duplicate --group option item (git-fixes).
  • perf auxtrace: Fix multiple use of --itrace option (git-fixes).
  • perf bench internals inject-build-id: Fix trap divide when collecting just one DSO (git-fixes).
  • perf bench uprobe: Remove lib64 from libc.so.6 binary path (git-fixes).
  • perf bpf: Clean up the generated/copied vmlinux.h (git-fixes).
  • perf daemon: Fix file leak in daemon_session__control (git-fixes).
  • perf docs: Document bpf event modifier (git-fixes).
  • perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample() (git-fixes).
  • perf expr: Fix 'has_event' function for metric style events (git-fixes).
  • perf intel-pt: Fix unassigned instruction op (discovered by MemorySanitizer) (git-fixes).
  • perf jevents: Drop or simplify small integer values (git-fixes).
  • perf list: fix short description for some cache events (git-fixes).
  • perf lock contention: Add a missing NULL check (git-fixes).
  • perf metric: Do not remove scale from counts (git-fixes).
  • perf pmu: Count sys and cpuid JSON events separately (git fixes).
  • perf pmu: Fix a potential memory leak in perf_pmu__lookup() (git-fixes).
  • perf pmu: Treat the msr pmu as software (git-fixes).
  • perf print-events: make is_event_supported() more robust (git-fixes).
  • perf probe: Add missing libgen.h header needed for using basename() (git-fixes).
  • perf record: Check conflict between '--timestamp-filename' option and pipe mode before recording (git-fixes).
  • perf record: Fix debug message placement for test consumption (git-fixes).
  • perf record: Fix possible incorrect free in record__switch_output() (git-fixes).
  • perf report: Avoid SEGV in report__setup_sample_type() (git-fixes).
  • perf sched timehist: Fix -g/--call-graph option failure (git-fixes).
  • perf script: Show also errors for --insn-trace option (git-fixes).
  • perf srcline: Add missed addr2line closes (git-fixes).
  • perf stat: Avoid metric-only segv (git-fixes).
  • perf stat: Do not display metric header for non-leader uncore events (git-fixes).
  • perf stat: Do not fail on metrics on s390 z/VM systems (git-fixes).
  • perf symbols: Fix ownership of string in dso__load_vmlinux() (git-fixes).
  • perf test shell arm_coresight: Increase buffer size for Coresight basic tests (git-fixes).
  • perf tests: Apply attributes to all events in object code reading test (git-fixes).
  • perf tests: Make 'test data symbol' more robust on Neoverse N1 (git-fixes).
  • perf tests: Make data symbol test wait for perf to start (bsc#1220045).
  • perf tests: Skip data symbol test if buf1 symbol is missing (bsc#1220045).
  • perf thread: Fixes to thread__new() related to initializing comm (git-fixes).
  • perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str() (git-fixes).
  • perf top: Uniform the event name for the hybrid machine (git-fixes).
  • perf top: Use evsel's cpus to replace user_requested_cpus (git-fixes).
  • perf ui browser: Avoid SEGV on title (git fixes).
  • perf ui browser: Do not save pointer to stack memory (git-fixes).
  • perf vendor events amd: Add Zen 4 memory controller events (git-fixes).
  • perf vendor events amd: Fix Zen 4 cache latency events (git-fixes).
  • perf/x86/amd/core: Avoid register reset when CPU is dead (git-fixes).
  • perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later (git-fixes).
  • perf/x86/amd/lbr: Discard erroneous branch entries (git-fixes).
  • perf/x86/amd/lbr: Use freeze based on availability (git-fixes).
  • perf/x86/intel/ds: Do not clear ->pebs_data_cfg for the last PEBS event (git-fixes).
  • perf/x86/intel: Expose existence of callback support to KVM (git-fixes).
  • perf/x86: Fix out of range data (git-fixes).
  • phy: freescale: imx8m-pcie: fix pcie link-up instability (git-fixes).
  • phy: marvell: a3700-comphy: Fix hardcoded array size (git-fixes).
  • phy: marvell: a3700-comphy: Fix out of bounds read (git-fixes).
  • phy: rockchip-snps-pcie3: fix bifurcation on rk3588 (git-fixes).
  • phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits (git-fixes).
  • phy: rockchip: naneng-combphy: Fix mux on rk3588 (git-fixes).
  • phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered (git-fixes).
  • pinctrl/meson: fix typo in PDM's pin name (git-fixes).
  • pinctrl: armada-37xx: remove an unused variable (git-fixes).
  • pinctrl: baytrail: Fix selecting gpio pinctrl state (git-fixes).
  • pinctrl: core: delete incorrect free in pinctrl_enable() (git-fixes).
  • pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (git-fixes).
  • pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback (git-fixes).
  • pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE (git-fixes).
  • pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T (git-fixes).
  • pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs (git-fixes).
  • pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs (stable-fixes).
  • platform/chrome: cros_ec_uart: properly fix race condition (git-fixes).
  • platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes (stable-fixes).
  • platform/x86/intel-uncore-freq: Do not present root domain on error (git-fixes).
  • platform/x86: ISST: Add Granite Rapids-D to HPM CPU list (stable-fixes).
  • platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet (stable-fixes).
  • platform/x86: x86-android-tablets: Fix acer_b1_750_goodix_gpios name (stable-fixes).
  • platform/x86: xiaomi-wmi: Fix race condition when reporting key events (git-fixes).
  • power: rt9455: hide unused rt9455_boost_voltage_values (git-fixes).
  • power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator (git-fixes).
  • powerpc/crypto/chacha-p10: Fix failure on non Power10 (bsc#1218205).
  • powerpc/eeh: Permanently disable the removed device (bsc#1223991 ltc#205740).
  • powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks (git-fixes).
  • powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).
  • powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
  • powerpc/pseries: make max polling consistent for longer H_CALLs (bsc#1215199).
  • powerpc/uaccess: Fix build errors seen with GCC 13/14 (bsc#1194869).
  • powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).
  • powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
  • ppdev: Add an error check in register_device (git-fixes).
  • prctl: generalize PR_SET_MDWE support check to be per-arch (bsc#1225610).
  • printk: Add this_cpu_in_panic() (bsc#1225607).
  • printk: Adjust mapping for 32bit seq macros (bsc#1225607).
  • printk: Avoid non-panic CPUs writing to ringbuffer (bsc#1225607).
  • printk: Consolidate console deferred printing (bsc#1225607).
  • printk: Disable passing console lock owner completely during panic() (bsc#1225607).
  • printk: Do not take console lock for console_flush_on_panic() (bsc#1225607).
  • printk: For @suppress_panic_printk check for other CPU in panic (bsc#1225607).
  • printk: Keep non-panic-CPUs out of console lock (bsc#1225607).
  • printk: Let no_printk() use _printk() (bsc#1225618).
  • printk: Reduce console_unblank() usage in unsafe scenarios (bsc#1225607).
  • printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic() (bsc#1225607).
  • printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1225616).
  • printk: Use prb_first_seq() as base for 32bit seq macros (bsc#1225607).
  • printk: Wait for all reserved records with pr_flush() (bsc#1225607).
  • printk: nbcon: Relocate 32bit seq macros (bsc#1225607).
  • printk: ringbuffer: Clarify special lpos values (bsc#1225607).
  • printk: ringbuffer: Cleanup reader terminology (bsc#1225607).
  • printk: ringbuffer: Do not skip non-finalized records with prb_next_seq() (bsc#1225607).
  • printk: ringbuffer: Skip non-finalized records in panic (bsc#1225607).
  • proc/kcore: do not try to access unaccepted memory (git-fixes).
  • pstore/zone: Add a null pointer check to the psz_kmsg_read (stable-fixes).
  • pstore: inode: Convert mutex usage to guard(mutex) (stable-fixes).
  • pstore: inode: Only d_invalidate() is needed (git-fixes).
  • pwm: img: fix pwm clock lookup (git-fixes).
  • qibfs: fix dentry leak (git-fixes)
  • r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d (git-fixes).
  • r8169: skip DASH fw status checks when DASH is disabled (git-fixes).
  • random: handle creditable entropy from atomic process context (git-fixes).
  • regmap: Add regmap_read_bypassed() (git-fixes).
  • regmap: kunit: Ensure that changed bytes are actually different (stable-fixes).
  • regmap: maple: Fix cache corruption in regcache_maple_drop() (git-fixes).
  • regmap: maple: Fix uninitialized symbol 'ret' warnings (git-fixes).
  • regulator: bd71828: Do not overwrite runtime voltages (git-fixes).
  • regulator: change devm_regulator_get_enable_optional() stub to return Ok (git-fixes).
  • regulator: change stubbed devm_regulator_get_enable to return Ok (git-fixes).
  • regulator: core: fix debugfs creation regression (git-fixes).
  • regulator: mt6360: De-capitalize devicetree regulator subnodes (git-fixes).
  • regulator: tps65132: Add of_match table (stable-fixes).
  • remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs (git-fixes).
  • remoteproc: k3-r5: Jump to error handling labels in start/stop errors (git-fixes).
  • remoteproc: k3-r5: Wait for core0 power-up before powering up core1 (git-fixes).
  • remoteproc: mediatek: Make sure IPI buffer fits in L2TCM (git-fixes).
  • remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef (git-fixes).
  • remoteproc: virtio: Fix wdg cannot recovery remote processor (git-fixes).
  • ring-buffer: Do not set shortest_full when full target is hit (git-fixes).
  • ring-buffer: Fix a race between readers and resize checks (git-fixes).
  • ring-buffer: Fix full_waiters_pending in poll (git-fixes).
  • ring-buffer: Fix resetting of shortest_full (git-fixes).
  • ring-buffer: Fix waking up ring buffer readers (git-fixes).
  • ring-buffer: Make wake once of ring_buffer_wait() more robust (git-fixes).
  • ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() (git-fixes).
  • ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes).
  • rtc: mt6397: select IRQ_DOMAIN instead of depending on it (git-fixes).
  • s390/bpf: Emit a barrier for BPF_FETCH instructions (git-fixes bsc#1224792).
  • s390/cio: Ensure the copied buf is NUL terminated (git-fixes bsc#1223869).
  • s390/cio: fix tracepoint subchannel type field (git-fixes bsc#1224793).
  • s390/cpacf: Split and rework cpacf query functions (git-fixes bsc#1225133).
  • s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224348).
  • s390/ipl: Fix incorrect initialization of len fields in nvme reipl block (git-fixes bsc#1225136).
  • s390/ipl: Fix incorrect initialization of nvme dump block (git-fixes bsc#1225134).
  • s390/ism: Properly fix receive message buffer allocation (git-fixes bsc#1223590).
  • s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223871).
  • s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223872).
  • s390/qeth: Fix kernel panic after setting hsuid (git-fixes bsc#1223874).
  • s390/vdso: Add CFI for RA register to asm macro vdso_func (git-fixes bsc#1223870).
  • s390/vdso: drop '-fPIC' from LDFLAGS (git-fixes bsc#1223593).
  • s390/vtime: fix average steal time calculation (git-fixes bsc#1221783).
  • s390/zcrypt: fix reference counting on zcrypt card objects (git-fixes bsc#1223592).
  • sched-fair-Add-EAS-checks-before-updating-root_domain-overutilized.patch.
  • sched-fair-Combine-EAS-check-with-overutilized-access.patch.
  • sched-fair-Introduce-is_rd_overutilized-helper-function-to-access-root_domain-overutilized.patch.
  • sched/balancing: Rename newidle_balance() => sched_balance_newidle() (bsc#1222173).
  • sched/fair: Check root_domain::overload value before update (bsc#1222173).
  • sched/fair: Use helper functions to access root_domain::overload (bsc#1222173).
  • sched/psi: Select KERNFS as needed (git-fixes).
  • sched/topology: Optimize topology_span_sane() (bsc#1225053).
  • scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn (git-fixes).
  • scsi: core: Consult supported VPD page list prior to fetching page (git-fixes).
  • scsi: core: Fix unremoved procfs host directory regression (git-fixes).
  • scsi: csiostor: Avoid function pointer casts (git-fixes).
  • scsi: hisi_sas: Modify the deadline for ata_wait_after_reset() (git-fixes).
  • scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type() (git-fixes).
  • scsi: libsas: Fix disk not being scanned in after being removed (git-fixes).
  • scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).
  • scsi: lpfc: Change default logging level for unsolicited CT MIB commands (bsc#1225842).
  • scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask (bsc#1225842). Refresh: - patches.suse/lpfc-reintroduce-old-irq-probe-logic.patch
  • scsi: lpfc: Clear deferred RSCN processing flag when driver is unloading (bsc#1225842).
  • scsi: lpfc: Copyright updates for 14.4.0.1 patches (bsc#1221777).
  • scsi: lpfc: Copyright updates for 14.4.0.2 patches (bsc#1225842).
  • scsi: lpfc: Correct size for cmdwqe/rspwqe for memset() (bsc#1221777).
  • scsi: lpfc: Correct size for wqe for memset() (bsc#1221777).
  • scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr (bsc#1221777).
  • scsi: lpfc: Define lpfc_nodelist type for ctx_ndlp ptr (bsc#1221777).
  • scsi: lpfc: Define types in a union for generic void *context3 ptr (bsc#1221777).
  • scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list (bsc#1225842).
  • scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (bsc#1221777).
  • scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1221777).
  • scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling (bsc#1221777 bsc#1217959).
  • scsi: lpfc: Remove unnecessary log message in queuecommand path (bsc#1221777).
  • scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port() (bsc#1221777).
  • scsi: lpfc: Update logging of protection type for T10 DIF I/O (bsc#1225842).
  • scsi: lpfc: Update lpfc version to 14.4.0.1 (bsc#1221777).
  • scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).
  • scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic (bsc#1221777).
  • scsi: lpfc: Use a dedicated lock for ras_fwlog state (bsc#1221777).
  • scsi: mpi3mr: Reduce stack usage in mpi3mr_refresh_sas_ports() (git-fixes).
  • scsi: mpt3sas: Prevent sending diag_reset when the controller is ready (git-fixes).
  • scsi: mylex: Fix sysfs buffer lengths (git-fixes).
  • scsi: qla2xxx: Change debug message during driver unload (bsc1221816).
  • scsi: qla2xxx: Delay I/O Abort on PCI error (bsc1221816).
  • scsi: qla2xxx: Fix N2N stuck connection (bsc1221816).
  • scsi: qla2xxx: Fix command flush on cable pull (bsc1221816).
  • scsi: qla2xxx: Fix double free of fcport (bsc1221816).
  • scsi: qla2xxx: Fix double free of the ha->vp_map pointer (bsc1221816).
  • scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (git-fixes).
  • scsi: qla2xxx: NVME|FCP prefer flag not being honored (bsc1221816).
  • scsi: qla2xxx: Prevent command send on chip reset (bsc1221816).
  • scsi: qla2xxx: Split FCE|EFT trace control (bsc1221816).
  • scsi: qla2xxx: Update manufacturer detail (bsc1221816).
  • scsi: qla2xxx: Update version to 10.02.09.200-k (bsc1221816).
  • scsi: sd: Unregister device if device_add_disk() failed in sd_probe() (git-fixes).
  • scsi: sg: Avoid race in error handling & drop bogus warn (git-fixes).
  • scsi: sg: Avoid sg device teardown race (git-fixes).
  • scsi: smartpqi: Fix disable_managed_interrupts (git-fixes).
  • sctp: annotate data-races around sk->sk_wmem_queued (git-fixes).
  • sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove() (git-fixes).
  • selftests/binderfs: use the Makefile's rules, not Make's implicit rules (git-fixes).
  • selftests/bpf: add edge case backtracking logic test (bsc#1225756).
  • selftests/bpf: precision tracking test for BPF_NEG and BPF_END (bsc#1225756).
  • selftests/ftrace: Fix event filter target_func selection (stable-fixes).
  • selftests/ftrace: Limit length in subsystem-enable tests (git-fixes).
  • selftests/kcmp: remove unused open mode (git-fixes).
  • selftests/net: convert test_bridge_neigh_suppress.sh to run it in unique namespace (stable-fixes).
  • selftests/pidfd: Fix config for pidfd_setns_test (git-fixes).
  • selftests/powerpc/dexcr: Add -no-pie to hashchk tests (git-fixes).
  • selftests/powerpc/papr-vpd: Fix missing variable initialization (jsc#PED-4486 git-fixes).
  • selftests/resctrl: fix clang build failure: use LOCAL_HDRS (git-fixes).
  • selftests/timers/posix_timers: Reimplement check_timer_distribution() (git-fixes).
  • selftests: default to host arch for LLVM builds (git-fixes).
  • selftests: forwarding: Fix ping failure due to short timeout (git-fixes).
  • selftests: kselftest: Fix build failure with NOLIBC (git-fixes).
  • selftests: kselftest: Mark functions that unconditionally call exit() as __noreturn (git-fixes).
  • selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval (git-fixes).
  • selftests: net: kill smcrouted in the cleanup logic in amt.sh (git-fixes).
  • selftests: net: move amt to socat for better compatibility (git-fixes).
  • selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC (git-fixes).
  • selftests: timers: Convert posix_timers test to generate KTAP output (stable-fixes).
  • selftests: timers: Fix abs() warning in posix_timers test (git-fixes).
  • selftests: timers: Fix posix_timers ksft_print_msg() warning (git-fixes).
  • selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior (stable-fixes).
  • selftests: vxlan_mdb: Fix failures with old libnet (git-fixes).
  • selinux: avoid dereference of garbage after mount failure (git-fixes).
  • selinux: introduce an initial SID for early boot processes (bsc#1208593).
  • serial/pmac_zilog: Remove flawed mitigation for rx irq flood (git-fixes).
  • serial: 8250_bcm7271: use default_mux_rate if possible (git-fixes).
  • serial: 8250_dw: Revert: Do not reclock if already at correct rate (git-fixes).
  • serial: 8250_exar: Do not remove GPIO device on suspend (git-fixes).
  • serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup (git-fixes).
  • serial: Lock console when calling into driver before registration (git-fixes).
  • serial: core: Fix atomicity violation in uart_tiocmget (git-fixes).
  • serial: core: only stop transmit when HW fifo is empty (git-fixes).
  • serial: kgdboc: Fix NMI-safety problems from keyboard reset code (stable-fixes).
  • serial: max3100: Fix bitwise types (git-fixes).
  • serial: max3100: Lock port->lock when calling uart_handle_cts_change() (git-fixes).
  • serial: max310x: fix NULL pointer dereference in I2C instantiation (git-fixes).
  • serial: max310x: fix syntax error in IRQ error message (git-fixes).
  • serial: mxs-auart: add spinlock around changing cts state (git-fixes).
  • serial: sc16is7xx: add proper sched.h include for sched_set_fifo() (git-fixes).
  • serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler (git-fixes).
  • serial: sh-sci: protect invalidating RXDMA on shutdown (git-fixes).
  • serial: stm32: Reset .throttled state in .startup() (git-fixes).
  • series.conf: cleanup Fix subsection header to silence series_insert error.
  • slimbus: core: Remove usage of the deprecated ida_simple_xx() API (git-fixes).
  • slimbus: qcom-ngd-ctrl: Add timeout for wait operation (git-fixes).
  • smb3: show beginning time for per share stats (bsc#1225172).
  • smb: client: ensure to try all targets when finding nested links (bsc#1225172).
  • smb: client: fix mount when dns_resolver key is not available (git-fixes, bsc#1225172).
  • smb: client: fix parsing of SMB3.1.1 POSIX create context (git-fixes, bsc#1225172).
  • smb: client: get rid of dfs code dep in namespace.c (bsc#1225172).
  • smb: client: get rid of dfs naming in automount code (bsc#1225172).
  • smb: client: introduce DFS_CACHE_TGT_LIST() (bsc#1225172).
  • smb: client: reduce stack usage in cifs_try_adding_channels() (bsc#1225172).
  • smb: client: remove extra @chan_count check in __cifs_put_smb_ses() (bsc#1225172).
  • smb: client: rename cifs_dfs_ref.c to namespace.c (bsc#1225172).
  • soc: fsl: qbman: Always disable interrupts when taking cgr_lock (git-fixes).
  • soc: fsl: qbman: Use raw spinlock for cgr_lock (git-fixes).
  • soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE (git-fixes).
  • soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt (stable-fixes).
  • soc: qcom: pmic_glink: Make client-lock non-sleeping (git-fixes).
  • soc: qcom: pmic_glink: do not traverse clients list without a lock (git-fixes).
  • soc: qcom: pmic_glink: notify clients about the current state (git-fixes).
  • soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request (git-fixes).
  • sock_diag: annotate data-races around sock_diag_handlers[family] (git-fixes).
  • soundwire: amd: fix for wake interrupt handling for clockstop mode (git-fixes).
  • speakup: Avoid crash on very long word (git-fixes).
  • speakup: Fix 8bit characters from direct synth (git-fixes).
  • speakup: Fix sizeof() vs ARRAY_SIZE() bug (git-fixes).
  • spi: Do not mark message DMA mapped when no transfer in it is (git-fixes).
  • spi: fix null pointer dereference within spi_sync (git-fixes).
  • spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs (git-fixes).
  • spi: intel-pci: Add support for Lunar Lake-M SPI serial flash (stable-fixes).
  • spi: lm70llp: fix links in doc and comments (git-fixes).
  • spi: lpspi: Avoid potential use-after-free in probe() (git-fixes).
  • spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe (git-fixes).
  • spi: microchip-core-qspi: fix setting spi bus clock rate (git-fixes).
  • spi: spi-fsl-lpspi: remove redundant spi_controller_put call (git-fixes).
  • spi: spi-mt65xx: Fix NULL pointer access in interrupt handler (git-fixes).
  • spi: stm32: Do not warn about spurious interrupts (git-fixes).
  • spi: xilinx: Fix kernel documentation in the xilinx_spi.h (git-fixes).
  • spmi: hisi-spmi-controller: Do not override device identifier (git-fixes).
  • staging: vc04_services: changen strncpy() to strscpy_pad() (stable-fixes).
  • staging: vc04_services: fix information leak in create_component() (git-fixes).
  • staging: vt6655: Remove unused declaration of RFbAL7230SelectChannelPostProcess() (git-fixes).
  • stmmac: Clear variable when destroying workqueue (git-fixes).
  • supported.conf: support tcp_dctcp module (jsc#PED-8111)
  • swiotlb: Fix alignment checks when both allocation and DMA masks are (bsc#1224331)
  • swiotlb: Fix double-allocation of slots due to broken alignment (bsc#1224331)
  • swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() (bsc#1224331)
  • swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (bsc#1224331)
  • swiotlb: use the calculated number of areas (git-fixes).
  • thermal/drivers/qcom/lmh: Check for SCM availability at probe (git-fixes).
  • thermal/drivers/tsens: Fix null pointer dereference (git-fixes).
  • thermal/of: Assume polling-delay(-passive) 0 when absent (stable-fixes).
  • thermal: devfreq_cooling: Fix perf state when calculate dfc res_util (git-fixes).
  • thunderbolt: Avoid notify PM core about runtime PM resume (stable-fixes).
  • thunderbolt: Do not create DisplayPort tunnels on adapters of the same router (git-fixes).
  • thunderbolt: Fix wake configurations after device unplug (stable-fixes).
  • thunderbolt: Introduce tb_path_deactivate_hop() (stable-fixes).
  • thunderbolt: Introduce tb_port_reset() (stable-fixes).
  • thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4 routers (stable-fixes).
  • thunderbolt: Reset only non-USB4 host routers in resume (git-fixes).
  • tls: break out of main loop when PEEK gets a non-data record (bsc#1221858).
  • tls: do not skip over different type records from the rx_list (bsc#1221858).
  • tls: fix peeking with sync+async decryption (bsc#1221858).
  • tls: stop recv() if initial process_rx_list gave us non-DATA (bsc#1221858).
  • tools/arch/x86/intel_sdsi: Fix maximum meter bundle length (git-fixes).
  • tools/arch/x86/intel_sdsi: Fix meter_certificate decoding (git-fixes).
  • tools/arch/x86/intel_sdsi: Fix meter_show display (git-fixes).
  • tools/latency-collector: Fix -Wformat-security compile warns (git-fixes).
  • tools/power turbostat: Expand probe_intel_uncore_frequency() (bsc#1221765).
  • tools/power/turbostat: Fix uncore frequency file string (bsc#1221765).
  • tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer (git-fixes).
  • tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes).
  • tracing/ring-buffer: Fix wait_on_pipe() race (git-fixes).
  • tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test (git-fixes).
  • tracing: Have saved_cmdlines arrays all in one allocation (git-fixes).
  • tracing: Remove precision vsnprintf() check from print event (git-fixes).
  • tracing: Use .flush() call to wake up readers (git-fixes).
  • tracing: hide unused ftrace_event_id_fops (git-fixes).
  • tty: n_gsm: fix missing receive state reset after mode switch (git-fixes).
  • tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (git-fixes).
  • tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT (git-fixes).
  • tty: vt: fix 20 vs 0x20 typo in EScsiignore (git-fixes).
  • ubifs: Queue up space reservation tasks if retrying many times (git-fixes).
  • ubifs: Remove unreachable code in dbg_check_ltab_lnum (git-fixes).
  • ubifs: Set page uptodate in the correct place (git-fixes).
  • ubifs: dbg_check_idx_size: Fix kmemleak if loading znode failed (git-fixes).
  • ubifs: fix sort function prototype (git-fixes).
  • usb: Disable USB3 LPM at shutdown (stable-fixes).
  • usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device (bsc#1220569).
  • usb: aqc111: stop lying about skb->truesize (git-fixes).
  • usb: audio-v2: Correct comments for struct uac_clock_selector_descriptor (git-fixes).
  • usb: cdc-wdm: close race between read and workqueue (git-fixes).
  • usb: dwc2: gadget: Fix exiting from clock gating (git-fixes).
  • usb: dwc2: gadget: LPM flow fix (git-fixes).
  • usb: dwc2: host: Fix ISOC flow in DDMA mode (git-fixes).
  • usb: dwc2: host: Fix dereference issue in DDMA completion flow (git-fixes).
  • usb: dwc2: host: Fix hibernation flow (git-fixes).
  • usb: dwc2: host: Fix remote wakeup from hibernation (git-fixes).
  • usb: dwc3-am62: Disable wakeup at remove (git-fixes).
  • usb: dwc3-am62: Rename private data (git-fixes).
  • usb: dwc3-am62: fix module unload/reload behavior (git-fixes).
  • usb: dwc3: Properly set system wakeup (git-fixes).
  • usb: dwc3: Wait unconditionally after issuing EndXfer command (git-fixes).
  • usb: dwc3: core: Prevent phy suspend during init (Git-fixes).
  • usb: dwc3: pci: Drop duplicate ID (git-fixes).
  • usb: fotg210: Add missing kernel doc description (git-fixes).
  • usb: gadget: composite: fix OS descriptors w_value logic (git-fixes).
  • usb: gadget: f_fs: Fix a race condition when processing setup packets (git-fixes).
  • usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (git-fixes).
  • usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error (stable-fixes).
  • usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin (git-fixes).
  • usb: gadget: u_audio: Clear uac pointer when freed (git-fixes).
  • usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind (git-fixes).
  • usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR (stable-fixes).
  • usb: gadget: uvc: use correct buffer size when parsing configfs lists (git-fixes).
  • usb: ohci: Prevent missed ohci interrupts (git-fixes).
  • usb: phy: generic: Get the vbus supply (git-fixes).
  • usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined (stable-fixes).
  • usb: typec: Return size of buffer if pd_set operation succeeds (git-fixes).
  • usb: typec: tcpci: add generic tcpci fallback compatible (stable-fixes).
  • usb: typec: tcpm: Check for port partner validity before consuming it (git-fixes).
  • usb: typec: tcpm: Correct port source pdo array in pd_set callback (git-fixes).
  • usb: typec: tcpm: Correct the PDO counting in pd_set (git-fixes).
  • usb: typec: tcpm: Update PD of Type-C port upon pd_set (git-fixes).
  • usb: typec: tcpm: clear pd_event queue in PORT_RESET (git-fixes).
  • usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd() (git-fixes).
  • usb: typec: tcpm: unregister existing source caps before re-registration (git-fixes).
  • usb: typec: tipd: fix event checking for tps6598x (git-fixes).
  • usb: typec: ucsi: Ack unsupported commands (stable-fixes).
  • usb: typec: ucsi: Check for notifications after init (git-fixes).
  • usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros (git-fixes).
  • usb: typec: ucsi: Clear EVENT_PENDING under PPM lock (git-fixes).
  • usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset (stable-fixes).
  • usb: typec: ucsi: Fix connector check on init (git-fixes).
  • usb: typec: ucsi: Fix race between typec_switch and role_switch (git-fixes).
  • usb: typec: ucsi: Limit read size on v1.2 (stable-fixes).
  • usb: typec: ucsi: always register a link to USB PD device (git-fixes).
  • usb: typec: ucsi: displayport: Fix potential deadlock (git-fixes).
  • usb: typec: ucsi: simplify partner's PD caps registration (git-fixes).
  • usb: typec: ucsi_acpi: Refactor and fix DELL quirk (git-fixes).
  • usb: udc: remove warning when queue disabled ep (stable-fixes).
  • usb: xhci-plat: Do not include xhci.h (stable-fixes).
  • usb: xhci: Add error handling in xhci_map_urb_for_dma (git-fixes).
  • usb: xhci: Implement xhci_handshake_check_state() helper.
  • usb: xhci: correct return value in case of STS_HCE (git-fixes).
  • vboxsf: Avoid an spurious warning if load_nls_xxx() fails (git-fixes).
  • vboxsf: explicitly deny setlease attempts (stable-fixes).
  • vdpa/mlx5: Allow CVQ size changes (git-fixes).
  • vdpa_sim: reset must not run (git-fixes).
  • veth: try harder when allocating queue memory (git-fixes).
  • vhost: Add smp_rmb() in vhost_enable_notify() (git-fixes).
  • vhost: Add smp_rmb() in vhost_vq_avail_empty() (git-fixes).
  • virtio-blk: Ensure no requests in virtqueues before deleting vqs (git-fixes).
  • virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal (bsc#1223944).
  • virtio_net: Do not send RSS key if it is not supported (git-fixes).
  • vmci: prevent speculation leaks by sanitizing event in event_deliver() (git-fixes).
  • vsock/virtio: fix packet delivery to tap device (git-fixes).
  • watchdog: bd9576: Drop 'always-running' property (git-fixes).
  • watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger (git-fixes).
  • watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin (git-fixes).
  • watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe() (git-fixes).
  • wifi: ar5523: enable proper endpoint verification (git-fixes).
  • wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() (git-fixes).
  • wifi: ath10k: poll service ready message before failing (git-fixes).
  • wifi: ath10k: populate board data for WCN3990 (git-fixes).
  • wifi: ath11k: decrease MHI channel buffer length to 8KB (bsc#1207948).
  • wifi: ath11k: do not force enable power save on non-running vdevs (git-fixes).
  • wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() (git-fixes).
  • wifi: ath9k: fix LNA selection in ath_ant_try_scan() (stable-fixes).
  • wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro (stable-fixes).
  • wifi: brcmfmac: Demote vendor-specific attach/detach messages to info (git-fixes).
  • wifi: brcmfmac: add per-vendor feature detection callback (stable-fixes).
  • wifi: brcmfmac: cfg80211: Use WSEC to set SAE password (stable-fixes).
  • wifi: brcmfmac: pcie: handle randbuf allocation failure (git-fixes).
  • wifi: carl9170: add a proper sanity check for endpoints (git-fixes).
  • wifi: carl9170: re-fix fortified-memset warning (git-fixes).
  • wifi: cfg80211: check A-MSDU format more carefully (stable-fixes).
  • wifi: cfg80211: fix rdev_dump_mpp() arguments order (stable-fixes).
  • wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok() (git-fixes).
  • wifi: iwlwifi: fw: do not always use FW dump trig (git-fixes).
  • wifi: iwlwifi: fw: fix compile w/o CONFIG_ACPI (git-fixes).
  • wifi: iwlwifi: mvm: allocate STA links only for active links (git-fixes).
  • wifi: iwlwifi: mvm: fix active link counting during recovery (git-fixes).
  • wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask (git-fixes).
  • wifi: iwlwifi: mvm: guard against invalid STA ID on removal (stable-fixes).
  • wifi: iwlwifi: mvm: include link ID when releasing frames (git-fixes).
  • wifi: iwlwifi: mvm: init vif works only once (git-fixes).
  • wifi: iwlwifi: mvm: remove old PASN station when adding a new one (git-fixes).
  • wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd (git-fixes).
  • wifi: iwlwifi: mvm: rfi: fix potential response leaks (git-fixes).
  • wifi: iwlwifi: mvm: select STA mask only for active links (git-fixes).
  • wifi: iwlwifi: mvm: use correct address 3 in A-MSDU (stable-fixes).
  • wifi: iwlwifi: pcie: Add the PCI device id for new hardware (stable-fixes).
  • wifi: iwlwifi: pcie: fix RB status reading (stable-fixes).
  • wifi: iwlwifi: read txq->read_ptr under lock (stable-fixes).
  • wifi: iwlwifi: reconfigure TLC during HW restart (git-fixes).
  • wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (stable-fixes).
  • wifi: mac80211: clean up assignments to pointer cache (stable-fixes).
  • wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc (stable-fixes).
  • wifi: mac80211: fix prep_connection error path (stable-fixes).
  • wifi: mac80211: fix unaligned le16 access (git-fixes).
  • wifi: mac80211: only call drv_sta_rc_update for uploaded stations (stable-fixes).
  • wifi: mac80211: remove link before AP (git-fixes).
  • wifi: mac80211_hwsim: init peer measurement result (git-fixes).
  • wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset (git-fixes).
  • wifi: mt76: mt7603: fix tx queue of loopback packets (git-fixes).
  • wifi: mt76: mt7915: workaround too long expansion sparse warnings (git-fixes).
  • wifi: mt76: mt7996: add locking for accessing mapped registers (stable-fixes).
  • wifi: mt76: mt7996: disable AMSDU for non-data frames (stable-fixes).
  • wifi: mwl8k: initialize cmd->addr[] properly (git-fixes).
  • wifi: nl80211: do not free NULL coalescing rule (git-fixes).
  • wifi: rtw88: 8821cu: Fix connection failure (stable-fixes).
  • wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU (stable-fixes).
  • wifi: rtw89: fix null pointer access when abort scan (stable-fixes).
  • wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of firmware command (git-fixes).
  • wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor (stable-fixes).
  • wireguard: netlink: access device through ctx instead of peer (git-fixes).
  • wireguard: netlink: check for dangling peer via is_dead instead of empty list (git-fixes).
  • wireguard: receive: annotate data-race around receiving_counter.counter (git-fixes).
  • x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range (git-fixes).
  • x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT (git-fixes).
  • x86/bugs: Fix BHI retpoline check (git-fixes).
  • x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).
  • x86/bugs: Remove default case for fully switched enums (git-fixes).
  • x86/calldepth: Rename __x86_return_skl() to call_depth_return_thunk() (git-fixes).
  • x86/coco: Require seeding RNG with RDRAND on CoCo systems (git-fixes).
  • x86/cpu: Add model number for Intel Arrow Lake mobile processor (git-fixes).
  • x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ (git-fixes).
  • x86/efistub: Add missing boot_params for mixed mode compat entry (git-fixes).
  • x86/efistub: Call mixed mode boot services on the firmware's stack (git-fixes).
  • x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (git-fixes).
  • x86/hyperv: Allow 15-bit APIC IDs for VTL platforms (git-fixes).
  • x86/hyperv: Use per cpu initial stack for vtl context (git-fixes).
  • x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y (git-fixes).
  • x86/kvm/Kconfig: Have KVM_AMD_SEV select ARCH_HAS_CC_PLATFORM (git-fixes).
  • x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (git-fixes).
  • x86/nmi: Fix the inverse 'in NMI handler' check (git-fixes).
  • x86/nospec: Refactor UNTRAIN_RET[_*] (git-fixes).
  • x86/pm: Work around false positive kmemleak report in msr_build_context() (git-fixes).
  • x86/purgatory: Switch to the position-independent small code model (git-fixes).
  • x86/rethunk: Use SYM_CODE_START[_LOCAL]_NOALIGN macros (git-fixes).
  • x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk (git-fixes).
  • x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO (git-fixes).
  • x86/srso: Disentangle rethunk-dependent options (git-fixes).
  • x86/srso: Fix unret validation dependencies (git-fixes).
  • x86/srso: Improve i-cache locality for alias mitigation (git-fixes).
  • x86/srso: Print actual mitigation if requested mitigation isn't possible (git-fixes).
  • x86/srso: Remove 'pred_cmd' label (git-fixes).
  • x86/srso: Unexport untraining functions (git-fixes).
  • x86/xen: Add some null pointer checking to smp.c (git-fixes).
  • x86/xen: attempt to inflate the memory balloon on PVH (git-fixes).
  • xdp, bonding: Fix feature flags when there are no slave devs anymore (git-fixes).
  • xen-netfront: Add missing skb_mark_for_recycle (git-fixes).
  • xen/events: drop xen_allocate_irqs_dynamic() (git-fixes).
  • xen/events: fix error code in xen_bind_pirq_msi_to_irq() (git-fixes).
  • xen/events: increment refcnt only if event channel is refcounted (git-fixes).
  • xen/events: modify internal [un]bind interfaces (git-fixes).
  • xen/events: reduce externally visible helper functions (git-fixes).
  • xen/events: remove some simple helpers from events_base.c (git-fixes).
  • xen/evtchn: avoid WARN() when unbinding an event channel (git-fixes).
  • xen: evtchn: Allow shared registration of IRQ handers (git-fixes).
  • xfs: add lock protection when remove perag from radix tree (git-fixes).
  • xfs: allow extent free intents to be retried (git-fixes).
  • xfs: fix perag leak when growfs fails (git-fixes).
  • xfs: force all buffers to be written during btree bulk load (git-fixes).
  • xfs: make xchk_iget safer in the presence of corrupt inode btrees (git-fixes).
  • xfs: pass the xfs_defer_pending object to iop_recover (git-fixes).
  • xfs: recompute growfsrtfree transaction reservation while growing rt volume (git-fixes).
  • xfs: transfer recovered intent item ownership in ->iop_recover (git-fixes).
  • xfs: use xfs_defer_pending objects to recover intent items (git-fixes).
  • xhci: Simplify event ring dequeue pointer update for port change events (git-fixes).
  • xhci: add helper that checks for unhandled events on a event ring (git-fixes).
  • xhci: remove unnecessary event_ring_deq parameter from xhci_handle_event() (git-fixes).
  • xhci: simplify event ring dequeue tracking for transfer events (git-fixes).
  • 9p: add missing locking around taking dentry fid list (git-fixes)
  • accel/ivpu: Fix deadlock in context_xa (git-fixes).
  • ACPI: bus: Indicate support for _TFP thru _OSC (git-fixes).
  • ACPI: bus: Indicate support for IRQ ResourceSource thru _OSC (git-fixes).
  • ACPI: bus: Indicate support for the Generic Event Device thru _OSC (git-fixes).
  • ACPI: CPPC: Fix access width used for PCC registers (git-fixes).
  • ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro (git-fixes).
  • ACPI: CPPC: Use access_width over bit_width for system memory accesses (stable-fixes).
  • ACPI: disable -Wstringop-truncation (git-fixes).
  • ACPI: Fix Generic Initiator Affinity _OSC bit (git-fixes).
  • ACPI: LPSS: Advertise number of chip selects via property (git-fixes).
  • ACPI: resource: Add Infinity laptops to irq1_edge_low_force_override (stable-fixes).
  • ACPI: resource: Do IRQ override on Lunnen Ground laptops (stable-fixes).
  • ACPI: scan: Do not increase dep_unmet for already met dependencies (git-fixes).
  • ACPI: video: Add backlight=native quirk for Lenovo Slim 7 16ARH7 (bsc#1217750).
  • ACPI: x86: Move acpi_quirk_skip_serdev_enumeration() out of CONFIG_X86_ANDROID_TABLETS (stable-fixes).
  • ACPICA: debugger: check status of acpi_evaluate_object() in acpi_db_walk_for_fields() (git-fixes).
  • admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET (git-fixes).
  • ahci: asm1064: asm1166: do not limit reported ports (git-fixes).
  • ahci: asm1064: correct count of reported ports (stable-fixes).
  • ALSA: aoa: avoid false-positive format truncation warning (git-fixes).
  • ALSA: core: Fix NULL module pointer assignment at card init (git-fixes).
  • ALSA: core: Remove debugfs at disconnection (git-fixes).
  • ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter (stable-fixes).
  • ALSA: Fix deadlocks with kctl removals at disconnection (stable-fixes).
  • ALSA: hda: Add Intel BMG PCI ID and HDMI codec vid (stable-fixes).
  • ALSA: hda: clarify Copyright information (stable-fixes).
  • ALSA: hda: cs35l41: Add support for ASUS ROG 2024 Laptops (stable-fixes).
  • ALSA: hda: cs35l41: Ignore errors when configuring IRQs (stable-fixes).
  • ALSA: hda: cs35l41: Remove redundant argument to cs35l41_request_firmware_file() (stable-fixes).
  • ALSA: hda: cs35l41: Remove Speaker ID for Lenovo Legion slim 7 16ARHA7 (git-fixes).
  • ALSA: hda: cs35l41: Set the max PCM Gain using tuning setting (stable-fixes).
  • ALSA: hda: cs35l41: Support HP Omen models without _DSD (stable-fixes).
  • ALSA: hda: cs35l41: Support Lenovo 13X laptop without _DSD (stable-fixes).
  • ALSA: hda: cs35l41: Update DSP1RX5/6 Sources for DSP config (stable-fixes).
  • ALSA: hda: cs35l56: Add ACPI device match tables (git-fixes).
  • ALSA: hda: cs35l56: Exit cache-only after cs35l56_wait_for_firmware_boot() (stable-fixes).
  • ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance (git-fixes).
  • ALSA: hda: cs35l56: Set the init_done flag before component_add() (git-fixes).
  • ALSA: hda: hda_cs_dsp_ctl: Remove notification of driver write (stable-fixes).
  • ALSA: hda: intel-dsp-config: harden I2C/I2S codec detection (stable-fixes).
  • ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() (git-fixes).
  • ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup (git-fixes).
  • ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC (stable-fixes).
  • ALSA: hda/realtek - Fix inactive headset mic jack (stable-fixes).
  • ALSA: hda/realtek - fixed headset Mic not show (stable-fixes).
  • ALSA: hda/realtek - Set GPIO3 to default at S4 state for Thinkpad with ALC1318 (stable-fixes).
  • ALSA: hda/realtek: Add quirk for HP SnowWhite laptops (stable-fixes).
  • ALSA: hda/realtek: Add quirk for HP Spectre x360 14 eu0000 (stable-fixes).
  • ALSA: hda/realtek: Add quirks for ASUS Laptops using CS35L56 (stable-fixes).
  • ALSA: hda/realtek: Add quirks for HP Omen models using CS35L41 (stable-fixes).
  • ALSA: hda/realtek: Add quirks for Huawei Matebook D14 NBLB-WAX9N (stable-fixes).
  • ALSA: hda/realtek: Add quirks for Lenovo 13X (stable-fixes).
  • ALSA: hda/realtek: Add quirks for some Clevo laptops (stable-fixes).
  • ALSA: hda/realtek: Add sound quirks for Lenovo Legion slim 7 16ARHA7 models (stable-fixes).
  • ALSA: hda/realtek: Add support for ASUS Zenbook 2024 HN7306W (stable-fixes).
  • ALSA: hda/realtek: Adjust G814JZR to use SPI init for amp (git-fixes).
  • ALSA: hda/realtek: cs35l41: Support ASUS ROG G634JYR (stable-fixes).
  • ALSA: hda/realtek: Drop doubly quirk entry for 103c:8a2e (git-fixes).
  • ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897 (stable-fixes).
  • ALSA: hda/realtek: Fix build error without CONFIG_PM (stable-fixes).
  • ALSA: hda/realtek: Fix conflicting PCI SSID 17aa:386f for Lenovo Legion models (bsc#1223462).
  • ALSA: hda/realtek: Fix internal speakers for Legion Y9000X 2022 IAH7 (stable-fixes).
  • ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU (stable-fixes).
  • ALSA: hda/realtek: fix mute/micmute LEDs do not work for ProBook 440/460 G11 (stable-fixes).
  • ALSA: hda/realtek: fix the hp playback volume issue for LG machines (stable-fixes).
  • ALSA: hda/realtek: Fix volumn control of ThinkBook 16P Gen4 (git-fixes).
  • ALSA: hda/realtek: Fixes for Asus GU605M and GA403U sound (stable-fixes).
  • ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone (git-fixes).
  • ALSA: hda/tas2781: add locks to kcontrols (git-fixes).
  • ALSA: hda/tas2781: Add new vendor_id and subsystem_id to support ThinkPad ICE-1 (stable-fixes).
  • ALSA: hda/tas2781: correct the register for pow calibrated data (git-fixes).
  • ALSA: hda/tas2781: remove digital gain kcontrol (git-fixes).
  • ALSA: line6: Zero-initialize message buffers (stable-fixes).
  • ALSA: scarlett2: Add correct product series name to messages (stable-fixes).
  • ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support (stable-fixes).
  • ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support (stable-fixes).
  • ALSA: scarlett2: Add missing error check to scarlett2_config_save() (git-fixes).
  • ALSA: scarlett2: Add support for Clarett 8Pre USB (stable-fixes).
  • ALSA: scarlett2: Default mixer driver to enabled (stable-fixes).
  • ALSA: scarlett2: Move USB IDs out from device_info struct (stable-fixes).
  • ALSA: seq: Do not clear bank selection at event -> UMP MIDI2 conversion (git-fixes).
  • ALSA: seq: Fix incorrect UMP type for system messages (git-fixes).
  • ALSA: seq: Fix missing bank setup between MIDI1/MIDI2 UMP conversion (git-fixes).
  • ALSA: seq: Fix yet another spot for system message conversion (git-fixes).
  • ALSA: seq: ump: Fix conversion from MIDI2 to MIDI1 UMP messages (git-fixes).
  • ALSA: seq: ump: Fix swapped song position pointer data (git-fixes).
  • ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs (git-fixes).
  • ALSA: timer: Set lower bound of start tick time (stable-fixes).
  • ALSA: ump: Do not accept an invalid UMP protocol number (git-fixes).
  • ALSA: ump: Do not clear bank selection after sending a program change (git-fixes).
  • ALSA: ump: Set default protocol when not given explicitly (git-fixes).
  • ALSA: usb-audio: Add sampling rates support for Mbox3 (stable-fixes).
  • ALSA: usb-audio: Fix for sampling rates support for Mbox3 (stable-fixes).
  • ALSA/hda: intel-dsp-config: reduce log verbosity (git-fixes).
  • amd/amdkfd: sync all devices to wait all processes being evicted (stable-fixes).
  • amdkfd: use calloc instead of kzalloc to avoid integer overflow (stable-fixes).
  • arm_pmu: acpi: Add a representative platform device for TRBE (bsc#1220587)
  • arm_pmu: acpi: Refactor arm_spe_acpi_register_device() (bsc#1220587)
  • ARM: 9381/1: kasan: clear stale stack poison (git-fixes).
  • ARM: imx_v6_v7_defconfig: Restore CONFIG_BACKLIGHT_CLASS_DEVICE (git-fixes).
  • ARM: imx: Check return value of devm_kasprintf in imx_mmdc_perf_init (git-fixes).
  • ARM: OMAP2+: fix N810 MMC gpiod table (git-fixes).
  • ARM: OMAP2+: fix USB regression on Nokia N8x0 (git-fixes).
  • ARM: prctl: reject PR_SET_MDWE on pre-ARMv6 (stable-fixes).
  • ARM: s5pv210: fix pm.c kernel-doc warning (git-fixes).
  • arm64: Add the arm64.no32bit_el0 command line option (jsc#PED-3184).
  • arm64: bpf: fix 32bit unconditional bswap (git-fixes).
  • arm64: dts: allwinner: h616: Fix I2C0 pins (git-fixes)
  • arm64: dts: allwinner: Pine H64: correctly remove reg_gmac_3v3 (git-fixes)
  • arm64: dts: broadcom: bcmbca: bcm4908: drop invalid switch cells (git-fixes)
  • arm64: dts: Fix dtc interrupt_provider warnings (git-fixes)
  • arm64: dts: hi3798cv200: fix the size of GICR (git-fixes)
  • arm64: dts: imx8-ss-conn: fix usb lpcg indices (git-fixes)
  • arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order (git-fixes)
  • arm64: dts: imx8-ss-dma: fix adc lpcg indices (git-fixes)
  • arm64: dts: imx8-ss-dma: fix can lpcg indices (git-fixes)
  • arm64: dts: imx8-ss-dma: fix spi lpcg indices (git-fixes)
  • arm64: dts: imx8-ss-lsio: fix pwm lpcg indices (git-fixes)
  • arm64: dts: imx8qm-ss-dma: fix can lpcg indices (git-fixes)
  • arm64: dts: marvell: reorder crypto interrupts on Armada SoCs (git-fixes)
  • arm64: dts: microchip: sparx5: fix mdio reg (git-fixes)
  • arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)
  • arm64: dts: rockchip: Add enable-strobe-pulldown to emmc phy on ROCK (git-fixes)
  • arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 (git-fixes)
  • arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for (git-fixes)
  • arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 (git-fixes)
  • arm64: dts: rockchip: fix rk3328 hdmi ports node (git-fixes)
  • arm64: dts: rockchip: fix rk3399 hdmi ports node (git-fixes)
  • arm64: dts: rockchip: regulator for sd needs to be always on for (git-fixes)
  • arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro (git-fixes)
  • arm64: dts: rockchip: set PHY address of MT7531 switch to 0x1f (git-fixes)
  • arm64: hibernate: Fix level3 translation fault in swsusp_save() (git-fixes).
  • arm64: tegra: Correct Tegra132 I2C alias (git-fixes)
  • arm64: tegra: Set the correct PHY mode for MGBE (git-fixes)
  • arm64/head: Disable MMU at EL2 before clearing HCR_EL2.E2H (git-fixes).
  • arm64/ptrace: Use saved floating point state type to determine SVE (git-fixes)
  • arm64/sve: Lower the maximum allocation for the SVE ptrace regset (git-fixes)
  • asm-generic: make sparse happy with odd-sized put_unaligned_*() (stable-fixes).
  • ASoC: acp: Support microphone from device Acer 315-24p (git-fixes).
  • ASoC: amd: acp: fix for acp_init function error handling (git-fixes).
  • ASoC: amd: yc: Add Lenovo ThinkBook 21J0 into DMI quirk table (stable-fixes).
  • ASoC: amd: yc: Fix non-functional mic on ASUS M7600RE (stable-fixes).
  • ASoC: amd: yc: Fix non-functional mic on Lenovo 21J2 (stable-fixes).
  • ASoC: amd: yc: Revert 'Fix non-functional mic on Lenovo 21J2' (stable-fixes).
  • ASoC: codecs: wsa881x: set clk_stop_mode1 flag (git-fixes).
  • ASoC: cs35l41: Update DSP1RX5/6 Sources for DSP config (git-fixes).
  • ASoC: cs35l56: Fix unintended bus access while resetting amp (git-fixes).
  • ASoC: cs35l56: Prevent overwriting firmware ASP config (git-fixes).
  • ASoC: da7219-aad: fix usage of device_get_named_child_node() (git-fixes).
  • ASoC: Intel: avs: Fix ASRC module initialization (git-fixes).
  • ASoC: Intel: avs: Fix potential integer overflow (git-fixes).
  • ASoC: Intel: avs: Populate board selection with new I2S entries (stable-fixes).
  • ASoC: Intel: avs: Set name of control as in topology (git-fixes).
  • ASoC: Intel: avs: ssm4567: Do not ignore route checks (git-fixes).
  • ASoC: Intel: avs: Test result of avs_get_module_entry() (git-fixes).
  • ASoC: Intel: bytcr_rt5640: Apply Asus T100TA quirk to Asus T100TAM too (git-fixes).
  • ASoC: Intel: common: DMI remap for rebranded Intel NUC M15 (LAPRC710) laptops (stable-fixes).
  • ASoC: Intel: Disable route checks for Skylake boards (git-fixes).
  • ASoC: kirkwood: Fix potential NULL dereference (git-fixes).
  • ASoC: mediatek: Assign dummy when codec not specified for a DAI link (git-fixes).
  • ASoC: mediatek: mt8192: fix register configuration for tdm (git-fixes).
  • ASoC: meson: axg-card: make links nonatomic (git-fixes).
  • ASoC: meson: axg-fifo: use FIELD helpers (stable-fixes).
  • ASoC: meson: axg-fifo: use threaded irq to check periods (git-fixes).
  • ASoC: meson: axg-tdm-interface: manage formatters in trigger (git-fixes).
  • ASoC: meson: cards: select SND_DYNAMIC_MINORS (git-fixes).
  • ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw (git-fixes).
  • ASoC: rockchip: i2s-tdm: Fix inaccurate sampling rates (git-fixes).
  • ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating (git-fixes).
  • ASoC: rt5645: Make LattePanda board DMI match more precise (stable-fixes).
  • ASoC: rt5682-sdw: fix locking sequence (git-fixes).
  • ASoC: rt711-sdca: fix locking sequence (git-fixes).
  • ASoC: rt711-sdw: fix locking sequence (git-fixes).
  • ASoC: rt712-sdca-sdw: fix locking sequence (git-fixes).
  • ASoC: rt715-sdca: volume step modification (git-fixes).
  • ASoC: rt715: add vendor clear control register (git-fixes).
  • ASoC: rt722-sdca-sdw: fix locking sequence (git-fixes).
  • ASoC: rt722-sdca: add headset microphone vrefo setting (git-fixes).
  • ASoC: rt722-sdca: modify channel number to support 4 channels (git-fixes).
  • ASoC: soc-core.c: Skip dummy codec when adding platforms (stable-fixes).
  • ASoC: SOF: amd: Optimize quirk for Valve Galileo (stable-fixes).
  • ASoC: SOF: Intel: add default firmware library path for LNL (git-fixes).
  • ASoC: SOF: Intel: hda-dsp: Skip IMR boot on ACE platforms in case of S3 suspend (stable-fixes).
  • ASoC: SOF: Intel: lnl: Correct rom_status_reg (git-fixes).
  • ASoC: SOF: Intel: mtl: call dsp dump when boot retry fails (stable-fixes).
  • ASoC: SOF: Intel: mtl: Correct rom_status_reg (git-fixes).
  • ASoC: SOF: Intel: mtl: Disable interrupts when firmware boot failed (git-fixes).
  • ASoC: SOF: Intel: mtl: Implement firmware boot state check (git-fixes).
  • ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend (stable-fixes).
  • ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension (git-fixes).
  • ASoC: tas2552: Add TX path for capturing AUDIO-OUT data (git-fixes).
  • ASoC: tas2781: Fix a warning reported by robot kernel test (git-fixes).
  • ASoC: tas2781: Fix wrong loading calibrated data sequence (git-fixes).
  • ASoC: tas2781: mark dvc_tlv with __maybe_unused (git-fixes).
  • ASoC: tegra: Fix DSPK 16-bit playback (git-fixes).
  • ASoC: ti: Convert Pandora ASoC to GPIO descriptors (stable-fixes).
  • ASoC: ti: davinci-mcasp: Fix race condition during probe (git-fixes).
  • ASoC: tlv320adc3xxx: Do not strip remove function when driver is builtin (git-fixes).
  • ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).
  • ASoC: wm_adsp: Add missing MODULE_DESCRIPTION() (git-fixes).
  • ASoC: wm_adsp: Fix missing mutex_lock in wm_adsp_write_ctl() (git-fixes).
  • ata: libata-core: Allow command duration limits detection for ACS-4 drives (git-fixes).
  • ata: pata_legacy: make legacy_exit() work again (git-fixes).
  • ata: sata_gemini: Check clk_enable() result (stable-fixes).
  • ata: sata_mv: Fix PCI device ID table declaration compilation warning (git-fixes).
  • ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit (git-fixes).
  • autofs: use wake_up() instead of wake_up_interruptible(() (bsc#1224166).
  • ax25: Fix netdev refcount issue (git-fixes).
  • ax25: Fix reference count leak issue of net_device (git-fixes).
  • ax25: Fix reference count leak issues of ax25_dev (git-fixes).
  • ax25: fix use-after-free bugs caused by ax25_ds_del_timer (git-fixes).
  • batman-adv: Avoid infinite loop trying to resize local TT (git-fixes).
  • bitops: add missing prototype check (git-fixes).
  • blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (bsc#1225605).
  • blk-cgroup: fix list corruption from resetting io stat (bsc#1225605).
  • block: fix q->blkg_list corruption during disk rebind (bsc#1223591).
  • Bluetooth: Add new quirk for broken read key length on ATS2851 (stable-fixes).
  • Bluetooth: add quirk for broken address properties (git-fixes).
  • Bluetooth: btintel: Fix null ptr deref in btintel_read_version (stable-fixes).
  • Bluetooth: btintel: Fixe build regression (git-fixes).
  • Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 (stable-fixes).
  • Bluetooth: btusb: Fix triggering coredump implementation for QCA (git-fixes).
  • Bluetooth: Fix memory leak in hci_req_sync_complete() (git-fixes).
  • Bluetooth: Fix TOCTOU in HCI debugfs implementation (git-fixes).
  • Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() (stable-fixes).
  • Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (git-fixes).
  • Bluetooth: hci_core: Cancel request on command timeout (stable-fixes).
  • Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE (git-fixes).
  • Bluetooth: hci_event: set the conn encrypted before conn establishes (stable-fixes).
  • Bluetooth: hci_sock: Fix not validating setsockopt user input (git-fixes).
  • Bluetooth: hci_sync: Fix not checking error on hci_cmd_sync_cancel_sync (git-fixes).
  • Bluetooth: hci_sync: Fix using the same interval and window for Coded PHY (git-fixes).
  • Bluetooth: hci_sync: Use QoS to determine which PHY to scan (stable-fixes).
  • Bluetooth: HCI: Fix potential null-ptr-deref (git-fixes).
  • Bluetooth: ISO: Align broadcast sync_timeout with connection timeout (stable-fixes).
  • Bluetooth: ISO: Do not reject BT_ISO_QOS if parameters are unset (git-fixes).
  • Bluetooth: l2cap: Do not double set the HCI_CONN_MGMT_CONNECTED bit (git-fixes).
  • Bluetooth: L2CAP: Fix not validating setsockopt user input (git-fixes).
  • Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (git-fixes).
  • Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() (git-fixes).
  • Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (bsc#1221504).
  • Bluetooth: mgmt: Fix limited discoverable off timeout (stable-fixes).
  • Bluetooth: msft: fix slab-use-after-free in msft_do_close() (git-fixes).
  • Bluetooth: qca: add missing firmware sanity checks (git-fixes).
  • Bluetooth: qca: fix device-address endianness (git-fixes).
  • Bluetooth: qca: Fix error code in qca_read_fw_build_info() (git-fixes).
  • Bluetooth: qca: fix firmware check error path (git-fixes).
  • Bluetooth: qca: fix info leak when fetching fw build id (git-fixes).
  • Bluetooth: qca: fix NULL-deref on non-serdev setup (git-fixes).
  • Bluetooth: qca: fix NULL-deref on non-serdev suspend (git-fixes).
  • Bluetooth: qca: fix NVM configuration parsing (git-fixes).
  • Bluetooth: RFCOMM: Fix not validating setsockopt user input (git-fixes).
  • Bluetooth: SCO: Fix not validating setsockopt user input (git-fixes).
  • bnx2x: Fix firmware version string character counts (git-fixes).
  • bnxt_en: Fix error recovery for RoCE ulp client (git-fixes).
  • bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() (git-fixes).
  • bnxt_en: Reset PTP tx_avail after possible firmware reset (git-fixes).
  • bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (git-fixes)
  • bootconfig: Fix the kerneldoc of _xbc_exit() (git-fixes).
  • bootconfig: use memblock_free_late to free xbc memory to buddy (git-fixes).
  • bootmem: use kmemleak_free_part_phys in free_bootmem_page (git-fixes).
  • bootmem: use kmemleak_free_part_phys in put_page_bootmem (git-fixes).
  • bpf, arm64: fix bug in BPF_LDX_MEMSX (git-fixes)
  • bpf, arm64: Fix incorrect runtime stats (git-fixes)
  • bpf, scripts: Correct GPL license name (git-fixes).
  • bpf: fix precision backtracking instruction iteration (bsc#1225756).
  • bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END (git-fixes).
  • bpf: handle ldimm64 properly in check_cfg() (bsc#1225756).
  • btrfs: add a helper to read the superblock metadata_uuid (git-fixes)
  • btrfs: add and use helper to check if block group is used (bsc#1220120).
  • btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (git-fixes)
  • btrfs: add new unused block groups to the list of unused block groups (bsc#1220120).
  • btrfs: allow to run delayed refs by bytes to be released instead of count (bsc#1220120).
  • btrfs: always clear PERTRANS metadata during commit (git-fixes)
  • btrfs: always print transaction aborted messages with an error level (git-fixes)
  • btrfs: always reserve space for delayed refs when starting transaction (bsc#1220120).
  • btrfs: assert correct lock is held at btrfs_select_ref_head() (bsc#1220120).
  • btrfs: assert delayed node locked when removing delayed item (git-fixes)
  • btrfs: avoid start and commit empty transaction when flushing qgroups (bsc#1220120).
  • btrfs: avoid start and commit empty transaction when starting qgroup rescan (bsc#1220120).
  • btrfs: avoid starting and committing empty transaction when flushing space (bsc#1220120).
  • btrfs: avoid starting new transaction when flushing delayed items and refs (bsc#1220120).
  • btrfs: check for BTRFS_FS_ERROR in pending ordered assert (git-fixes)
  • btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super (git-fixes)
  • btrfs: defrag: avoid unnecessary defrag caused by incorrect extent size (git-fixes)
  • btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args (git-fixes)
  • btrfs: do not allow non subvolume root targets for snapshot (git-fixes)
  • btrfs: do not arbitrarily slow down delalloc if we're committing (git-fixes)
  • btrfs: do not delete unused block group if it may be used soon (bsc#1220120).
  • btrfs: do not refill whole delayed refs block reserve when starting transaction (bsc#1220120).
  • btrfs: do not start transaction when joining with TRANS_JOIN_NOSTART (git-fixes)
  • btrfs: do not steal space from global rsv after a transaction abort (bsc#1220120).
  • btrfs: do not warn if discard range is not aligned to sector (git-fixes)
  • btrfs: ensure fiemap does not race with writes when FIEMAP_FLAG_SYNC is given (bsc#1223285).
  • btrfs: error out when COWing block using a stale transaction (git-fixes)
  • btrfs: error out when reallocating block for defrag using a stale transaction (git-fixes)
  • btrfs: error when COWing block from a root that is being deleted (git-fixes)
  • btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (git-fixes)
  • btrfs: fail priority metadata ticket with real fs error (bsc#1220120).
  • btrfs: file_remove_privs needs an exclusive lock in direct io write (git-fixes)
  • btrfs: fix 64bit compat send ioctl arguments not initializing version member (git-fixes)
  • btrfs: fix deadlock with fiemap and extent locking (bsc#1223285).
  • btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (git-fixes)
  • btrfs: fix kvcalloc() arguments order in btrfs_ioctl_send() (git-fixes)
  • btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)
  • btrfs: fix off-by-one chunk length calculation at contains_pending_extent() (git-fixes)
  • btrfs: fix off-by-one when checking chunk map includes logical address (git-fixes)
  • btrfs: fix race between ordered extent completion and fiemap (bsc#1223285).
  • btrfs: fix race when detecting delalloc ranges during fiemap (bsc#1223285).
  • btrfs: fix race when refilling delayed refs block reserve (git-fixes)
  • btrfs: fix start transaction qgroup rsv double free (git-fixes)
  • btrfs: fix stripe length calculation for non-zoned data chunk allocation (bsc#1217489).
  • btrfs: fix wrong block_start calculation for btrfs_drop_extent_map_range() (git-fixes) Dropped hunk in selftests (test_case_7), 92e1229b204d6.
  • btrfs: free qgroup rsv on io failure (git-fixes)
  • btrfs: free the allocated memory if btrfs_alloc_page_array() fails (git-fixes)
  • btrfs: get rid of label and goto at insert_delayed_ref() (bsc#1220120).
  • btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (git-fixes)
  • btrfs: handle errors properly in update_inline_extent_backref() (git-fixes)
  • btrfs: initialize key where it's used when running delayed data ref (bsc#1220120).
  • btrfs: log message if extent item not found when running delayed extent op (bsc#1220120).
  • btrfs: make btrfs_cleanup_fs_roots() static (bsc#1220120).
  • btrfs: make btrfs_destroy_delayed_refs() return void (bsc#1220120).
  • btrfs: make btrfs_destroy_marked_extents() return void (bsc#1220120).
  • btrfs: make btrfs_destroy_pinned_extent() return void (bsc#1220120).
  • btrfs: make error messages more clear when getting a chunk map (git-fixes)
  • btrfs: make find_first_extent_bit() return a boolean (bsc#1220120).
  • btrfs: make find_free_dev_extent() static (bsc#1220120).
  • btrfs: make insert_delayed_ref() return a bool instead of an int (bsc#1220120).
  • btrfs: merge find_free_dev_extent() and find_free_dev_extent_start() (bsc#1220120).
  • btrfs: move btrfs_free_excluded_extents() into block-group.c (bsc#1220120).
  • btrfs: open code trivial btrfs_add_excluded_extent() (bsc#1220120).
  • btrfs: output extra debug info if we failed to find an inline backref (git-fixes)
  • btrfs: pass a space_info argument to btrfs_reserve_metadata_bytes() (bsc#1220120).
  • btrfs: prevent transaction block reserve underflow when starting transaction (git-fixes)
  • btrfs: print available space across all block groups when dumping space info (bsc#1220120).
  • btrfs: print available space for a block group when dumping a space info (bsc#1220120).
  • btrfs: print block group super and delalloc bytes when dumping space info (bsc#1220120).
  • btrfs: print target number of bytes when dumping free space (bsc#1220120).
  • btrfs: qgroup: always free reserved space for extent records (bsc#1216196).
  • btrfs: qgroup: convert PREALLOC to PERTRANS after record_root_in_trans (git-fixes)
  • btrfs: record delayed inode root in transaction (git-fixes)
  • btrfs: reject encoded write if inode has nodatasum flag set (git-fixes)
  • btrfs: release path before inode lookup during the ino lookup ioctl (git-fixes)
  • btrfs: remove pointless 'ref_root' variable from run_delayed_data_ref() (bsc#1220120).
  • btrfs: remove pointless in_tree field from struct btrfs_delayed_ref_node (bsc#1220120).
  • btrfs: remove pointless initialization at btrfs_delayed_refs_rsv_release() (bsc#1220120).
  • btrfs: remove redundant BUG_ON() from __btrfs_inc_extent_ref() (bsc#1220120).
  • btrfs: remove refs_to_add argument from __btrfs_inc_extent_ref() (bsc#1220120).
  • btrfs: remove refs_to_drop argument from __btrfs_free_extent() (bsc#1220120).
  • btrfs: remove the refcount warning/check at btrfs_put_delayed_ref() (bsc#1220120).
  • btrfs: remove unnecessary logic when running new delayed references (bsc#1220120).
  • btrfs: remove unnecessary prototype declarations at disk-io.c (bsc#1220120).
  • btrfs: remove unused is_head field from struct btrfs_delayed_ref_node (bsc#1220120).
  • btrfs: rename add_new_free_space() to btrfs_add_new_free_space() (bsc#1220120).
  • btrfs: reorder some members of struct btrfs_delayed_ref_head (bsc#1220120).
  • btrfs: reserve space for delayed refs on a per ref basis (bsc#1220120).
  • btrfs: reset destination buffer when read_extent_buffer() gets invalid range (git-fixes)
  • btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 (git-fixes)
  • btrfs: return -EUCLEAN if extent item is missing when searching inline backref (bsc#1220120).
  • btrfs: return real error when orphan cleanup fails due to a transaction abort (bsc#1220120).
  • btrfs: send: do not issue unnecessary zero writes for trailing hole (bsc#1222459).
  • btrfs: send: ensure send_fd is writable (git-fixes)
  • btrfs: send: handle path ref underflow in header iterate_inode_ref() (git-fixes)
  • btrfs: send: return EOPNOTSUPP on unknown flags (git-fixes)
  • btrfs: set page extent mapped after read_folio in relocate_one_page (git-fixes)
  • btrfs: simplify check for extent item overrun at lookup_inline_extent_backref() (bsc#1220120).
  • btrfs: stop doing excessive space reservation for csum deletion (bsc#1220120).
  • btrfs: store the error that turned the fs into error state (bsc#1220120).
  • btrfs: sysfs: validate scrub_speed_max value (git-fixes)
  • btrfs: tree-checker: fix inline ref size in error messages (git-fixes)
  • btrfs: update comment for btrfs_join_transaction_nostart() (bsc#1220120).
  • btrfs: update documentation for add_new_free_space() (bsc#1220120).
  • btrfs: use a bool to track qgroup record insertion when adding ref head (bsc#1220120).
  • btrfs: use a single switch statement when initializing delayed ref head (bsc#1220120).
  • btrfs: use a single variable for return value at lookup_inline_extent_backref() (bsc#1220120).
  • btrfs: use a single variable for return value at run_delayed_extent_op() (bsc#1220120).
  • btrfs: use bool type for delayed ref head fields that are used as booleans (bsc#1220120).
  • btrfs: use the correct superblock to compare fsid in btrfs_validate_super (git-fixes)
  • btrfs: use u64 for buffer sizes in the tree search ioctls (git-fixes)
  • btrfs: zoned: do not skip block groups with 100% zone unusable (bsc#1220120).
  • bus: mhi: ep: check the correct variable in mhi_ep_register_controller() (git-fixes).
  • ceph: redirty page before returning AOP_WRITEPAGE_ACTIVATE (bsc#1224866).
  • ceph: stop copying to iter at EOF on sync reads (bsc#1222606).
  • certs: Add ECDSA signature verification self-test (bsc#1222777).
  • certs: Move RSA self-test data to separate file (bsc#1222777).
  • clk: Do not hold prepare_lock when calling kref_put() (stable-fixes).
  • clk: Get runtime PM before walking tree during disable_unused (git-fixes).
  • clk: Get runtime PM before walking tree for clk_summary (git-fixes).
  • clk: Initialize struct clk_core kref earlier (stable-fixes).
  • clk: mediatek: Do a runtime PM get on controllers during probe (git-fixes).
  • clk: mediatek: mt8365-mm: fix DPI0 parent (git-fixes).
  • clk: mediatek: pllfh: Do not log error for missing fhctl node (git-fixes).
  • clk: qcom: clk-alpha-pll: fix rate setting for Stromer PLLs (git-fixes).
  • clk: qcom: clk-alpha-pll: remove invalid Stromer register offset (git-fixes).
  • clk: qcom: dispcc-sm6350: fix DisplayPort clocks (git-fixes).
  • clk: qcom: dispcc-sm8450: fix DisplayPort clocks (git-fixes).
  • clk: qcom: dispcc-sm8550: fix DisplayPort clocks (git-fixes).
  • clk: qcom: mmcc-msm8998: fix venus clock issue (git-fixes).
  • clk: qcom: reset: Commonize the de/assert functions (stable-fixes).
  • clk: qcom: reset: Ensure write completion on reset de/assertion (git-fixes).
  • clk: Remove prepare_lock hold assertion in __clk_release() (git-fixes).
  • clk: renesas: r8a779a0: Fix CANFD parent clock (git-fixes).
  • clk: renesas: r9a07g043: Add clock and reset entry for PLIC (git-fixes).
  • clk: rs9: fix wrong default value for clock amplitude (git-fixes).
  • clk: samsung: exynosautov9: fix wrong pll clock id value (git-fixes).
  • clk: Show active consumers of clocks in debugfs (stable-fixes).
  • clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change (git-fixes).
  • clocksource/drivers/arm_global_timer: Fix maximum prescaler value (git-fixes).
  • clocksource/drivers/imx: Fix -Wunused-but-set-variable warning (git-fixes).
  • comedi: vmk80xx: fix incomplete endpoint checking (git-fixes).
  • coresight: trbe: Add a representative coresight_platform_data for (bsc#1220587)
  • coresight: trbe: Allocate platform data per device (bsc#1220587)
  • coresight: trbe: Enable ACPI based TRBE devices (bsc#1220587)
  • counter: linux/counter.h: fix Excess kernel-doc description warning (git-fixes).
  • cppc_cpufreq: Fix possible null pointer dereference (git-fixes).
  • cpufreq: brcmstb-avs-cpufreq: ISO C90 forbids mixed declarations (git-fixes).
  • cpufreq: exit() callback is optional (git-fixes).
  • cpumask: Add for_each_cpu_from() (bsc#1225053).
  • crypto: bcm - Fix pointer arithmetic (git-fixes).
  • crypto: ccp - Add support for PCI device 0x156E (bsc#1223338).
  • crypto: ccp - Add support for PCI device 0x17E0 (bsc#1223338).
  • crypto: ccp - drop platform ifdef checks (git-fixes).
  • crypto: ecc - update ecc_gen_privkey for FIPS 186-5 (bsc#1222782).
  • crypto: ecdsa - Fix module auto-load on add-key (git-fixes).
  • crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init (git-fixes).
  • crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (git-fixes).
  • crypto: qat - fix ring to service map for dcc in 4xxx (git-fixes).
  • crypto: qat - improve error logging to be consistent across features (git-fixes).
  • crypto: qat - relocate and rename get_service_enabled() (stable-fixes).
  • crypto: qat - specify firmware files for 402xx (git-fixes).
  • crypto: rsa - add a check for allocation failure (bsc#1222775).
  • crypto: rsa - allow only odd e and restrict value in FIPS mode (bsc#1222775).
  • crypto: testmgr - remove unused xts4096 and xts512 algorithms from testmgr.c (bsc#1222769).
  • crypto: x86/nh-avx2 - add missing vzeroupper (git-fixes).
  • crypto: x86/sha256-avx2 - add missing vzeroupper (git-fixes).
  • crypto: x86/sha512-avx2 - add missing vzeroupper (git-fixes).
  • cxl/acpi: Fix load failures due to single window creation failure (git-fixes).
  • cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window (git-fixes).
  • cxl/trace: Properly initialize cxl_poison region name (git-fixes).
  • dax: alloc_dax() return ERR_PTR(-EOPNOTSUPP) for CONFIG_DAX=n (jsc#PED-5853).
  • dax/bus.c: replace driver-core lock usage by a local rwsem (jsc#PED-5853).
  • dax/bus.c: replace several sprintf() with sysfs_emit() (jsc#PED-5853).
  • device-dax: make dax_bus_type const (jsc#PED-5853).
  • dlm: fix user space lkb refcounting (git-fixes).
  • dm crypt: remove redundant state settings after waking up (jsc#PED-7542).
  • dm thin: add braces around conditional code that spans lines (jsc#PED-7542).
  • dm verity: set DM_TARGET_SINGLETON feature flag (jsc#PED-7542).
  • dm-integrity: set max_integrity_segments in dm_integrity_io_hints (jsc#PED-7542).
  • dm-multipath: dont't attempt SG_IO on non-SCSI-disks (bsc#1223575).
  • dm-raid: add a new helper prepare_suspend() in md_personality (jsc#PED-7542).
  • dm-raid: really frozen sync_thread during suspend (jsc#PED-7542).
  • dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape (bsc#1219596)
  • dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list (jsc#PED-7542).
  • dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users (git-fixes).
  • dma-buf: Fix NULL pointer dereference in sanitycheck() (git-fixes).
  • dma-buf/sw-sync: do not enable IRQ from sync_print_obj() (git-fixes).
  • dma-mapping: benchmark: fix node id validation (git-fixes).
  • dma-mapping: benchmark: handle NUMA_NO_NODE correctly (git-fixes).
  • dma: xilinx_dpdma: Fix locking (git-fixes).
  • dmaengine: axi-dmac: fix possible race in remove() (git-fixes).
  • dmaengine: idma64: Add check for dma_set_max_seg_size (git-fixes).
  • dmaengine: idxd: Avoid unnecessary destruction of file_ida (git-fixes).
  • dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (git-fixes).
  • dmaengine: owl: fix register access functions (git-fixes).
  • dmaengine: tegra186: Fix residual calculation (git-fixes).
  • driver core: Introduce device_link_wait_removal() (stable-fixes).
  • drivers/nvme: Add quirks for device 126f:2262 (git-fixes).
  • drm: add drm_gem_object_is_shared_for_memory_stats() helper (stable-fixes).
  • drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference (git-fixes).
  • drm: Check output polling initialized before disabling (stable-fixes).
  • drm: Check polling initialized before enabling in drm_helper_probe_single_connector_modes (stable-fixes).
  • drm: Fix drm_fixp2int_round() making it add 0.5 (git-fixes).
  • drm: nv04: Fix out of bounds access (git-fixes).
  • drm: panel-orientation-quirks: Add quirk for GPD Win Mini (stable-fixes).
  • drm: vc4: Fix possible null pointer dereference (git-fixes).
  • drm: zynqmp_dpsub: Always register bridge (git-fixes).
  • drm/amd: Flush GFXOFF requests in prepare stage (git-fixes).
  • drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() (stable-fixes).
  • drm/amd/display: Add dml2 copy functions (stable-fixes).
  • drm/amd/display: Allow dirty rects to be sent to dmub when abm is active (stable-fixes).
  • drm/amd/display: Atom Integrated System Info v2_2 for DCN35 (stable-fixes).
  • drm/amd/display: Change default size for dummy plane in DML2 (stable-fixes).
  • drm/amd/display: Do not recursively call manual trigger programming (stable-fixes).
  • drm/amd/display: Enable colorspace property for MST connectors (git-fixes).
  • drm/amd/display: Fix bounds check for dcn35 DcfClocks (git-fixes).
  • drm/amd/display: fix disable otg wa logic in DCN316 (stable-fixes).
  • drm/amd/display: Fix division by zero in setup_dsc_config (stable-fixes).
  • drm/amd/display: Fix idle check for shared firmware state (stable-fixes).
  • drm/amd/display: Fix incorrect DSC instance for MST (stable-fixes).
  • drm/amd/display: fix input states translation error for dcn35 & dcn351 (stable-fixes).
  • drm/amd/display: Fix nanosec stat overflow (stable-fixes).
  • drm/amd/display: Fix noise issue on HDMI AV mute (stable-fixes).
  • drm/amd/display: Fix potential index out of bounds in color transformation function (git-fixes).
  • drm/amd/display: handle range offsets in VRR ranges (stable-fixes).
  • drm/amd/display: Handle Y carry-over in VCP X.Y calculation (stable-fixes).
  • drm/amd/display: Init DPPCLK from SMU on dcn32 (stable-fixes).
  • drm/amd/display: Override min required DCFCLK in dml1_validate (stable-fixes).
  • drm/amd/display: Prevent crash when disable stream (stable-fixes).
  • drm/amd/display: Program VSC SDP colorimetry for all DP sinks >= 1.4 (stable-fixes).
  • drm/amd/display: Remove MPC rate control logic from DCN30 and above (stable-fixes).
  • drm/amd/display: Remove redundant condition in dcn35_calc_blocks_to_gate() (git-fixes).
  • drm/amd/display: Return the correct HDCP error code (stable-fixes).
  • drm/amd/display: Send DTBCLK disable message on first commit (git-fixes).
  • drm/amd/display: Set DCN351 BB and IP the same as DCN35 (stable-fixes).
  • drm/amd/display: Set VSC SDP Colorimetry same way for MST and SST (stable-fixes).
  • drm/amd/display: Update odm when ODM combine is changed on an otg master pipe with no plane (stable-fixes).
  • drm/amd/display: Use freesync when DRM_EDID_FEATURE_CONTINUOUS_FREQ found (stable-fixes).
  • drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 (stable-fixes).
  • drm/amd/swsmu: modify the gfx activity scaling (stable-fixes).
  • drm/amdgpu: always force full reset for SOC21 (stable-fixes).
  • drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag (stable-fixes).
  • drm/amdgpu: Assign correct bits for SDMA HDP flush (stable-fixes).
  • drm/amdgpu: drop setting buffer funcs in sdma442 (git-fixes).
  • drm/amdgpu: Enable gpu reset for S3 abort cases on Raven series (stable-fixes).
  • drm/amdgpu: Fix comparison in amdgpu_res_cpu_visible (git-fixes).
  • drm/amdgpu: fix deadlock while reading mqd from debugfs (git-fixes).
  • drm/amdgpu: fix doorbell regression (git-fixes).
  • drm/amdgpu: fix incorrect number of active RBs for gfx11 (stable-fixes).
  • drm/amdgpu: Fix leak when GPU memory allocation fails (stable-fixes).
  • drm/amdgpu: fix mmhub client id out-of-bounds access (git-fixes).
  • drm/amdgpu: fix use-after-free bug (stable-fixes).
  • drm/amdgpu: Fix VCN allocation in CPX partition (stable-fixes).
  • drm/amdgpu: fix visible VRAM handling during faults (git-fixes).
  • drm/amdgpu: implement IRQ_STATE_ENABLE for SDMA v4.4.2 (stable-fixes).
  • drm/amdgpu: make damage clips support configurable (stable-fixes).
  • drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 (git-fixes).
  • drm/amdgpu: Refine IB schedule error logging (stable-fixes).
  • drm/amdgpu: remove invalid resource->start check v2 (git-fixes).
  • drm/amdgpu: Reset dGPU if suspend got aborted (stable-fixes).
  • drm/amdgpu: validate the parameters of bo mapping operations more clearly (git-fixes).
  • drm/amdgpu/display: Address kdoc for 'is_psr_su' in 'fill_dc_dirty_rects' (git-fixes).
  • drm/amdgpu/pm: Check the validity of overdiver power limit (git-fixes).
  • drm/amdgpu/pm: Fix NULL pointer dereference when get power limit (git-fixes).
  • drm/amdgpu/pm: Fix the error of pwm1_enable setting (stable-fixes).
  • drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 (stable-fixes).
  • drm/amdkfd: Check cgroup when returning DMABuf info (stable-fixes).
  • drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (git-fixes).
  • drm/amdkfd: Fix memory leak in create_process failure (git-fixes).
  • drm/amdkfd: fix TLB flush after unmap for GFX9.4.2 (stable-fixes).
  • drm/amdkfd: range check cp bad op exception interrupts (stable-fixes).
  • drm/amdkfd: Reset GPU on queue preemption failure (stable-fixes).
  • drm/arm/malidp: fix a possible null pointer dereference (git-fixes).
  • drm/ast: Fix soft lockup (git-fixes).
  • drm/bridge: anx7625: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: anx7625: Update audio status while detecting (git-fixes).
  • drm/bridge: dpc3433: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: Fix improper bridge init order with pre_enable_prev_first (git-fixes).
  • drm/bridge: icn6211: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: lt8912b: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: lt9611: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: lt9611uxc: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: tc358775: Do not log an error when DSI host can't be found (git-fixes).
  • drm/bridge: tc358775: fix support for jeida-18 and jeida-24 (git-fixes).
  • drm/buddy: check range allocation matches alignment (stable-fixes).
  • drm/ci: update device type for volteer devices (git-fixes).
  • drm/client: Fully protect modes[] with dev->mode_config.mutex (stable-fixes).
  • drm/connector: Add \n to message about demoting connector force-probes (git-fixes).
  • drm/display: fix typo (git-fixes).
  • drm/exynos: do not return negative values from .get_modes() (stable-fixes).
  • drm/fbdev-generic: Do not set physical framebuffer address (git-fixes).
  • drm/gma500: Remove lid code (git-fixes).
  • drm/i915: Disable live M/N updates when using bigjoiner (stable-fixes).
  • drm/i915: Disable port sync when bigjoiner is used (stable-fixes).
  • drm/i915: Do not match JSL in ehl_combo_pll_div_frac_wa_needed() (git-fixes).
  • drm/i915: Fix audio component initialization (git-fixes).
  • drm/i915: Include the PLL name in the debug messages (stable-fixes).
  • drm/i915: Pre-populate the cursor physical dma address (git-fixes).
  • drm/i915: Replace a memset() with zero initialization (stable-fixes).
  • drm/i915: Stop printing pipe name as hex (stable-fixes).
  • drm/i915: Suppress old PLL pipe_mask checks for MG/TC/TBT PLLs (stable-fixes).
  • drm/i915: Try to preserve the current shared_dpll for fastset on type-c ports (stable-fixes).
  • drm/i915: Use named initializers for DPLL info (stable-fixes).
  • drm/i915/audio: Fix audio time stamp programming for DP (stable-fixes).
  • drm/i915/bios: Fix parsing backlight BDB data (git-fixes).
  • drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() (stable-fixes).
  • drm/i915/cdclk: Fix CDCLK programming order when pipes are active (git-fixes).
  • drm/i915/display: Use i915_gem_object_get_dma_address to get dma address (stable-fixes).
  • drm/i915/dp: Fix the computation for compressed_bpp for DISPLAY < 13 (git-fixes).
  • drm/i915/dp: Remove support for UHBR13.5 (git-fixes).
  • drm/i915/dpt: Make DPT object unshrinkable (git-fixes).
  • drm/i915/dsb: Fix DSB vblank waits when using VRR (git-fixes).
  • drm/i915/dsi: Go back to the previous INIT_OTP/DISPLAY_ON order, mostly (git-fixes).
  • drm/i915/gt: Automate CCS Mode setting during engine resets (git-fixes).
  • drm/i915/gt: Disable HW load balancing for CCS (git-fixes).
  • drm/i915/gt: Disarm breadcrumbs if engines are already idle (git-fixes).
  • drm/i915/gt: Do not generate the command streamer for all the CCS (git-fixes).
  • drm/i915/gt: Enable only one CCS for compute workload (git-fixes).
  • drm/i915/gt: Fix CCS id's calculation for CCS mode setting (git-fixes).
  • drm/i915/gt: Reset queue_priority_hint on parking (git-fixes).
  • drm/i915/guc: avoid FIELD_PREP warning (git-fixes).
  • drm/i915/hwmon: Fix locking inversion in sysfs getter (git-fixes).
  • drm/i915/lspcon: Separate function to set expected mode (bsc#1193599).
  • drm/i915/lspcon: Separate lspcon probe and lspcon init (bsc#1193599).
  • drm/i915/mst: Limit MST+DSC to TGL+ (git-fixes).
  • drm/i915/mst: Reject FEC+MST on ICL (git-fixes).
  • drm/i915/mtl: Update workaround 14018575942 (git-fixes).
  • drm/i915/vrr: Disable VRR when using bigjoiner (stable-fixes).
  • drm/i915/vrr: Generate VRR 'safe window' for DSB (git-fixes).
  • drm/imx/ipuv3: do not return negative values from .get_modes() (stable-fixes).
  • drm/lcdif: Do not disable clocks on already suspended hardware (git-fixes).
  • drm/mediatek: Add 0 size check to mtk_drm_gem_obj (git-fixes).
  • drm/mediatek: dp: Fix mtk_dp_aux_transfer return value (git-fixes).
  • drm/mediatek: Init ddp_comp with devm_kcalloc() (git-fixes).
  • drm/meson: dw-hdmi: add bandgap setting for g12 (git-fixes).
  • drm/meson: dw-hdmi: power up phy on device init (git-fixes).
  • drm/meson: gate px_clk when setting rate (git-fixes).
  • drm/meson: vclk: fix calculation of 59.94 fractional rates (git-fixes).
  • drm/msm: Add newlines to some debug prints (git-fixes).
  • drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails (git-fixes).
  • drm/msm/adreno: fix CP cycles stat retrieval on a7xx (git-fixes).
  • drm/msm/dp: allow voltage swing / pre emphasis of 3 (git-fixes).
  • drm/msm/dp: Avoid a long timeout for AUX transfer if nothing connected (git-fixes).
  • drm/msm/dp: fix typo in dp_display_handle_port_status_changed() (git-fixes).
  • drm/msm/dpu: Add callback function pointer check before its call (git-fixes).
  • drm/msm/dpu: Allow configuring multiple active DSC blocks (git-fixes).
  • drm/msm/dpu: Always flush the slave INTF on the CTL (git-fixes).
  • drm/msm/dpu: do not allow overriding data from catalog (git-fixes).
  • drm/msm/dpu: make error messages at dpu_core_irq_register_callback() more sensible (git-fixes).
  • drm/msm/dpu: use devres-managed allocation for MDP TOP (stable-fixes).
  • drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk (git-fixes).
  • drm/nouveau: use tile_mode and pte_kind for VM_BIND bo allocations (git-fixes).
  • drm/nouveau/disp: Fix missing backlight control on Macbook 5, 1 (bsc#1223838).
  • drm/nouveau/dp: Do not probe eDP ports twice harder (stable-fixes).
  • drm/nouveau/dp: Fix incorrect return code in r535_dp_aux_xfer() (git-fixes).
  • drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor() (stable-fixes).
  • drm/omapdrm: Fix console by implementing fb_dirty (git-fixes).
  • drm/panel: do not return negative error codes from drm_panel_get_modes() (stable-fixes).
  • drm/panel: ili9341: Respect deferred probe (git-fixes).
  • drm/panel: ili9341: Use predefined error codes (git-fixes).
  • drm/panel: ltk050h3146w: add MIPI_DSI_MODE_VIDEO to LTK050H3148W flags (git-fixes).
  • drm/panel: ltk050h3146w: drop duplicate commands from LTK050H3148W init (git-fixes).
  • drm/panel: novatek-nt35950: Do not log an error when DSI host can't be found (git-fixes).
  • drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector (git-fixes).
  • drm/panel: sitronix-st7789v: fix display size for jt240mhqs_hwt_ek_e3 panel (git-fixes).
  • drm/panel: sitronix-st7789v: fix timing for jt240mhqs_hwt_ek_e3 panel (git-fixes).
  • drm/panel: sitronix-st7789v: tweak timing for jt240mhqs_hwt_ek_e3 panel (git-fixes).
  • drm/panel: visionox-rm69299: do not unregister DSI device (git-fixes).
  • drm/panfrost: fix power transition timeout warnings (git-fixes).
  • drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() (git-fixes).
  • drm/prime: Unbreak virtgpu dma-buf export (git-fixes).
  • drm/probe-helper: warn about negative .get_modes() (stable-fixes).
  • drm/qxl: remove unused count variable from qxl_surface_id_alloc() (git-fixes).
  • drm/qxl: remove unused variable from qxl_process_single_command() (git-fixes).
  • drm/radeon: make -fstrict-flex-arrays=3 happy (git-fixes).
  • drm/radeon: silence UBSAN warning (v3) (stable-fixes).
  • drm/rockchip: vop2: Do not divide height twice for YUV (git-fixes).
  • drm/rockchip: vop2: Remove AR30 and AB30 format support (git-fixes).
  • drm/sched: fix null-ptr-deref in init entity (git-fixes).
  • drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (git-fixes).
  • drm/ttm: return ENOSPC from ttm_bo_mem_space v3 (stable-fixes).
  • drm/ttm: stop pooling cached NUMA pages v2 (git-fixes).
  • drm/vc4: do not check if plane->state->fb == state->fb (stable-fixes).
  • drm/vc4: hdmi: do not return negative values from .get_modes() (stable-fixes).
  • drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (git-fixes).
  • drm/vmwgfx: Enable DMA mappings with SEV (git-fixes).
  • drm/vmwgfx: Fix crtc's atomic check conditional (git-fixes).
  • drm/vmwgfx: Fix invalid reads in fence signaled events (git-fixes).
  • drm/vmwgfx: Fix Legacy Display Unit (git-fixes).
  • drm/vmwgfx: Fix prime import/export (git-fixes).
  • drm/vmwgfx: Sort primary plane formats by order of preference (git-fixes).
  • dt-bindings: clock: qcom: Add missing UFS QREF clocks (git-fixes)
  • dump_stack: Do not get cpu_sync for panic CPU (bsc#1225607).
  • dyndbg: fix old BUG_ON in >control parser (stable-fixes).
  • e1000e: Minor flow correction in e1000_shutdown function (git-fixes).
  • e1000e: move force SMBUS from enable ulp function to avoid PHY loss issue (git-fixes).
  • e1000e: Workaround for sporadic MDI error on Meteor Lake systems (git-fixes).
  • ecryptfs: Fix buffer size for tag 66 packet (git-fixes)
  • ecryptfs: Reject casefold directory inodes (git-fixes)
  • EDAC/synopsys: Fix ECC status and IRQ control race condition (git-fixes).
  • efi: disable mirror feature during crashkernel (stable-fixes).
  • efi: fix panic in kdump kernel (git-fixes).
  • efi: libstub: only free priv.runtime_map when allocated (git-fixes).
  • efi/unaccepted: do not let /proc/vmcore try to access unaccepted memory (git-fixes).
  • efi/unaccepted: touch soft lockup during memory accept (git-fixes).
  • extcon: max8997: select IRQ_DOMAIN instead of depending on it (git-fixes).
  • fast_dput(): handle underflows gracefully (git-fixes)
  • fat: fix uninitialized field in nostale filehandles (git-fixes)
  • fbdev: fix incorrect address computation in deferred IO (git-fixes).
  • fbdev: savage: Handle err return when savagefb_check_var failed (git-fixes).
  • fbdev: sh7760fb: allow modular build (git-fixes).
  • fbdev: shmobile: fix snprintf truncation (git-fixes).
  • fbdev: sisfb: hide unused variables (git-fixes).
  • fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 (stable-fixes).
  • fbmon: prevent division by zero in fb_videomode_from_videomode() (stable-fixes).
  • firewire: core: use long bus reset on gap count error (stable-fixes).
  • firewire: ohci: mask bus reset interrupts between ISR and bottom half (stable-fixes).
  • firmware: arm_scmi: Make raw debugfs entries non-seekable (git-fixes).
  • firmware: dmi-id: add a release callback function (git-fixes).
  • firmware: raspberrypi: Use correct device for DMA mappings (git-fixes).
  • firmware: tegra: bpmp: Return directly after a failed kzalloc() in get_filename() (stable-fixes).
  • fs: Fix error checking for d_hash_and_lookup() (git-fixes)
  • fs: indicate request originates from old mount API (git-fixes)
  • fs: relax mount_setattr() permission checks (git-fixes)
  • fs/9p: only translate RWX permissions for plain 9P2000 (git-fixes)
  • fs/9p: translate O_TRUNC into OTRUNC (git-fixes)
  • fsverity: skip PKCS#7 parser when keyring is empty (git-fixes)
  • ftrace: Fix possible use-after-free issue in ftrace_location() (git-fixes).
  • fuse: do not unhash root (bsc#1223946).
  • fuse: fix root lookup with nonzero generation (bsc#1223945).
  • geneve: fix header validation in geneve[6]_xmit_skb (git-fixes).
  • geneve: make sure to pull inner header in geneve_rx() (git-fixes).
  • gpio: cdev: check for NULL labels when sanitizing them for irqs (git-fixes).
  • gpio: cdev: fix missed label sanitizing in debounce_setup() (git-fixes).
  • gpio: cdev: sanitize the label before requesting the interrupt (stable-fixes).
  • gpio: crystalcove: Use -ENOTSUPP consistently (stable-fixes).
  • gpio: tangier: Use correct type for the IRQ chip data (git-fixes).
  • gpio: tegra186: Fix tegra186_gpio_is_accessible() check (git-fixes).
  • gpio: wcove: Use -ENOTSUPP consistently (stable-fixes).
  • gpiolib: cdev: fix uninitialised kfifo (git-fixes).
  • gpiolib: cdev: relocate debounce_period_us from struct gpio_desc (stable-fixes).
  • gpiolib: swnode: Remove wrong header inclusion (git-fixes).
  • gpu: host1x: Do not setup DMA for virtual devices (stable-fixes).
  • gtp: fix use-after-free and null-ptr-deref in gtp_newlink() (git-fixes).
  • HID: amd_sfh: Handle 'no sensors' in PM operations (git-fixes).
  • HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up (git-fixes).
  • HID: input: avoid polling stylus battery on Chromebook Pompom (stable-fixes).
  • HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors (git-fixes).
  • HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc (git-fixes).
  • HID: logitech-dj: allow mice to use all types of reports (git-fixes).
  • HID: multitouch: Add required quirk for Synaptics 0xcddc device (stable-fixes).
  • hwmon: (amc6821) add of_match table (stable-fixes).
  • hwmon: (corsair-cpro) Protect ccp->wait_input_report with a spinlock (git-fixes).
  • hwmon: (corsair-cpro) Use a separate buffer for sending commands (git-fixes).
  • hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() (git-fixes).
  • hwmon: (intel-m10-bmc-hwmon) Fix multiplier for N6000 board power sensor (git-fixes).
  • hwmon: (lm70) fix links in doc and comments (git-fixes).
  • hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us (git-fixes).
  • hwmon: (shtc1) Fix property misspelling (git-fixes).
  • hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init() (git-fixes).
  • i2c: acpi: Unbind mux adapters before delete (git-fixes).
  • i2c: cadence: Avoid fifo clear after start (git-fixes).
  • i2c: pxa: hide unused icr_bits[] variable (git-fixes).
  • i2c: smbus: fix NULL function pointer dereference (git-fixes).
  • i2c: synquacer: Fix an error handling path in synquacer_i2c_probe() (git-fixes).
  • i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame (git-fixes).
  • i3c: master: svc: fix invalidate IBI type and miss call client IBI handler (git-fixes).
  • i40e: disable NAPI right after disabling irqs when handling xsk_pool (git-fixes).
  • i40e: Enforce software interrupt during busy-poll exit (git-fixes).
  • i40e: Fix firmware version comparison function (git-fixes).
  • i40e: fix i40e_count_filters() to count only active/new filters (git-fixes).
  • i40e: Fix VF MAC filter removal (git-fixes).
  • i40e: fix vf may be used uninitialized in this function warning (git-fixes).
  • i915: make inject_virtual_interrupt() void (stable-fixes).
  • IB/mlx5: Use __iowrite64_copy() for write combining stores (git-fixes)
  • ice: fix enabling RX VLAN filtering (git-fixes).
  • ice: fix memory corruption bug with suspend and rebuild (git-fixes).
  • ice: fix stats being updated by way too large values (git-fixes).
  • ice: fix typo in assignment (git-fixes).
  • ice: fix uninitialized dplls mutex usage (git-fixes).
  • ice: reconfig host after changing MSI-X on VF (git-fixes).
  • ice: Refactor FW data type and fix bitmap casting issue (git-fixes).
  • ice: reorder disabling IRQ and NAPI in ice_qp_dis (git-fixes).
  • ice: use relative VSI index for VFs instead of PF VSI number (git-fixes).
  • ice: virtchnl: stop pretending to support RSS over AQ or registers (git-fixes).
  • ida: make 'ida_dump' static (git-fixes).
  • idma64: Do not try to serve interrupts when device is powered off (git-fixes).
  • idpf: disable local BH when scheduling napi for marker packets (git-fixes).
  • idpf: extend tx watchdog timeout (bsc#1224137).
  • idpf: fix kernel panic on unknown packet types (git-fixes).
  • igb: extend PTP timestamp adjustments to i211 (git-fixes).
  • igb: Fix missing time sync events (git-fixes).
  • igc: avoid returning frame twice in XDP_REDIRECT (git-fixes).
  • igc: Fix missing time sync events (git-fixes).
  • igc: Remove stale comment about Tx timestamping (git-fixes).
  • iio: accel: mxc4005: Interrupt handling fixes (git-fixes).
  • iio: adc: stm32: Fixing err code to not indicate success (git-fixes).
  • iio: core: Leave private pointer NULL when no private data supplied (git-fixes).
  • iio: dummy_evgen: remove Excess kernel-doc comments (git-fixes).
  • iio: gts-helper: Fix division loop (git-fixes).
  • iio: pressure: dps310: support negative temperature values (git-fixes).
  • iio: pressure: Fixes BME280 SPI driver data (git-fixes).
  • iio:imu: adis16475: Fix sync mode setting (git-fixes).
  • inet_diag: annotate data-races around inet_diag_table[] (git-fixes).
  • inet: frags: eliminate kernel-doc warning (git-fixes).
  • init: open /initrd.image with O_LARGEFILE (stable-fixes).
  • init/main.c: Fix potential static_command_line memory overflow (git-fixes).
  • Input: allocate keycode for Display refresh rate toggle (stable-fixes).
  • Input: cyapa - add missing input core locking to suspend/resume functions (git-fixes).
  • Input: gpio_keys_polled - suppress deferred probe error for gpio (stable-fixes).
  • Input: imagis - use FIELD_GET where applicable (stable-fixes).
  • Input: ims-pcu - fix printf string overflow (git-fixes).
  • Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation (git-fixes).
  • Input: synaptics-rmi4 - fail probing if memory allocation for 'phys' fails (stable-fixes).
  • Input: xpad - add additional HyperX Controller Identifiers (stable-fixes).
  • Input: xpad - add support for Snakebyte GAMEPADs (stable-fixes).
  • input/touchscreen: imagis: Correct the maximum touch area value (stable-fixes).
  • intel: legacy: Partial revert of field get conversion (git-fixes).
  • interconnect: qcom: osm-l3: Replace custom implementation of COUNT_ARGS() (git-fixes).
  • interconnect: qcom: qcm2290: Fix mas_snoc_bimc QoS port assignment (git-fixes).
  • interconnect: qcom: sc8180x: Mark CO0 BCM keepalive (git-fixes).
  • interconnect: qcom: sm8550: Enable sync_state (git-fixes).
  • io_uring: kabi cookie remove (bsc#1217384).
  • iomap: clear the per-folio dirty bits on all writeback failures (git-fixes)
  • iommu: Map reserved memory as cacheable if device is coherent (git-fixes).
  • iommu/arm-smmu-v3: Check that the RID domain is S1 in SVA (git-fixes).
  • iommu/dma: Force swiotlb_max_mapping_size on an untrusted device (bsc#1224331)
  • iommu/dma: Trace bounce buffer usage when mapping buffers (git-fixes).
  • iommu/vt-d: Allocate local memory for page request queue (git-fixes).
  • iommu/vt-d: Fix wrong use of pasid config (git-fixes).
  • iommu/vt-d: Set SSADE when attaching to a parent with dirty tracking (git-fixes).
  • iommu/vt-d: Update iotlb in nested domain attach (git-fixes).
  • iommufd: Add missing IOMMUFD_DRIVER kconfig for the selftest (git-fixes).
  • iommufd: Fix iopt_access_list_id overwrite bug (git-fixes).
  • iommufd: Reject non-zero data_type if no data_len is provided (git-fixes).
  • iommufd/iova_bitmap: Bounds check mapped::pages access (git-fixes).
  • iommufd/iova_bitmap: Consider page offset for the pages to be pinned (git-fixes).
  • iommufd/iova_bitmap: Switch iova_bitmap::bitmap to an u8 array (git-fixes).
  • ionic: set adminq irq affinity (git-fixes).
  • ipv4: annotate data-races around fi->fib_dead (git-fixes).
  • irqchip/alpine-msi: Fix off-by-one in allocation error path (git-fixes).
  • irqchip/armada-370-xp: Suppress unused-function warning (git-fixes).
  • irqchip/gic-v3-its: Do not assume vPE tables are preallocated (git-fixes).
  • irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1 (git-fixes).
  • irqchip/gic-v3-its: Prevent double free on error (git-fixes).
  • irqchip/loongson-pch-msi: Fix off-by-one on allocation error path (git-fixes).
  • irqchip/mbigen: Do not use bus_get_dev_root() to find the parent (git-fixes).
  • irqchip/renesas-rzg2l: Add macro to retrieve TITSR register offset based on register's index (stable-fixes).
  • irqchip/renesas-rzg2l: Flush posted write in irq_eoi() (git-fixes).
  • irqchip/renesas-rzg2l: Implement restriction when writing ISCR register (stable-fixes).
  • irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type (git-fixes).
  • irqchip/renesas-rzg2l: Rename rzg2l_irq_eoi() (stable-fixes).
  • irqchip/renesas-rzg2l: Rename rzg2l_tint_eoi() (stable-fixes).
  • ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able (git-fixes).
  • ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() (git-fixes).
  • jffs2: prevent xattr node from overflowing the eraseblock (git-fixes).
  • kabi/severities: ignore brcmfmac-specific local symbols
  • kabi/severities: ignore IMS functions They were dropped in previous patches. Noone is supposed to use them.
  • kabi/severities: ignore TAS2781 symbol drop, it's only locally used
  • kabi/severities: ignore Wangxun ethernet driver local symbols
  • kabi/severities: Remove mitigation-related symbols Those are used by the core kernel to implement CPU vulnerabilities mitigation and are not expected to be consumed by 3rd party users.
  • kasan, fortify: properly rename memintrinsics (git-fixes).
  • kasan: disable kasan_non_canonical_hook() for HW tags (git-fixes).
  • kasan: print the original fault addr when access invalid shadow (git-fixes).
  • kasan/test: avoid gcc warning for intentional overflow (git-fixes).
  • kexec: do syscore_shutdown() in kernel_kexec (git-fixes).
  • KEYS: trusted: Do not use WARN when encode fails (git-fixes).
  • KEYS: trusted: Fix memory leak in tpm2_key_encode() (git-fixes).
  • kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).
  • kselftest: Add a ksft_perror() helper (stable-fixes).
  • kunit/fortify: Fix mismatched kvalloc()/vfree() usage (git-fixes).
  • KVM: nVMX: Clear EXIT_QUALIFICATION when injecting an EPT Misconfig (git-fixes).
  • KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1224790).
  • KVM: SVM: Add support for allowing zero SEV ASIDs (git-fixes).
  • KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (git-fixes).
  • KVM: SVM: Use unsigned integers when dealing with ASIDs (git-fixes).
  • KVM: VMX: Disable LBR virtualization if the CPU does not support LBR callstacks (git-fixes).
  • KVM: VMX: Report up-to-date exit qualification to userspace (git-fixes).
  • KVM: x86: Allow, do not ignore, same-value writes to immutable MSRs (git-fixes).
  • KVM: x86: Fix broken debugregs ABI for 32 bit kernels (git-fixes).
  • KVM: x86: Fully re-initialize supported_mce_cap on vendor module load (git-fixes).
  • KVM: x86: Introduce __kvm_get_hypervisor_cpuid() helper (git-fixes).
  • KVM: x86: Mark target gfn of emulated atomic instruction as dirty (git-fixes).
  • KVM: x86: Only set APICV_INHIBIT_REASON_ABSENT if APICv is enabled (git-fixes).
  • KVM: x86: Snapshot if a vCPU's vendor model is AMD vs. Intel compatible (git-fixes).
  • KVM: x86: Update KVM_SW_PROTECTED_VM docs to make it clear they're a WIP (git-fixes).
  • KVM: x86: Use actual kvm_cpuid.base for clearing KVM_FEATURE_PV_UNHALT (git-fixes).
  • KVM: x86/mmu: Do not force emulation of L2 accesses to non-APIC internal slots (git-fixes).
  • KVM: x86/mmu: Move private vs. shared check above slot validity checks (git-fixes).
  • KVM: x86/mmu: Restrict KVM_SW_PROTECTED_VM to the TDP MMU (git-fixes).
  • KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status (git-fixes).
  • KVM: x86/pmu: Allow programming events that match unsupported arch events (git-fixes).
  • KVM: x86/pmu: Always treat Fixed counters as available when supported (git-fixes).
  • KVM: x86/pmu: Apply 'fast' RDPMC only to Intel PMUs (git-fixes).
  • KVM: x86/pmu: Disable support for adaptive PEBS (git-fixes).
  • KVM: x86/pmu: Disallow 'fast' RDPMC for architectural Intel PMUs (git-fixes).
  • KVM: x86/pmu: Do not ignore bits 31:30 for RDPMC index on AMD (git-fixes).
  • KVM: x86/pmu: Do not mask LVTPC when handling a PMI on AMD platforms (git-fixes).
  • KVM: x86/pmu: Explicitly check NMI from guest to reducee false positives (git-fixes).
  • KVM: x86/pmu: Prioritize VMX interception over #GP on RDPMC due to bad index (git-fixes).
  • KVM: x86/pmu: Set enable bits for GP counters in PERF_GLOBAL_CTRL at 'RESET' (git-fixes).
  • KVM: x86/pmu: Zero out PMU metadata on AMD if PMU is disabled (git-fixes).
  • KVM: x86/xen: fix recursive deadlock in timer injection (git-fixes).
  • KVM: x86/xen: improve accuracy of Xen timers (git-fixes).
  • KVM: x86/xen: inject vCPU upcall vector when local APIC is enabled (git-fixes).
  • KVM: x86/xen: remove WARN_ON_ONCE() with false positives in evtchn delivery (git-fixes).
  • leds: pwm: Disable PWM when going to suspend (git-fixes).
  • lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (git-fixes).
  • libnvdimm: Fix ACPI_NFIT in BLK_DEV_PMEM help (jsc#PED-5853).
  • libsubcmd: Fix parse-options memory leak (git-fixes).
  • livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).
  • locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock (git-fixes)
  • lsm: fix the logic in security_inode_getsecctx() (git-fixes).
  • mac802154: fix llsec key resources release in mac802154_llsec_key_del (git-fixes).
  • maple_tree: fix mas_empty_area_rev() null pointer dereference (git-fixes).
  • md: add a new helper rdev_has_badblock() (jsc#PED-7542).
  • md: add a new helper reshape_interrupted() (jsc#PED-7542).
  • md: changed the switch of RAID_VERSION to if (jsc#PED-7542).
  • md: check mddev->pers before calling md_set_readonly() (jsc#PED-7542).
  • md: clean up invalid BUG_ON in md_ioctl (jsc#PED-7542).
  • md: clean up openers check in do_md_stop() and md_set_readonly() (jsc#PED-7542).
  • md: Do not clear MD_CLOSING when the raid is about to stop (jsc#PED-7542).
  • md: do not clear MD_RECOVERY_FROZEN for new dm-raid until resume (jsc#PED-7542).
  • md: export helper md_is_rdwr() (jsc#PED-7542).
  • md: export helpers to stop sync_thread (jsc#PED-7542).
  • md: factor out a helper to sync mddev (jsc#PED-7542).
  • md: fix kmemleak of rdev->serial (jsc#PED-7542).
  • md: get rdev->mddev with READ_ONCE() (jsc#PED-7542).
  • md: merge the check of capabilities into md_ioctl_valid() (jsc#PED-7542).
  • md: preserve KABI in struct md_personality (jsc#PED-7542).
  • md: remove redundant check of 'mddev->sync_thread' (jsc#PED-7542).
  • md: remove redundant md_wakeup_thread() (jsc#PED-7542).
  • md: return directly before setting did_set_md_closing (jsc#PED-7542).
  • md: sync blockdev before stopping raid or setting readonly (jsc#PED-7542).
  • md: use RCU lock to protect traversal in md_spares_need_change() (jsc#PED-7542).
  • md/dm-raid: do not call md_reap_sync_thread() directly (jsc#PED-7542).
  • md/raid1-10: add a helper raid1_check_read_range() (jsc#PED-7542).
  • md/raid1-10: factor out a new helper raid1_should_read_first() (jsc#PED-7542).
  • md/raid1: factor out choose_bb_rdev() from read_balance() (jsc#PED-7542).
  • md/raid1: factor out choose_slow_rdev() from read_balance() (jsc#PED-7542).
  • md/raid1: factor out helpers to add rdev to conf (jsc#PED-7542).
  • md/raid1: factor out helpers to choose the best rdev from read_balance() (jsc#PED-7542).
  • md/raid1: factor out read_first_rdev() from read_balance() (jsc#PED-7542).
  • md/raid1: factor out the code to manage sequential IO (jsc#PED-7542).
  • md/raid1: fix choose next idle in read_balance() (jsc#PED-7542).
  • md/raid1: record nonrot rdevs while adding/removing rdevs to conf (jsc#PED-7542).
  • media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries (git-fixes).
  • media: cadence: csi2rx: use match fwnode for media link (git-fixes).
  • media: cec: core: remove length check of Timer Status (stable-fixes).
  • media: dt-bindings: ovti,ov2680: Fix the power supply names (git-fixes).
  • media: flexcop-usb: fix sanity check of bNumEndpoints (git-fixes).
  • media: i2c: et8ek8: Do not strip remove function when driver is builtin (git-fixes).
  • media: ipu3-cio2: Request IRQ earlier (git-fixes).
  • media: mc: Fix flags handling when creating pad links (stable-fixes).
  • media: mc: Fix graph walk in media_pipeline_start (git-fixes).
  • media: mc: mark the media devnode as registered from the, start (git-fixes).
  • media: mc: Rename pad variable to clarify intent (stable-fixes).
  • media: ngene: Add dvb_ca_en50221_init return value check (git-fixes).
  • media: rcar-vin: work around -Wenum-compare-conditional warning (git-fixes).
  • media: rkisp1: Fix IRQ handling due to shared interrupts (stable-fixes).
  • media: sta2x11: fix irq handler cast (stable-fixes).
  • media: stk1160: fix bounds checking in stk1160_copy_video() (git-fixes).
  • media: sunxi: a83-mips-csi2: also select GENERIC_PHY (git-fixes).
  • media: uvcvideo: Add quirk for Logitech Rally Bar (git-fixes).
  • media: v4l: Do not turn on privacy LED if streamon fails (git-fixes).
  • media: v4l2-subdev: Fix stream handling for crop API (git-fixes).
  • mei: me: add arrow lake point H DID (stable-fixes).
  • mei: me: add arrow lake point S DID (stable-fixes).
  • mei: me: add lunar lake point M DID (stable-fixes).
  • mei: me: disable RPL-S on SPS and IGN firmwares (git-fixes).
  • mlxbf_gige: call request_irq() after NAPI initialized (git-fixes).
  • mlxbf_gige: stop interface during shutdown (git-fixes).
  • mlxbf_gige: stop PHY during open() error paths (git-fixes).
  • mlxsw: Use refcount_t for reference counting (git-fixes).
  • mm_init kABI workaround (git-fixes).
  • mm,page_owner: check for null stack_record before bumping its refcount (bsc#1222366).
  • mm,page_owner: Defer enablement of static branch (bsc#1222366).
  • mm,page_owner: drop unnecessary check (bsc#1222366).
  • mm,page_owner: Fix accounting of pages when migrating (bsc#1222366).
  • mm,page_owner: Fix printing of stack records (bsc#1222366).
  • mm,page_owner: fix recursion (bsc#1222366).
  • mm,page_owner: Fix refcount imbalance (bsc#1222366).
  • mm,page_owner: Update metadata for tail pages (bsc#1222366).
  • mm: memcg: do not periodically flush stats when memcg is disabled (bsc#1222525).
  • mm: memcg: use larger batches for proactive reclaim (bsc#1222522).
  • mm: page_owner: fix wrong information in dump_page_owner (git-fixes).
  • mm/slab: make __free(kfree) accept error pointers (git-fixes).
  • mmc: core: Add HS400 tuning in HS400es initialization (stable-fixes).
  • mmc: core: Avoid negative index with array access (git-fixes).
  • mmc: core: Initialize mmc_blk_ioc_data (git-fixes).
  • mmc: davinci: Do not strip remove function when driver is builtin (git-fixes).
  • mmc: omap: fix broken slot switch lookup (git-fixes).
  • mmc: omap: fix deferred probe (git-fixes).
  • mmc: omap: restore original power up/down steps (git-fixes).
  • mmc: sdhci_am654: Add ITAPDLYSEL in sdhci_j721e_4bit_set_clock (git-fixes).
  • mmc: sdhci_am654: Add OTAP/ITAP delay enable (git-fixes).
  • mmc: sdhci_am654: Add tuning algorithm for delay chain (git-fixes).
  • mmc: sdhci_am654: Fix ITAPDLY for HS400 timing (git-fixes).
  • mmc: sdhci_am654: Write ITAPDLY for DDR52 timing (git-fixes).
  • mmc: sdhci-msm: pervent access to suspended controller (git-fixes).
  • mmc: sdhci-omap: re-tuning is needed after a pm transition to support emmc HS200 mode (git-fixes).
  • modpost: Add '.ltext' and '.ltext.*' to TEXT_SECTIONS (stable-fixes).
  • mptcp: annotate data-races around msk->rmem_fwd_alloc (git-fixes).
  • mptcp: fix bogus receive window shrinkage with multiple subflows (git-fixes).
  • mptcp: move __mptcp_error_report in protocol.c (git-fixes).
  • mptcp: process pending subflow error on close (git-fixes).
  • mptcp: Remove unnecessary test for __mptcp_init_sock() (git-fixes).
  • mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() (git-fixes).
  • mtd: diskonchip: work around ubsan link failure (stable-fixes).
  • mtd: rawnand: hynix: fixed typo (git-fixes).
  • mtd: spinand: Add support for 5-byte IDs (stable-fixes).
  • net: add netdev_lockdep_set_classes() to virtual drivers (git-fixes).
  • net: annotate data-races around sk->sk_bind_phc (git-fixes).
  • net: annotate data-races around sk->sk_forward_alloc (git-fixes).
  • net: annotate data-races around sk->sk_lingertime (git-fixes).
  • net: annotate data-races around sk->sk_tsflags (git-fixes).
  • net: bonding: remove kernel-doc comment marker (git-fixes).
  • net: cfg802154: fix kernel-doc notation warnings (git-fixes).
  • net: dsa: microchip: fix register write order in ksz8_ind_write8() (git-fixes).
  • net: dsa: mt7530: fix handling of all link-local frames (git-fixes).
  • net: dsa: mt7530: fix link-local frames that ingress vlan filtering ports (git-fixes).
  • net: dsa: mt7530: prevent possible incorrect XTAL frequency selection (git-fixes).
  • net: dsa: mt7530: trap link-local frames regardless of ST Port State (git-fixes).
  • net: dsa: sja1105: Fix parameters order in sja1110_pcs_mdio_write_c45() (git-fixes).
  • net: ena: Fix incorrect descriptor free behavior (git-fixes).
  • net: ena: Fix potential sign extension issue (git-fixes).
  • net: ena: Move XDP code to its new files (git-fixes).
  • net: ena: Pass ena_adapter instead of net_device to ena_xmit_common() (git-fixes).
  • net: ena: Remove ena_select_queue (git-fixes).
  • net: ena: Set tx_info->xdpf value to NULL (git-fixes).
  • net: ena: Use tx_ring instead of xdp_ring for XDP channel TX (git-fixes).
  • net: ena: Wrong missing IO completions check order (git-fixes).
  • net: ethernet: mtk_eth_soc: fix PPE hanging issue (git-fixes).
  • net: ethernet: ti: cpsw: enable mac_managed_pm to fix mdio (git-fixes).
  • net: fec: Set mac_managed_pm during probe (git-fixes).
  • net: hns3: fix index limit to support all queue stats (git-fixes).
  • net: hns3: fix kernel crash when 1588 is received on HIP08 devices (git-fixes).
  • net: hns3: fix kernel crash when devlink reload during pf initialization (git-fixes).
  • net: hns3: fix port duplex configure error in IMP reset (git-fixes).
  • net: hns3: fix wrong judgment condition issue (git-fixes).
  • net: hns3: mark unexcuted loopback test result as UNEXECUTED (git-fixes).
  • net: hns3: tracing: fix hclgevf trace event strings (git-fixes).
  • net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (git-fixes).
  • net: ks8851: Handle softirqs at the end of IRQ thread to fix hang (git-fixes).
  • net: ks8851: Inline ks8851_rx_skb() (git-fixes).
  • net: ks8851: Queue RX packets in IRQ handler instead of disabling BHs (git-fixes).
  • net: lan743x: Add set RFE read fifo threshold for PCI1x1x chips (git-fixes).
  • net: libwx: fix memory leak on free page (git-fixes).
  • net: ll_temac: platform_get_resource replaced by wrong function (git-fixes).
  • net: llc: fix kernel-doc notation warnings (git-fixes).
  • net: mana: Fix Rx DMA datasize and skb_over_panic (git-fixes).
  • net: mediatek: mtk_eth_soc: clear MAC_MCR_FORCE_LINK only when MAC is up (git-fixes).
  • net: nfc: remove inappropriate attrs check (stable-fixes).
  • net: NSH: fix kernel-doc notation warning (git-fixes).
  • net: pcs: xpcs: Return EINVAL in the internal methods (git-fixes).
  • net: phy: fix phy_read_poll_timeout argument type in genphy_loopback (git-fixes).
  • net: phy: micrel: Fix potential null pointer dereference (git-fixes).
  • net: phy: micrel: lan8814: Fix when enabling/disabling 1-step timestamping (git-fixes).
  • net: phy: micrel: set soft_reset callback to genphy_soft_reset for KSZ8061 (git-fixes).
  • net: phy: phy_device: Prevent nullptr exceptions on ISR (git-fixes).
  • net: phy: phy_device: Prevent nullptr exceptions on ISR (stable-fixes).
  • net: ravb: Always process TX descriptor ring (git-fixes).
  • net: ravb: Always update error counters (git-fixes).
  • net: ravb: Let IP-specific receive function to interrogate descriptors (git-fixes).
  • net: smsc95xx: add support for SYS TEC USB-SPEmodule1 (git-fixes).
  • net: sparx5: Fix use after free inside sparx5_del_mact_entry (git-fixes).
  • net: sparx5: fix wrong config being used when reconfiguring PCS (git-fixes).
  • net: sparx5: flower: fix fragment flags handling (git-fixes).
  • net: stmmac: dwmac-starfive: Add support for JH7100 SoC (git-fixes).
  • net: stmmac: Fix incorrect dereference in interrupt handlers (git-fixes).
  • net: stmmac: fix rx queue priority assignment (git-fixes).
  • net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() (git-fixes).
  • net: tcp: fix unexcepted socket die when snd_wnd is 0 (git-fixes).
  • net: tls, fix WARNIING in __sk_msg_free (bsc#1221858).
  • net: tls: fix returned read length with async decrypt (bsc#1221858).
  • net: tls: fix use-after-free with partial reads and async (bsc#1221858).
  • net: usb: ax88179_178a: avoid the interface always configured as random address (git-fixes).
  • net: usb: ax88179_178a: avoid writing the mac address before first reading (git-fixes).
  • net: usb: ax88179_178a: fix link status when link is set to down/up (git-fixes).
  • net: usb: ax88179_178a: stop lying about skb->truesize (git-fixes).
  • net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM (git-fixes).
  • net: usb: smsc95xx: stop lying about skb->truesize (git-fixes).
  • net: usb: sr9700: stop lying about skb->truesize (git-fixes).
  • net: Use sockaddr_storage for getsockopt(SO_PEERNAME) (git-fixes).
  • net: veth: do not manipulate GRO when using XDP (git-fixes).
  • net: wwan: t7xx: Split 64bit accesses to fix alignment issues (git-fixes).
  • net:usb:qmi_wwan: support Rolling modules (stable-fixes).
  • net/mlx5: Correctly compare pkt reformat ids (git-fixes).
  • net/mlx5: E-switch, Change flow rule destination checking (git-fixes).
  • net/mlx5: E-switch, store eswitch pointer before registering devlink_param (git-fixes).
  • net/mlx5: Fix fw reporter diagnose output (git-fixes).
  • net/mlx5: Fix peer devlink set for SF representor devlink port (git-fixes).
  • net/mlx5: Lag, restore buckets number to default after hash LAG deactivation (git-fixes).
  • net/mlx5: offset comp irq index in name by one (git-fixes).
  • net/mlx5: Properly link new fs rules into the tree (git-fixes).
  • net/mlx5: Register devlink first under devlink lock (git-fixes).
  • net/mlx5: Restore mistakenly dropped parts in register devlink flow (git-fixes).
  • net/mlx5: SF, Stop waiting for FW as teardown was called (git-fixes).
  • net/mlx5e: Change the warning when ignore_flow_level is not supported (git-fixes).
  • net/mlx5e: Do not produce metadata freelist entries in Tx port ts WQE xmit (git-fixes).
  • net/mlx5e: Fix MACsec state loss upon state update in offload path (git-fixes).
  • net/mlx5e: Fix mlx5e_priv_init() cleanup flow (git-fixes).
  • net/mlx5e: HTB, Fix inconsistencies with QoS SQs number (git-fixes).
  • net/mlx5e: RSS, Block changing channels number when RXFH is configured (git-fixes).
  • net/mlx5e: RSS, Block XOR hash with over 128 channels (git-fixes).
  • net/mlx5e: Switch to using _bh variant of of spinlock API in port timestamping NAPI poll context (git-fixes).
  • net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (git-fixes).
  • net/smc: bugfix for smcr v2 server connect success statistic (git-fixes).
  • net/smc: fix documentation of buffer sizes (git-fixes).
  • net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add (git-fixes).
  • net/x25: fix incorrect parameter validation in the x25_getsockopt() function (git-fixes).
  • netfilter: nf_tables: disable toggling dormant table state more than once (git-fixes).
  • netfilter: nf_tables: uapi: Describe NFTA_RULE_CHAIN_ID (git-fixes).
  • netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes).
  • netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention (git-fixes).
  • nf_conntrack: fix -Wunused-const-variable= (git-fixes).
  • nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() (git-fixes).
  • nfc: nci: Fix kcov check in nci_rx_work() (git-fixes).
  • nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet (git-fixes).
  • nfc: nci: Fix uninit-value in nci_rx_work (git-fixes).
  • NFC: trf7970a: disable all regulators on removal (git-fixes).
  • nfp: flower: handle acti_netdevs allocation failure (git-fixes).
  • NFS: Fix an off by one in root_nfs_cat() (git-fixes).
  • NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt (git-fixes).
  • nfs: fix panic when nfs4_ff_layout_prepare_ds() fails (git-fixes).
  • NFS: Read unlock folio on nfs_page_create_from_folio() error (git-fixes).
  • NFSD: change LISTXATTRS cookie encoding to big-endian (git-fixes).
  • NFSD: Convert the callback workqueue to use delayed_work (git-fixes).
  • nfsd: do not call locks_release_private() twice concurrently (git-fixes).
  • nfsd: Fix a regression in nfsd_setattr() (git-fixes).
  • NFSD: fix LISTXATTRS returning a short list with eof=TRUE (git-fixes).
  • NFSD: fix LISTXATTRS returning more bytes than maxcount (git-fixes).
  • NFSD: Fix nfsd_clid_class use of __string_len() macro (git-fixes).
  • NFSD: fix nfsd4_listxattr_validate_cookie (git-fixes).
  • NFSD: Reschedule CB operations when backchannel rpc_clnt is shut down (git-fixes).
  • NFSD: Reset cb_seq_status after NFS4ERR_DELAY (git-fixes).
  • NFSD: Retransmit callbacks after client reconnects (git-fixes).
  • nfsd: use __fput_sync() to avoid delayed closing of files (bsc#1223380 bsc#1217408).
  • NFSv4.1/pnfs: fix NFS with TLS in pnfs (git-fixes).
  • NFSv4.2: fix listxattr maximum XDR buffer size (git-fixes).
  • NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (git-fixes).
  • nilfs2: fix OOB in nilfs_set_de_type (git-fixes).
  • nilfs2: fix out-of-range warning (git-fixes).
  • nilfs2: fix potential bug in end_buffer_async_write (git-fixes).
  • nilfs2: fix unexpected freezing of nilfs_segctor_sync() (git-fixes).
  • nilfs2: fix use-after-free of timer for log writer thread (git-fixes).
  • nilfs2: make superblock data array index computation sparse friendly (git-fixes).
  • nouveau: fix devinit paths to only handle display on GSP (git-fixes).
  • nouveau: fix function cast warning (git-fixes).
  • nouveau: fix instmem race condition around ptr stores (git-fixes).
  • nouveau: lock the client object tree (stable-fixes).
  • nouveau: reset the bo resource bus info after an eviction (git-fixes).
  • nouveau/dmem: handle kcalloc() allocation failure (git-fixes).
  • nouveau/gsp: do not check devinit disable on GSP (git-fixes).
  • nouveau/uvmm: fix addr/range calcs for remap operations (git-fixes).
  • nvdimm: make nvdimm_bus_type const (jsc#PED-5853).
  • nvdimm/pmem: fix leak on dax_add_host() failure (jsc#PED-5853).
  • nvdimm/pmem: Treat alloc_dax() -EOPNOTSUPP failure as non-fatal (jsc#PED-5853).
  • nvme-fc: do not wait in vain when unloading module (git-fixes).
  • nvme-pci: Add quirk for broken MSIs (git-fixes).
  • nvme-tcp: strict pdu pacing to avoid send stalls on TLS (bsc#1221858).
  • nvme: fix reconnection fail due to reserved tag allocation (git-fixes).
  • nvme: fix warn output about shared namespaces without CONFIG_NVME_MULTIPATH (git-fixes).
  • nvmet-fc: abort command when there is no binding (git-fixes).
  • nvmet-fc: avoid deadlock on delete association path (git-fixes).
  • nvmet-fc: defer cleanup using RCU properly (git-fixes).
  • nvmet-fc: hold reference on hostport match (git-fixes).
  • nvmet-fc: release reference on target port (git-fixes).
  • nvmet-fc: take ref count on tgtport before delete assoc (git-fixes).
  • nvmet-fcloop: swap the list_add_tail arguments (git-fixes).
  • nvmet-tcp: fix nvme tcp ida memory leak (git-fixes).
  • octeontx2-af: Add array index check (git-fixes).
  • octeontx2-af: Fix devlink params (git-fixes).
  • octeontx2-af: Fix issue with loading coalesced KPU profiles (git-fixes).
  • octeontx2-af: Fix NIX SQ mode and BP config (git-fixes).
  • Octeontx2-af: fix pause frame configuration in GMP mode (git-fixes).
  • octeontx2-af: Use matching wake_up API variant in CGX command interface (git-fixes).
  • octeontx2-af: Use separate handlers for interrupts (git-fixes).
  • octeontx2-pf: check negative error code in otx2_open() (git-fixes).
  • octeontx2-pf: fix FLOW_DIS_IS_FRAGMENT implementation (git-fixes).
  • octeontx2-pf: Fix transmit scheduler resource leak (git-fixes).
  • octeontx2-pf: Send UP messages to VF only when VF is up (git-fixes).
  • octeontx2-pf: Use default max_active works instead of one (git-fixes).
  • octeontx2-pf: Wait till detach_resources msg is complete (git-fixes).
  • octeontx2: Detect the mbox up or down message via register (git-fixes).
  • of: dynamic: Synchronize of_changeset_destroy() with the devlink removals (git-fixes).
  • of: module: add buffer overflow check in of_modalias() (git-fixes).
  • of: module: prevent NULL pointer dereference in vsnprintf() (stable-fixes).
  • of: property: Add in-ports/out-ports support to of_graph_get_port_parent() (stable-fixes).
  • of: property: fix typo in io-channels (git-fixes).
  • of: property: fw_devlink: Fix stupid bug in remote-endpoint parsing (git-fixes).
  • of: property: Improve finding the consumer of a remote-endpoint property (git-fixes).
  • of: property: Improve finding the supplier of a remote-endpoint property (git-fixes).
  • of: unittest: Fix compile in the non-dynamic case (git-fixes).
  • PCI: Delay after FLR of Solidigm P44 Pro NVMe (stable-fixes).
  • PCI: Disable D3cold on Asus B1400 PCI-NVMe bridge (stable-fixes).
  • PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host (git-fixes).
  • PCI: Execute quirk_enable_clear_retrain_link() earlier (stable-fixes).
  • PCI: Fix typos in docs and comments (stable-fixes).
  • PCI: hv: Fix ring buffer size calculation (git-fixes).
  • PCI: Make link retraining use RMW accessors for changing LNKCTL (git-fixes).
  • PCI: qcom: Add support for sa8775p SoC (git-fixes).
  • PCI: qcom: Disable ASPM L0s for sc8280xp, sa8540p and sa8295p (git-fixes).
  • PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id (git-fixes).
  • PCI: rpaphp: Error out on busy status from get-sensor-state (bsc#1223369 ltc#205888).
  • PCI: Simplify pcie_capability_clear_and_set_word() to ..._clear_word() (stable-fixes).
  • PCI: switchtec: Add support for PCIe Gen5 devices (stable-fixes).
  • PCI: switchtec: Use normal comment style (stable-fixes).
  • PCI: tegra194: Fix probe path for Endpoint mode (git-fixes).
  • PCI/AER: Block runtime suspend when handling errors (stable-fixes).
  • PCI/ASPM: Use RMW accessors for changing LNKCTL (git-fixes).
  • PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports (stable-fixes).
  • PCI/DPC: Use FIELD_GET() (stable-fixes).
  • PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 (git-fixes).
  • PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 (git-fixes).
  • PCI/PM: Drain runtime-idle callbacks before driver removal (stable-fixes).
  • peci: linux/peci.h: fix Excess kernel-doc description warning (git-fixes).
  • perf tests: Make data symbol test wait for perf to start (bsc#1220045).
  • perf tests: Skip data symbol test if buf1 symbol is missing (bsc#1220045).
  • perf/x86/amd/core: Avoid register reset when CPU is dead (git-fixes).
  • perf/x86/amd/core: Update and fix stalled-cycles-* events for Zen 2 and later (git-fixes).
  • perf/x86/amd/lbr: Use freeze based on availability (git-fixes).
  • perf/x86/intel: Expose existence of callback support to KVM (git-fixes).
  • phy: freescale: imx8m-pcie: fix pcie link-up instability (git-fixes).
  • phy: marvell: a3700-comphy: Fix hardcoded array size (git-fixes).
  • phy: marvell: a3700-comphy: Fix out of bounds read (git-fixes).
  • phy: rockchip-snps-pcie3: fix bifurcation on rk3588 (git-fixes).
  • phy: rockchip-snps-pcie3: fix clearing PHP_GRF_PCIESEL_CON bits (git-fixes).
  • phy: rockchip: naneng-combphy: Fix mux on rk3588 (git-fixes).
  • phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered (git-fixes).
  • pinctrl: armada-37xx: remove an unused variable (git-fixes).
  • pinctrl: baytrail: Fix selecting gpio pinctrl state (git-fixes).
  • pinctrl: core: delete incorrect free in pinctrl_enable() (git-fixes).
  • pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (git-fixes).
  • pinctrl: mediatek: paris: Fix PIN_CONFIG_INPUT_SCHMITT_ENABLE readback (git-fixes).
  • pinctrl: mediatek: paris: Rework support for PIN_CONFIG_{INPUT,OUTPUT}_ENABLE (git-fixes).
  • pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T (git-fixes).
  • pinctrl: qcom: pinctrl-sm7150: Fix sdc1 and ufs special pins regs (git-fixes).
  • pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs (stable-fixes).
  • pinctrl/meson: fix typo in PDM's pin name (git-fixes).
  • platform/chrome: cros_ec_uart: properly fix race condition (git-fixes).
  • platform/x86: intel-vbtn: Update tablet mode switch at end of probe (git-fixes).
  • platform/x86: ISST: Add Granite Rapids-D to HPM CPU list (stable-fixes).
  • platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet (stable-fixes).
  • platform/x86: x86-android-tablets: Fix acer_b1_750_goodix_gpios name (stable-fixes).
  • platform/x86: xiaomi-wmi: Fix race condition when reporting key events (git-fixes).
  • platform/x86/amd/pmc: Extend Framework 13 quirk to more BIOSes (stable-fixes).
  • platform/x86/intel-uncore-freq: Do not present root domain on error (git-fixes).
  • PM / devfreq: Synchronize devfreq_monitor_[start/stop] (stable-fixes).
  • PM: s2idle: Make sure CPUs will wakeup directly on resume (git-fixes).
  • power: rt9455: hide unused rt9455_boost_voltage_values (git-fixes).
  • power: supply: mt6360_charger: Fix of_match for usb-otg-vbus regulator (git-fixes).
  • powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).
  • powerpc/crypto/chacha-p10: Fix failure on non Power10 (bsc#1218205).
  • powerpc/eeh: Permanently disable the removed device (bsc#1223991 ltc#205740).
  • powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks (git-fixes).
  • powerpc/pseries: make max polling consistent for longer H_CALLs (bsc#1215199).
  • powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).
  • ppdev: Add an error check in register_device (git-fixes).
  • prctl: generalize PR_SET_MDWE support check to be per-arch (bsc#1225610).
  • printk: Add this_cpu_in_panic() (bsc#1225607).
  • printk: Adjust mapping for 32bit seq macros (bsc#1225607).
  • printk: Avoid non-panic CPUs writing to ringbuffer (bsc#1225607).
  • printk: Consolidate console deferred printing (bsc#1225607).
  • printk: Disable passing console lock owner completely during panic() (bsc#1225607).
  • printk: Do not take console lock for console_flush_on_panic() (bsc#1225607).
  • printk: For @suppress_panic_printk check for other CPU in panic (bsc#1225607).
  • printk: Keep non-panic-CPUs out of console lock (bsc#1225607).
  • printk: Let no_printk() use _printk() (bsc#1225618).
  • printk: nbcon: Relocate 32bit seq macros (bsc#1225607).
  • printk: Reduce console_unblank() usage in unsafe scenarios (bsc#1225607).
  • printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic() (bsc#1225607).
  • printk: ringbuffer: Clarify special lpos values (bsc#1225607).
  • printk: ringbuffer: Cleanup reader terminology (bsc#1225607).
  • printk: ringbuffer: Do not skip non-finalized records with prb_next_seq() (bsc#1225607).
  • printk: ringbuffer: Skip non-finalized records in panic (bsc#1225607).
  • printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1225616).
  • printk: Use prb_first_seq() as base for 32bit seq macros (bsc#1225607).
  • printk: Wait for all reserved records with pr_flush() (bsc#1225607).
  • proc/kcore: do not try to access unaccepted memory (git-fixes).
  • pstore: inode: Convert mutex usage to guard(mutex) (stable-fixes).
  • pstore: inode: Only d_invalidate() is needed (git-fixes).
  • pstore/zone: Add a null pointer check to the psz_kmsg_read (stable-fixes).
  • pwm: img: fix pwm clock lookup (git-fixes).
  • qibfs: fix dentry leak (git-fixes)
  • r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d (git-fixes).
  • r8169: skip DASH fw status checks when DASH is disabled (git-fixes).
  • random: handle creditable entropy from atomic process context (git-fixes).
  • RAS/AMD/FMPM: Avoid NULL ptr deref in get_saved_records() (jsc#PED-7619).
  • RAS/AMD/FMPM: Fix build when debugfs is not enabled (jsc#PED-7619).
  • RAS/AMD/FMPM: Safely handle saved records of various sizes (jsc#PED-7619).
  • RDMA/cm: add timeout to cm_destroy_id wait (git-fixes)
  • RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes)
  • RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw (git-fixes)
  • RDMA/hns: Add max_ah and cq moderation capacities in query_device() (git-fixes)
  • RDMA/hns: Fix deadlock on SRQ async events. (git-fixes)
  • RDMA/hns: Fix GMV table pagesize (git-fixes)
  • RDMA/hns: Fix return value in hns_roce_map_mr_sg (git-fixes)
  • RDMA/hns: Fix UAF for cq async event (git-fixes)
  • RDMA/hns: Modify the print level of CQE error (git-fixes)
  • RDMA/hns: Use complete parentheses in macros (git-fixes)
  • RDMA/IPoIB: Fix format truncation compilation errors (git-fixes)
  • RDMA/mana_ib: Fix bug in creation of dma regions (git-fixes).
  • RDMA/mlx5: Adding remote atomic access flag to updatable flags (git-fixes)
  • RDMA/mlx5: Change check for cacheable mkeys (git-fixes)
  • RDMA/mlx5: Fix port number for counter query in multi-port configuration (git-fixes)
  • RDMA/mlx5: Uncacheable mkey has neither rb_key or cache_ent (git-fixes)
  • RDMA/rxe: Allow good work requests to be executed (git-fixes)
  • RDMA/rxe: Fix incorrect rxe_put in error path (git-fixes)
  • RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (git-fixes)
  • RDMA/rxe: Fix the problem 'mutex_destroy missing' (git-fixes)
  • regmap: Add regmap_read_bypassed() (git-fixes).
  • regmap: kunit: Ensure that changed bytes are actually different (stable-fixes).
  • regmap: maple: Fix cache corruption in regcache_maple_drop() (git-fixes).
  • regmap: maple: Fix uninitialized symbol 'ret' warnings (git-fixes).
  • regulator: bd71828: Do not overwrite runtime voltages (git-fixes).
  • regulator: change devm_regulator_get_enable_optional() stub to return Ok (git-fixes).
  • regulator: change stubbed devm_regulator_get_enable to return Ok (git-fixes).
  • regulator: core: fix debugfs creation regression (git-fixes).
  • regulator: mt6360: De-capitalize devicetree regulator subnodes (git-fixes).
  • regulator: tps65132: Add of_match table (stable-fixes).
  • remoteproc: k3-r5: Do not allow core1 to power up before core0 via sysfs (git-fixes).
  • remoteproc: k3-r5: Jump to error handling labels in start/stop errors (git-fixes).
  • remoteproc: k3-r5: Wait for core0 power-up before powering up core1 (git-fixes).
  • remoteproc: mediatek: Make sure IPI buffer fits in L2TCM (git-fixes).
  • remoteproc: stm32: Fix incorrect type assignment returned by stm32_rproc_get_loaded_rsc_tablef (git-fixes).
  • remoteproc: virtio: Fix wdg cannot recovery remote processor (git-fixes).
  • Revert 'ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default' (stable-fixes).
  • Revert 'ASoC: SOF: Intel: hda-dai-ops: only allocate/release streams for first CPU DAI' (stable-fixes).
  • Revert 'ASoC: SOF: Intel: hda-dai-ops: reset device count for SoundWire DAIs' (stable-fixes).
  • Revert 'drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init()' (stable-fixes).
  • Revert 'drm/amd/display: Fix sending VSC (+ colorimetry) packets for DP/eDP displays without PSR' (stable-fixes).
  • Revert 'drm/amd/display: fix USB-C flag update after enc10 feature init' (stable-fixes).
  • Revert 'drm/amdkfd: fix gfx_target_version for certain 11.0.3 devices' (stable-fixes).
  • Revert 'drm/bridge: ti-sn65dsi83: Fix enable error path' (git-fixes).
  • Revert 'drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()' (stable-fixes).
  • Revert 'drm/qxl: simplify qxl_fence_wait' (git-fixes).
  • Revert 'iommu/amd: Enable PCI/IMS' (git-fixes).
  • Revert 'iommu/vt-d: Enable PCI/IMS' (git-fixes).
  • Revert 'net/mlx5: Block entering switchdev mode with ns inconsistency' (git-fixes).
  • Revert 'net/mlx5e: Check the number of elements before walk TC rhashtable' (git-fixes).
  • Revert 'PCI/MSI: Provide IMS (Interrupt Message Store) support' (git-fixes).
  • Revert 'PCI/MSI: Provide pci_ims_alloc/free_irq()' (git-fixes).
  • Revert 'PCI/MSI: Provide stubs for IMS functions' (git-fixes).
  • Revert 'selinux: introduce an initial SID for early boot processes' (bsc#1208593) It caused a regression on ALP-current branch, kernel-obs-qa build failed.
  • Revert 'thermal: core: Do not update trip points inside the hysteresis range' (git-fixes).
  • Revert 'usb: cdc-wdm: close race between read and workqueue' (git-fixes).
  • Revert 'usb: phy: generic: Get the vbus supply' (git-fixes).
  • ring-buffer: Do not set shortest_full when full target is hit (git-fixes).
  • ring-buffer: Fix a race between readers and resize checks (git-fixes).
  • ring-buffer: Fix full_waiters_pending in poll (git-fixes).
  • ring-buffer: Fix resetting of shortest_full (git-fixes).
  • ring-buffer: Fix waking up ring buffer readers (git-fixes).
  • ring-buffer: Make wake once of ring_buffer_wait() more robust (git-fixes).
  • ring-buffer: Only update pages_touched when a new page is touched (git-fixes).
  • ring-buffer: use READ_ONCE() to read cpu_buffer->commit_page in concurrent environment (git-fixes).
  • ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() (git-fixes).
  • rtc: mt6397: select IRQ_DOMAIN instead of depending on it (git-fixes).
  • s390/bpf: Emit a barrier for BPF_FETCH instructions (git-fixes bsc#1224792).
  • s390/cio: Ensure the copied buf is NUL terminated (git-fixes bsc#1223869).
  • s390/cio: fix tracepoint subchannel type field (git-fixes bsc#1224793).
  • s390/cpacf: Split and rework cpacf query functions (git-fixes bsc#1225133).
  • s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224348).
  • s390/ipl: Fix incorrect initialization of len fields in nvme reipl block (git-fixes bsc#1225136).
  • s390/ipl: Fix incorrect initialization of nvme dump block (git-fixes bsc#1225134).
  • s390/ism: Properly fix receive message buffer allocation (git-fixes bsc#1223590).
  • s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223871).
  • s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223872).
  • s390/qeth: Fix kernel panic after setting hsuid (git-fixes bsc#1223874).
  • s390/vdso: Add CFI for RA register to asm macro vdso_func (git-fixes bsc#1223870).
  • s390/vdso: drop '-fPIC' from LDFLAGS (git-fixes bsc#1223593).
  • s390/vtime: fix average steal time calculation (git-fixes bsc#1221783).
  • s390/zcrypt: fix reference counting on zcrypt card objects (git-fixes bsc#1223592).
  • sched/balancing: Rename newidle_balance() => sched_balance_newidle() (bsc#1222173).
  • sched/fair: Check root_domain::overload value before update (bsc#1222173).
  • sched/fair: Use helper functions to access root_domain::overload (bsc#1222173).
  • sched/psi: Select KERNFS as needed (git-fixes).
  • sched/topology: Optimize topology_span_sane() (bsc#1225053).
  • scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn (git-fixes).
  • scsi: core: Consult supported VPD page list prior to fetching page (git-fixes).
  • scsi: core: Fix unremoved procfs host directory regression (git-fixes).
  • scsi: csiostor: Avoid function pointer casts (git-fixes).
  • scsi: hisi_sas: Modify the deadline for ata_wait_after_reset() (git-fixes).
  • scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type() (git-fixes).
  • scsi: libsas: Fix disk not being scanned in after being removed (git-fixes).
  • scsi: lpfc: Copyright updates for 14.4.0.1 patches (bsc#1221777).
  • scsi: lpfc: Correct size for cmdwqe/rspwqe for memset() (bsc#1221777).
  • scsi: lpfc: Correct size for wqe for memset() (bsc#1221777).
  • scsi: lpfc: Define lpfc_dmabuf type for ctx_buf ptr (bsc#1221777).
  • scsi: lpfc: Define lpfc_nodelist type for ctx_ndlp ptr (bsc#1221777).
  • scsi: lpfc: Define types in a union for generic void *context3 ptr (bsc#1221777).
  • scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (bsc#1221777).
  • scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (bsc#1221777).
  • scsi: lpfc: Remove IRQF_ONESHOT flag from threaded IRQ handling (bsc#1221777 bsc#1217959).
  • scsi: lpfc: Remove unnecessary log message in queuecommand path (bsc#1221777).
  • scsi: lpfc: Replace hbalock with ndlp lock in lpfc_nvme_unregister_port() (bsc#1221777).
  • scsi: lpfc: Update lpfc version to 14.4.0.1 (bsc#1221777).
  • scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic (bsc#1221777).
  • scsi: lpfc: Use a dedicated lock for ras_fwlog state (bsc#1221777).
  • scsi: mpi3mr: Reduce stack usage in mpi3mr_refresh_sas_ports() (git-fixes).
  • scsi: mpt3sas: Prevent sending diag_reset when the controller is ready (git-fixes).
  • scsi: mylex: Fix sysfs buffer lengths (git-fixes).
  • scsi: qla2xxx: Change debug message during driver unload (bsc1221816).
  • scsi: qla2xxx: Delay I/O Abort on PCI error (bsc1221816).
  • scsi: qla2xxx: Fix command flush on cable pull (bsc1221816).
  • scsi: qla2xxx: Fix double free of fcport (bsc1221816).
  • scsi: qla2xxx: Fix double free of the ha->vp_map pointer (bsc1221816).
  • scsi: qla2xxx: Fix N2N stuck connection (bsc1221816).
  • scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (git-fixes).
  • scsi: qla2xxx: NVME|FCP prefer flag not being honored (bsc1221816).
  • scsi: qla2xxx: Prevent command send on chip reset (bsc1221816).
  • scsi: qla2xxx: Split FCE|EFT trace control (bsc1221816).
  • scsi: qla2xxx: Update manufacturer detail (bsc1221816).
  • scsi: qla2xxx: Update version to 10.02.09.200-k (bsc1221816).
  • scsi: sd: Unregister device if device_add_disk() failed in sd_probe() (git-fixes).
  • scsi: sg: Avoid race in error handling & drop bogus warn (git-fixes).
  • scsi: sg: Avoid sg device teardown race (git-fixes).
  • scsi: smartpqi: Fix disable_managed_interrupts (git-fixes).
  • sctp: annotate data-races around sk->sk_wmem_queued (git-fixes).
  • sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove() (git-fixes).
  • selftests: default to host arch for LLVM builds (git-fixes).
  • selftests: forwarding: Fix ping failure due to short timeout (git-fixes).
  • selftests: kselftest: Fix build failure with NOLIBC (git-fixes).
  • selftests: kselftest: Mark functions that unconditionally call exit() as __noreturn (git-fixes).
  • selftests: net: bridge: increase IGMP/MLD exclude timeout membership interval (git-fixes).
  • selftests: net: kill smcrouted in the cleanup logic in amt.sh (git-fixes).
  • selftests: net: move amt to socat for better compatibility (git-fixes).
  • selftests: test_bridge_neigh_suppress.sh: Fix failures due to duplicate MAC (git-fixes).
  • selftests: timers: Convert posix_timers test to generate KTAP output (stable-fixes).
  • selftests: timers: Fix abs() warning in posix_timers test (git-fixes).
  • selftests: timers: Fix posix_timers ksft_print_msg() warning (git-fixes).
  • selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior (stable-fixes).
  • selftests: vxlan_mdb: Fix failures with old libnet (git-fixes).
  • selftests/binderfs: use the Makefile's rules, not Make's implicit rules (git-fixes).
  • selftests/bpf: add edge case backtracking logic test (bsc#1225756).
  • selftests/bpf: precision tracking test for BPF_NEG and BPF_END (bsc#1225756).
  • selftests/ftrace: Fix event filter target_func selection (stable-fixes).
  • selftests/ftrace: Limit length in subsystem-enable tests (git-fixes).
  • selftests/kcmp: remove unused open mode (git-fixes).
  • selftests/net: convert test_bridge_neigh_suppress.sh to run it in unique namespace (stable-fixes).
  • selftests/pidfd: Fix config for pidfd_setns_test (git-fixes).
  • selftests/powerpc/dexcr: Add -no-pie to hashchk tests (git-fixes).
  • selftests/powerpc/papr-vpd: Fix missing variable initialization (jsc#PED-4486 git-fixes).
  • selftests/resctrl: fix clang build failure: use LOCAL_HDRS (git-fixes).
  • selftests/timers/posix_timers: Reimplement check_timer_distribution() (git-fixes).
  • selinux: avoid dereference of garbage after mount failure (git-fixes).
  • selinux: introduce an initial SID for early boot processes (bsc#1208593).
  • serial: 8250_bcm7271: use default_mux_rate if possible (git-fixes).
  • serial: 8250_dw: Revert: Do not reclock if already at correct rate (git-fixes).
  • serial: 8250_exar: Do not remove GPIO device on suspend (git-fixes).
  • serial: 8520_mtk: Set RTS on shutdown for Rx in-band wakeup (git-fixes).
  • serial: core: Fix atomicity violation in uart_tiocmget (git-fixes).
  • serial: core: only stop transmit when HW fifo is empty (git-fixes).
  • serial: kgdboc: Fix NMI-safety problems from keyboard reset code (stable-fixes).
  • serial: Lock console when calling into driver before registration (git-fixes).
  • serial: max3100: Fix bitwise types (git-fixes).
  • serial: max3100: Lock port->lock when calling uart_handle_cts_change() (git-fixes).
  • serial: max3100: Update uart_driver_registered on driver removal (git-fixes).
  • serial: max310x: fix NULL pointer dereference in I2C instantiation (git-fixes).
  • serial: max310x: fix syntax error in IRQ error message (git-fixes).
  • serial: mxs-auart: add spinlock around changing cts state (git-fixes).
  • serial: sc16is7xx: add proper sched.h include for sched_set_fifo() (git-fixes).
  • serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler (git-fixes).
  • serial: sh-sci: protect invalidating RXDMA on shutdown (git-fixes).
  • serial: stm32: Reset .throttled state in .startup() (git-fixes).
  • serial/pmac_zilog: Remove flawed mitigation for rx irq flood (git-fixes).
  • SEV: disable SEV-ES DebugSwap by default (git-fixes).
  • slimbus: core: Remove usage of the deprecated ida_simple_xx() API (git-fixes).
  • slimbus: qcom-ngd-ctrl: Add timeout for wait operation (git-fixes).
  • soc: fsl: qbman: Always disable interrupts when taking cgr_lock (git-fixes).
  • soc: fsl: qbman: Use raw spinlock for cgr_lock (git-fixes).
  • soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE (git-fixes).
  • soc: microchip: Fix POLARFIRE_SOC_SYS_CTRL input prompt (stable-fixes).
  • soc: qcom: pmic_glink: do not traverse clients list without a lock (git-fixes).
  • soc: qcom: pmic_glink: Make client-lock non-sleeping (git-fixes).
  • soc: qcom: pmic_glink: notify clients about the current state (git-fixes).
  • soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request (git-fixes).
  • sock_diag: annotate data-races around sock_diag_handlers[family] (git-fixes).
  • soundwire: amd: fix for wake interrupt handling for clockstop mode (git-fixes).
  • speakup: Avoid crash on very long word (git-fixes).
  • speakup: Fix 8bit characters from direct synth (git-fixes).
  • speakup: Fix sizeof() vs ARRAY_SIZE() bug (git-fixes).
  • spi: Do not mark message DMA mapped when no transfer in it is (git-fixes).
  • spi: fix null pointer dereference within spi_sync (git-fixes).
  • spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs (git-fixes).
  • spi: intel-pci: Add support for Lunar Lake-M SPI serial flash (stable-fixes).
  • spi: lm70llp: fix links in doc and comments (git-fixes).
  • spi: lpspi: Avoid potential use-after-free in probe() (git-fixes).
  • spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe (git-fixes).
  • spi: microchip-core-qspi: fix setting spi bus clock rate (git-fixes).
  • spi: spi-fsl-lpspi: remove redundant spi_controller_put call (git-fixes).
  • spi: spi-mt65xx: Fix NULL pointer access in interrupt handler (git-fixes).
  • spi: stm32: Do not warn about spurious interrupts (git-fixes).
  • spi: xilinx: Fix kernel documentation in the xilinx_spi.h (git-fixes).
  • spmi: hisi-spmi-controller: Do not override device identifier (git-fixes).
  • staging: vc04_services: changen strncpy() to strscpy_pad() (stable-fixes).
  • staging: vc04_services: fix information leak in create_component() (git-fixes).
  • staging: vt6655: Remove unused declaration of RFbAL7230SelectChannelPostProcess() (git-fixes).
  • stmmac: Clear variable when destroying workqueue (git-fixes).
  • SUNRPC: fix a memleak in gss_import_v2_context (git-fixes).
  • SUNRPC: fix some memleaks in gssx_dec_option_array (git-fixes).
  • supported.conf: support tcp_dctcp module (jsc#PED-8111)
  • swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (bsc#1224331)
  • swiotlb: Fix alignment checks when both allocation and DMA masks are (bsc#1224331)
  • swiotlb: Fix double-allocation of slots due to broken alignment (bsc#1224331)
  • swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() (bsc#1224331)
  • swiotlb: use the calculated number of areas (git-fixes).
  • thermal: devfreq_cooling: Fix perf state when calculate dfc res_util (git-fixes).
  • thermal/drivers/qcom/lmh: Check for SCM availability at probe (git-fixes).
  • thermal/drivers/tsens: Fix null pointer dereference (git-fixes).
  • thermal/of: Assume polling-delay(-passive) 0 when absent (stable-fixes).
  • thunderbolt: Avoid notify PM core about runtime PM resume (stable-fixes).
  • thunderbolt: Do not create DisplayPort tunnels on adapters of the same router (git-fixes).
  • thunderbolt: Fix wake configurations after device unplug (stable-fixes).
  • thunderbolt: Introduce tb_path_deactivate_hop() (stable-fixes).
  • thunderbolt: Introduce tb_port_reset() (stable-fixes).
  • thunderbolt: Make tb_switch_reset() support Thunderbolt 2, 3 and USB4 routers (stable-fixes).
  • thunderbolt: Reset only non-USB4 host routers in resume (git-fixes).
  • tls: break out of main loop when PEEK gets a non-data record (bsc#1221858).
  • tls: do not skip over different type records from the rx_list (bsc#1221858).
  • tls: fix peeking with sync+async decryption (bsc#1221858).
  • tls: stop recv() if initial process_rx_list gave us non-DATA (bsc#1221858).
  • tools/arch/x86/intel_sdsi: Fix maximum meter bundle length (git-fixes).
  • tools/arch/x86/intel_sdsi: Fix meter_certificate decoding (git-fixes).
  • tools/arch/x86/intel_sdsi: Fix meter_show display (git-fixes).
  • tools/latency-collector: Fix -Wformat-security compile warns (git-fixes).
  • tools/power turbostat: Expand probe_intel_uncore_frequency() (bsc#1221765).
  • tools/power/turbostat: Fix uncore frequency file string (bsc#1221765).
  • tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer (git-fixes).
  • tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test (git-fixes).
  • tracing: Have saved_cmdlines arrays all in one allocation (git-fixes).
  • tracing: hide unused ftrace_event_id_fops (git-fixes).
  • tracing: Remove precision vsnprintf() check from print event (git-fixes).
  • tracing: Use .flush() call to wake up readers (git-fixes).
  • tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes).
  • tracing/ring-buffer: Fix wait_on_pipe() race (git-fixes).
  • tty: n_gsm: fix missing receive state reset after mode switch (git-fixes).
  • tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (git-fixes).
  • tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT (git-fixes).
  • tty: vt: fix 20 vs 0x20 typo in EScsiignore (git-fixes).
  • ubifs: dbg_check_idx_size: Fix kmemleak if loading znode failed (git-fixes).
  • ubifs: fix sort function prototype (git-fixes).
  • ubifs: Queue up space reservation tasks if retrying many times (git-fixes).
  • ubifs: Remove unreachable code in dbg_check_ltab_lnum (git-fixes).
  • ubifs: Set page uptodate in the correct place (git-fixes).
  • usb: aqc111: stop lying about skb->truesize (git-fixes).
  • usb: audio-v2: Correct comments for struct uac_clock_selector_descriptor (git-fixes).
  • usb: cdc-wdm: close race between read and workqueue (git-fixes).
  • USB: core: Add hub_get() and hub_put() routines (stable-fixes).
  • USB: core: Fix access violation during port device removal (git-fixes).
  • USB: core: Fix deadlock in port 'disable' sysfs attribute (stable-fixes).
  • USB: core: Fix deadlock in usb_deauthorize_interface() (git-fixes).
  • usb: Disable USB3 LPM at shutdown (stable-fixes).
  • usb: dwc2: gadget: Fix exiting from clock gating (git-fixes).
  • usb: dwc2: gadget: LPM flow fix (git-fixes).
  • usb: dwc2: host: Fix dereference issue in DDMA completion flow (git-fixes).
  • usb: dwc2: host: Fix hibernation flow (git-fixes).
  • usb: dwc2: host: Fix ISOC flow in DDMA mode (git-fixes).
  • usb: dwc2: host: Fix remote wakeup from hibernation (git-fixes).
  • usb: dwc3-am62: Disable wakeup at remove (git-fixes).
  • usb: dwc3-am62: fix module unload/reload behavior (git-fixes).
  • usb: dwc3-am62: Rename private data (git-fixes).
  • usb: dwc3: core: Prevent phy suspend during init (Git-fixes).
  • usb: dwc3: pci: Drop duplicate ID (git-fixes).
  • usb: dwc3: Properly set system wakeup (git-fixes).
  • usb: dwc3: Wait unconditionally after issuing EndXfer command (git-fixes).
  • usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device (bsc#1220569).
  • usb: fotg210: Add missing kernel doc description (git-fixes).
  • usb: gadget: composite: fix OS descriptors w_value logic (git-fixes).
  • usb: gadget: f_fs: Fix a race condition when processing setup packets (git-fixes).
  • usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete (git-fixes).
  • usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error (stable-fixes).
  • usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin (git-fixes).
  • usb: gadget: u_audio: Clear uac pointer when freed (git-fixes).
  • usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind (git-fixes).
  • usb: gadget: uvc: mark incomplete frames with UVC_STREAM_ERR (stable-fixes).
  • usb: gadget: uvc: use correct buffer size when parsing configfs lists (git-fixes).
  • usb: ohci: Prevent missed ohci interrupts (git-fixes).
  • usb: phy: generic: Get the vbus supply (git-fixes).
  • USB: serial: add device ID for VeriFone adapter (stable-fixes).
  • USB: serial: cp210x: add ID for MGP Instruments PDS100 (stable-fixes).
  • USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M (stable-fixes).
  • USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB (stable-fixes).
  • USB: serial: option: add Fibocom FM135-GL variants (stable-fixes).
  • USB: serial: option: add Lonsung U8300/U9300 product (stable-fixes).
  • USB: serial: option: add MeiG Smart SLM320 product (stable-fixes).
  • USB: serial: option: add Rolling RW101-GL and RW135-GL support (stable-fixes).
  • USB: serial: option: add support for Fibocom FM650/FG650 (stable-fixes).
  • USB: serial: option: add Telit FN920C04 rmnet compositions (stable-fixes).
  • USB: serial: option: support Quectel EM060K sub-models (stable-fixes).
  • usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined (stable-fixes).
  • usb: typec: Return size of buffer if pd_set operation succeeds (git-fixes).
  • usb: typec: tcpci: add generic tcpci fallback compatible (stable-fixes).
  • usb: typec: tcpm: Check for port partner validity before consuming it (git-fixes).
  • usb: typec: tcpm: clear pd_event queue in PORT_RESET (git-fixes).
  • usb: typec: tcpm: Correct port source pdo array in pd_set callback (git-fixes).
  • usb: typec: tcpm: Correct the PDO counting in pd_set (git-fixes).
  • usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd() (git-fixes).
  • usb: typec: tcpm: unregister existing source caps before re-registration (git-fixes).
  • usb: typec: tcpm: Update PD of Type-C port upon pd_set (git-fixes).
  • usb: typec: tipd: fix event checking for tps6598x (git-fixes).
  • usb: typec: ucsi_acpi: Refactor and fix DELL quirk (git-fixes).
  • usb: typec: ucsi: Ack unsupported commands (stable-fixes).
  • usb: typec: ucsi: always register a link to USB PD device (git-fixes).
  • usb: typec: ucsi: Check for notifications after init (git-fixes).
  • usb: typec: ucsi: Clean up UCSI_CABLE_PROP macros (git-fixes).
  • usb: typec: ucsi: Clear EVENT_PENDING under PPM lock (git-fixes).
  • usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset (stable-fixes).
  • usb: typec: ucsi: displayport: Fix potential deadlock (git-fixes).
  • usb: typec: ucsi: Fix connector check on init (git-fixes).
  • usb: typec: ucsi: Fix race between typec_switch and role_switch (git-fixes).
  • usb: typec: ucsi: Limit read size on v1.2 (stable-fixes).
  • usb: typec: ucsi: simplify partner's PD caps registration (git-fixes).
  • USB: UAS: return ENODEV when submit urbs fail with device not attached (stable-fixes).
  • usb: udc: remove warning when queue disabled ep (stable-fixes).
  • usb: xhci-plat: Do not include xhci.h (stable-fixes).
  • usb: xhci: Add error handling in xhci_map_urb_for_dma (git-fixes).
  • usb: xhci: correct return value in case of STS_HCE (git-fixes).
  • usb: xhci: Implement xhci_handshake_check_state() helper.
  • vboxsf: Avoid an spurious warning if load_nls_xxx() fails (git-fixes).
  • vboxsf: explicitly deny setlease attempts (stable-fixes).
  • vdpa_sim: reset must not run (git-fixes).
  • vdpa/mlx5: Allow CVQ size changes (git-fixes).
  • veth: try harder when allocating queue memory (git-fixes).
  • vhost: Add smp_rmb() in vhost_enable_notify() (git-fixes).
  • vhost: Add smp_rmb() in vhost_vq_avail_empty() (git-fixes).
  • virtio_net: Do not send RSS key if it is not supported (git-fixes).
  • virtio-blk: Ensure no requests in virtqueues before deleting vqs (git-fixes).
  • virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal (bsc#1223944).
  • VMCI: Fix an error handling path in vmci_guest_probe_device() (git-fixes).
  • VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (stable-fixes).
  • vmci: prevent speculation leaks by sanitizing event in event_deliver() (git-fixes).
  • vsock/virtio: fix packet delivery to tap device (git-fixes).
  • watchdog: bd9576: Drop 'always-running' property (git-fixes).
  • watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger (git-fixes).
  • watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin (git-fixes).
  • watchdog: sa1100: Fix PTR_ERR_OR_ZERO() vs NULL check in sa1100dog_probe() (git-fixes).
  • wifi: ar5523: enable proper endpoint verification (git-fixes).
  • wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() (git-fixes).
  • wifi: ath10k: poll service ready message before failing (git-fixes).
  • wifi: ath10k: populate board data for WCN3990 (git-fixes).
  • wifi: ath11k: decrease MHI channel buffer length to 8KB (bsc#1207948).
  • wifi: ath11k: do not force enable power save on non-running vdevs (git-fixes).
  • wifi: ath12k: fix out-of-bound access of qmi_invoke_handler() (git-fixes).
  • wifi: ath12k: Update Qualcomm Innovation Center, Inc. copyrights (stable-fixes).
  • wifi: ath9k: fix LNA selection in ath_ant_try_scan() (stable-fixes).
  • wifi: brcmfmac: Add DMI nvram filename quirk for ACEPC W5 Pro (stable-fixes).
  • wifi: brcmfmac: add per-vendor feature detection callback (stable-fixes).
  • wifi: brcmfmac: cfg80211: Use WSEC to set SAE password (stable-fixes).
  • wifi: brcmfmac: Demote vendor-specific attach/detach messages to info (git-fixes).
  • wifi: brcmfmac: pcie: handle randbuf allocation failure (git-fixes).
  • wifi: carl9170: add a proper sanity check for endpoints (git-fixes).
  • wifi: carl9170: re-fix fortified-memset warning (git-fixes).
  • wifi: cfg80211: check A-MSDU format more carefully (stable-fixes).
  • wifi: cfg80211: fix rdev_dump_mpp() arguments order (stable-fixes).
  • wifi: ieee80211: fix ieee80211_mle_basic_sta_prof_size_ok() (git-fixes).
  • wifi: iwlwifi: fw: do not always use FW dump trig (git-fixes).
  • wifi: iwlwifi: fw: fix compile w/o CONFIG_ACPI (git-fixes).
  • wifi: iwlwifi: mvm: allocate STA links only for active links (git-fixes).
  • wifi: iwlwifi: mvm: fix active link counting during recovery (git-fixes).
  • wifi: iwlwifi: mvm: fix check in iwl_mvm_sta_fw_id_mask (git-fixes).
  • wifi: iwlwifi: mvm: guard against invalid STA ID on removal (stable-fixes).
  • wifi: iwlwifi: mvm: include link ID when releasing frames (git-fixes).
  • wifi: iwlwifi: mvm: init vif works only once (git-fixes).
  • wifi: iwlwifi: mvm: remove old PASN station when adding a new one (git-fixes).
  • wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd (git-fixes).
  • wifi: iwlwifi: mvm: rfi: fix potential response leaks (git-fixes).
  • wifi: iwlwifi: mvm: select STA mask only for active links (git-fixes).
  • wifi: iwlwifi: mvm: use correct address 3 in A-MSDU (stable-fixes).
  • wifi: iwlwifi: pcie: Add the PCI device id for new hardware (stable-fixes).
  • wifi: iwlwifi: pcie: fix RB status reading (stable-fixes).
  • wifi: iwlwifi: read txq->read_ptr under lock (stable-fixes).
  • wifi: iwlwifi: reconfigure TLC during HW restart (git-fixes).
  • wifi: mac80211_hwsim: init peer measurement result (git-fixes).
  • wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (stable-fixes).
  • wifi: mac80211: clean up assignments to pointer cache (stable-fixes).
  • wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc (stable-fixes).
  • wifi: mac80211: fix prep_connection error path (stable-fixes).
  • wifi: mac80211: fix unaligned le16 access (git-fixes).
  • wifi: mac80211: only call drv_sta_rc_update for uploaded stations (stable-fixes).
  • wifi: mac80211: remove link before AP (git-fixes).
  • wifi: mt76: mt7603: add wpdma tx eof flag for PSE client reset (git-fixes).
  • wifi: mt76: mt7603: fix tx queue of loopback packets (git-fixes).
  • wifi: mt76: mt7915: workaround too long expansion sparse warnings (git-fixes).
  • wifi: mt76: mt7996: add locking for accessing mapped registers (stable-fixes).
  • wifi: mt76: mt7996: disable AMSDU for non-data frames (stable-fixes).
  • wifi: mwl8k: initialize cmd->addr[] properly (git-fixes).
  • wifi: nl80211: do not free NULL coalescing rule (git-fixes).
  • wifi: rtw88: 8821cu: Fix connection failure (stable-fixes).
  • wifi: rtw88: Add missing VID/PIDs for 8811CU and 8821CU (stable-fixes).
  • wifi: rtw89: fix null pointer access when abort scan (stable-fixes).
  • wifi: rtw89: pci: correct TX resource checking for PCI DMA channel of firmware command (git-fixes).
  • wifi: rtw89: pci: enlarge RX DMA buffer to consider size of RX descriptor (stable-fixes).
  • wireguard: netlink: access device through ctx instead of peer (git-fixes).
  • wireguard: netlink: check for dangling peer via is_dead instead of empty list (git-fixes).
  • wireguard: receive: annotate data-race around receiving_counter.counter (git-fixes).
  • x86/bugs: Fix BHI retpoline check (git-fixes).
  • x86/bugs: Fix the SRSO mitigation on Zen3/4 (git-fixes).
  • x86/bugs: Remove default case for fully switched enums (git-fixes).
  • x86/calldepth: Rename __x86_return_skl() to call_depth_return_thunk() (git-fixes).
  • x86/coco: Require seeding RNG with RDRAND on CoCo systems (git-fixes).
  • x86/cpu: Add model number for Intel Arrow Lake mobile processor (git-fixes).
  • x86/CPU/AMD: Add models 0x10-0x1f to the Zen5 range (git-fixes).
  • x86/CPU/AMD: Update the Zenbleed microcode revisions (git-fixes).
  • x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ (git-fixes).
  • x86/efistub: Add missing boot_params for mixed mode compat entry (git-fixes).
  • x86/efistub: Call mixed mode boot services on the firmware's stack (git-fixes).
  • x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (git-fixes).
  • x86/hyperv: Allow 15-bit APIC IDs for VTL platforms (git-fixes).
  • x86/hyperv: Use per cpu initial stack for vtl context (git-fixes).
  • x86/Kconfig: Remove CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT (git-fixes).
  • x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y (git-fixes).
  • x86/kvm/Kconfig: Have KVM_AMD_SEV select ARCH_HAS_CC_PLATFORM (git-fixes).
  • x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (git-fixes).
  • x86/nmi: Fix the inverse 'in NMI handler' check (git-fixes).
  • x86/nospec: Refactor UNTRAIN_RET[_*] (git-fixes).
  • x86/pm: Work around false positive kmemleak report in msr_build_context() (git-fixes).
  • x86/purgatory: Switch to the position-independent small code model (git-fixes).
  • x86/rethunk: Use SYM_CODE_START[_LOCAL]_NOALIGN macros (git-fixes).
  • x86/retpoline: Add NOENDBR annotation to the SRSO dummy return thunk (git-fixes).
  • x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO (git-fixes).
  • x86/srso: Disentangle rethunk-dependent options (git-fixes).
  • x86/srso: Fix unret validation dependencies (git-fixes).
  • x86/srso: Improve i-cache locality for alias mitigation (git-fixes).
  • x86/srso: Print actual mitigation if requested mitigation isn't possible (git-fixes).
  • x86/srso: Remove 'pred_cmd' label (git-fixes).
  • x86/srso: Unexport untraining functions (git-fixes).
  • x86/xen: Add some null pointer checking to smp.c (git-fixes).
  • x86/xen: attempt to inflate the memory balloon on PVH (git-fixes).
  • xdp, bonding: Fix feature flags when there are no slave devs anymore (git-fixes).
  • xen-netfront: Add missing skb_mark_for_recycle (git-fixes).
  • xen: evtchn: Allow shared registration of IRQ handers (git-fixes).
  • xen/events: drop xen_allocate_irqs_dynamic() (git-fixes).
  • xen/events: fix error code in xen_bind_pirq_msi_to_irq() (git-fixes).
  • xen/events: increment refcnt only if event channel is refcounted (git-fixes).
  • xen/events: modify internal [un]bind interfaces (git-fixes).
  • xen/events: reduce externally visible helper functions (git-fixes).
  • xen/events: remove some simple helpers from events_base.c (git-fixes).
  • xen/evtchn: avoid WARN() when unbinding an event channel (git-fixes).
  • xfs: add lock protection when remove perag from radix tree (git-fixes).
  • xfs: allow extent free intents to be retried (git-fixes).
  • xfs: fix perag leak when growfs fails (git-fixes).
  • xfs: force all buffers to be written during btree bulk load (git-fixes).
  • xfs: make xchk_iget safer in the presence of corrupt inode btrees (git-fixes).
  • xfs: pass the xfs_defer_pending object to iop_recover (git-fixes).
  • xfs: recompute growfsrtfree transaction reservation while growing rt volume (git-fixes).
  • xfs: transfer recovered intent item ownership in ->iop_recover (git-fixes).
  • xfs: use xfs_defer_pending objects to recover intent items (git-fixes).
  • xhci: add helper that checks for unhandled events on a event ring (git-fixes).
  • xhci: remove unnecessary event_ring_deq parameter from xhci_handle_event() (git-fixes).
  • xhci: Simplify event ring dequeue pointer update for port change events (git-fixes).
  • xhci: simplify event ring dequeue tracking for transfer events (git-fixes).
  • xhci: update event ring dequeue pointer position to controller correctly (git-fixes). Altered because we cannot take the multiple interrupter code

Список пакетов

Image SLES15-SP6-Azure-Basic
kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard
kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC
kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure
kernel-azure-6.4.0-150600.8.5.4
SUSE Linux Enterprise Module for Public Cloud 15 SP6
kernel-azure-6.4.0-150600.8.5.4
kernel-azure-devel-6.4.0-150600.8.5.4
kernel-devel-azure-6.4.0-150600.8.5.4
kernel-source-azure-6.4.0-150600.8.5.4
kernel-syms-azure-6.4.0-150600.8.5.1
openSUSE Leap 15.6
cluster-md-kmp-azure-6.4.0-150600.8.5.4
dlm-kmp-azure-6.4.0-150600.8.5.4
gfs2-kmp-azure-6.4.0-150600.8.5.4
kernel-azure-6.4.0-150600.8.5.4
kernel-azure-devel-6.4.0-150600.8.5.4
kernel-azure-extra-6.4.0-150600.8.5.4
kernel-azure-livepatch-devel-6.4.0-150600.8.5.4
kernel-azure-optional-6.4.0-150600.8.5.4
kernel-azure-vdso-6.4.0-150600.8.5.4
kernel-devel-azure-6.4.0-150600.8.5.4
kernel-source-azure-6.4.0-150600.8.5.4
kernel-syms-azure-6.4.0-150600.8.5.1
kselftests-kmp-azure-6.4.0-150600.8.5.4
ocfs2-kmp-azure-6.4.0-150600.8.5.4
reiserfs-kmp-azure-6.4.0-150600.8.5.4

Описание

A deadlock flaw was found in the Linux kernel's BPF subsystem. This flaw allows a local user to potentially crash the system.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access, this "could be exploited in a real world scenario." This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG: unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 4a01067 P4D 4a01067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs] Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00 00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00 RSP: 0018:ffffc900007939e0 EFLAGS: 00010216 RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90 RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000 RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000 R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000 R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22 FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x181/0x480 ? search_module_extables+0x19/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x1b6/0x1c0 ? asm_exc_page_fault+0x26/0x30 ? smb2_parse_contexts+0xa0/0x3a0 [cifs] SMB2_open+0x38d/0x5f0 [cifs] ? smb2_is_path_accessible+0x138/0x260 [cifs] smb2_is_path_accessible+0x138/0x260 [cifs] cifs_is_path_remote+0x8d/0x230 [cifs] cifs_mount+0x7e/0x350 [cifs] cifs_smb3_do_mount+0x128/0x780 [cifs] smb3_get_tree+0xd9/0x290 [cifs] vfs_get_tree+0x2c/0x100 ? capable+0x37/0x70 path_mount+0x2d7/0xb80 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __x64_sys_mount+0x11a/0x150 do_syscall_64+0x47/0xf0 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f8737657b1e


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: block: add check that partition length needs to be aligned with block size Before calling add partition or resize partition, there is no check on whether the length is aligned with the logical block size. If the logical block size of the disk is larger than 512 bytes, then the partition size maybe not the multiple of the logical block size, and when the last sector is read, bio_truncate() will adjust the bio size, resulting in an IO error if the size of the read command is smaller than the logical block size.If integrity data is supported, this will also result in a null pointer dereference when calling bio_integrity_free.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: efivarfs: force RO when remounting if SetVariable is not supported If SetVariable at runtime is not supported by the firmware we never assign a callback for that function. At the same time mount the efivarfs as RO so no one can call that. However, we never check the permission flags when someone remounts the filesystem as RW. As a result this leads to a crash looking like this: $ mount -o remount,rw /sys/firmware/efi/efivars $ efi-updatevar -f PK.auth PK [ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 303.280482] Mem abort info: [ 303.280854] ESR = 0x0000000086000004 [ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits [ 303.282016] SET = 0, FnV = 0 [ 303.282414] EA = 0, S1PTW = 0 [ 303.282821] FSC = 0x04: level 0 translation fault [ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000 [ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP [ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6 [ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1 [ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023 [ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 303.292123] pc : 0x0 [ 303.292443] lr : efivar_set_variable_locked+0x74/0xec [ 303.293156] sp : ffff800008673c10 [ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000 [ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027 [ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000 [ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000 [ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54 [ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4 [ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002 [ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201 [ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc [ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000 [ 303.303341] Call trace: [ 303.303679] 0x0 [ 303.303938] efivar_entry_set_get_size+0x98/0x16c [ 303.304585] efivarfs_file_write+0xd0/0x1a4 [ 303.305148] vfs_write+0xc4/0x2e4 [ 303.305601] ksys_write+0x70/0x104 [ 303.306073] __arm64_sys_write+0x1c/0x28 [ 303.306622] invoke_syscall+0x48/0x114 [ 303.307156] el0_svc_common.constprop.0+0x44/0xec [ 303.307803] do_el0_svc+0x38/0x98 [ 303.308268] el0_svc+0x2c/0x84 [ 303.308702] el0t_64_sync_handler+0xf4/0x120 [ 303.309293] el0t_64_sync+0x190/0x194 [ 303.309794] Code: ???????? ???????? ???????? ???????? (????????) [ 303.310612] ---[ end trace 0000000000000000 ]--- Fix this by adding a .reconfigure() function to the fs operations which we can use to check the requested flags and deny anything that's not RO if the firmware doesn't implement SetVariable at runtime.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: crypto: rsa - add a check for allocation failure Static checkers insist that the mpi_alloc() allocation can fail so add a check to prevent a NULL dereference. Small allocations like this can't actually fail in current kernels, but adding a check is very simple and makes the static checkers happy.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mctp: perform route lookups under a RCU read-side lock Our current route lookups (mctp_route_lookup and mctp_route_lookup_null) traverse the net's route list without the RCU read lock held. This means the route lookup is subject to preemption, resulting in an potential grace period expiry, and so an eventual kfree() while we still have the route pointer. Add the proper read-side critical section locks around the route lookups, preventing premption and a possible parallel kfree. The remaining net->mctp.routes accesses are already under a rcu_read_lock, or protected by the RTNL for updates. Based on an analysis from Sili Luo <rootlab@huawei.com>, where introducing a delay in the route lookup could cause a UAF on simultaneous sendmsg() and route deletion.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix NULL pointer in channel unregistration function __dma_async_device_channel_register() can fail. In case of failure, chan->local is freed (with free_percpu()), and chan->local is nullified. When dma_async_device_unregister() is called (because of managed API or intentionally by DMA controller driver), channels are unconditionally unregistered, leading to this NULL pointer: [ 1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0 [...] [ 1.484499] Call trace: [ 1.486930] device_del+0x40/0x394 [ 1.490314] device_unregister+0x20/0x7c [ 1.494220] __dma_async_device_channel_unregister+0x68/0xc0 Look at dma_async_device_register() function error path, channel device unregistration is done only if chan->local is not NULL. Then add the same condition at the beginning of __dma_async_device_channel_unregister() function, to avoid NULL pointer issue whatever the API used to reach this function.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix use-after-free vulnerability in amdtee_close_session There is a potential race condition in amdtee_close_session that may cause use-after-free in amdtee_open_session. For instance, if a session has refcount == 1, and one thread tries to free this session via: kref_put(&sess->refcount, destroy_session); the reference count will get decremented, and the next step would be to call destroy_session(). However, if in another thread, amdtee_open_session() is called before destroy_session() has completed execution, alloc_session() may return 'sess' that will be freed up later in destroy_session() leading to use-after-free in amdtee_open_session. To fix this issue, treat decrement of sess->refcount and removal of 'sess' from session list in destroy_session() as a critical section, so that it is executed atomically.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: reiserfs: Avoid touching renamed directory if parent does not change The VFS will not be locking moved directory if its parent does not change. Change reiserfs rename code to avoid touching renamed directory if its parent does not change as without locking that can corrupt the filesystem.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Check mailbox/SMT channel for consistency On reception of a completion interrupt the shared memory area is accessed to retrieve the message header at first and then, if the message sequence number identifies a transaction which is still pending, the related payload is fetched too. When an SCMI command times out the channel ownership remains with the platform until eventually a late reply is received and, as a consequence, any further transmission attempt remains pending, waiting for the channel to be relinquished by the platform. Once that late reply is received the channel ownership is given back to the agent and any pending request is then allowed to proceed and overwrite the SMT area of the just delivered late reply; then the wait for the reply to the new request starts. It has been observed that the spurious IRQ related to the late reply can be wrongly associated with the freshly enqueued request: when that happens the SCMI stack in-flight lookup procedure is fooled by the fact that the message header now present in the SMT area is related to the new pending transaction, even though the real reply has still to arrive. This race-condition on the A2P channel can be detected by looking at the channel status bits: a genuine reply from the platform will have set the channel free bit before triggering the completion IRQ. Add a consistency check to validate such condition in the A2P ISR.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the structure was released. Initially, this issue was ignored because memory for mpi_ec_ctx is allocated with the __GFP_ZERO flag. For example, this error will be triggered when calculating the Za value for SM2 separately.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: block/rnbd-srv: Check for unlikely string overflow Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "full_path" since it was also PATH_MAX sized. The W=1 builds were reporting this warning: drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra': drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~ In function 'rnbd_srv_get_full_path', inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | dev_search_path, dev_name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~ To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present).


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_load_attr_list(). The "size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow on a 64bit systems but on 32bit systems the "+ 1023" can overflow and the result is zero. This means that the kmalloc will succeed by returning the ZERO_SIZE_PTR and then the memcpy() will crash with an Oops on the next line.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreq_monitor_[start/stop] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from cancel_delayed_work_sync() and followed by expire_timers() can be seen from the traces[1]. while true do echo "simple_ondemand" > /sys/class/devfreq/1d84000.ufshc/governor echo "performance" > /sys/class/devfreq/1d84000.ufshc/governor done It looks to be issue with devfreq driver where device_monitor_[start/stop] need to synchronized so that delayed work should get corrupted while it is either being queued or running or being cancelled. Let's use polling flag and devfreq lock to synchronize the queueing the timer instance twice and work data being corrupted. [1] ... .. <idle>-0 [003] 9436.209662: timer_cancel timer=0xffffff80444f0428 <idle>-0 [003] 9436.209664: timer_expire_entry timer=0xffffff80444f0428 now=0x10022da1c function=__typeid__ZTSFvP10timer_listE_global_addr baseclk=0x10022da1c <idle>-0 [003] 9436.209718: timer_expire_exit timer=0xffffff80444f0428 kworker/u16:6-14217 [003] 9436.209863: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2b now=0x10022da1c flags=182452227 vendor.xxxyyy.ha-1593 [004] 9436.209888: timer_cancel timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216390: timer_init timer=0xffffff80444f0428 vendor.xxxyyy.ha-1593 [004] 9436.216392: timer_start timer=0xffffff80444f0428 function=__typeid__ZTSFvP10timer_listE_global_addr expires=0x10022da2c now=0x10022da1d flags=186646532 vendor.xxxyyy.ha-1593 [005] 9436.220992: timer_cancel timer=0xffffff80444f0428 xxxyyyTraceManag-7795 [004] 9436.261641: timer_cancel timer=0xffffff80444f0428 [2] 9436.261653][ C4] Unable to handle kernel paging request at virtual address dead00000000012a [ 9436.261664][ C4] Mem abort info: [ 9436.261666][ C4] ESR = 0x96000044 [ 9436.261669][ C4] EC = 0x25: DABT (current EL), IL = 32 bits [ 9436.261671][ C4] SET = 0, FnV = 0 [ 9436.261673][ C4] EA = 0, S1PTW = 0 [ 9436.261675][ C4] Data abort info: [ 9436.261677][ C4] ISV = 0, ISS = 0x00000044 [ 9436.261680][ C4] CM = 0, WnR = 1 [ 9436.261682][ C4] [dead00000000012a] address between user and kernel address ranges [ 9436.261685][ C4] Internal error: Oops: 96000044 [#1] PREEMPT SMP [ 9436.261701][ C4] Skip md ftrace buffer dump for: 0x3a982d0 ... [ 9436.262138][ C4] CPU: 4 PID: 7795 Comm: TraceManag Tainted: G S W O 5.10.149-android12-9-o-g17f915d29d0c #1 [ 9436.262141][ C4] Hardware name: Qualcomm Technologies, Inc. (DT) [ 9436.262144][ C4] pstate: 22400085 (nzCv daIf +PAN -UAO +TCO BTYPE=--) [ 9436.262161][ C4] pc : expire_timers+0x9c/0x438 [ 9436.262164][ C4] lr : expire_timers+0x2a4/0x438 [ 9436.262168][ C4] sp : ffffffc010023dd0 [ 9436.262171][ C4] x29: ffffffc010023df0 x28: ffffffd0636fdc18 [ 9436.262178][ C4] x27: ffffffd063569dd0 x26: ffffffd063536008 [ 9436.262182][ C4] x25: 0000000000000001 x24: ffffff88f7c69280 [ 9436.262185][ C4] x23: 00000000000000e0 x22: dead000000000122 [ 9436.262188][ C4] x21: 000000010022da29 x20: ffffff8af72b4e80 [ 9436.262191][ C4] x19: ffffffc010023e50 x18: ffffffc010025038 [ 9436.262195][ C4] x17: 0000000000000240 x16: 0000000000000201 [ 9436.262199][ C4] x15: ffffffffffffffff x14: ffffff889f3c3100 [ 9436.262203][ C4] x13: ffffff889f3c3100 x12: 00000000049f56b8 [ 9436.262207][ C4] x11: 00000000049f56b8 x10: 00000000ffffffff [ 9436.262212][ C4] x9 : ffffffc010023e50 x8 : dead000000000122 [ 9436.262216][ C4] x7 : ffffffffffffffff x6 : ffffffc0100239d8 [ 9436.262220][ C4] x5 : 0000000000000000 x4 : 0000000000000101 [ 9436.262223][ C4] x3 : 0000000000000080 x2 : ffffff8 ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix oob in ntfs_listxattr The length of name cannot exceed the space occupied by ea.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() It is preferable to exit through the out: label because internal debugging functions are located there.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix race conditions with genpd If the power domains are registered first with genpd and *after that* the driver attempts to power them on in the probe sequence, then it is possible that a race condition occurs if genpd tries to power them on in the same time. The same is valid for powering them off before unregistering them from genpd. Attempt to fix race conditions by first removing the domains from genpd and *after that* powering down domains. Also first power up the domains and *after that* register them to genpd.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: NTB: fix possible name leak in ntb_register_device() If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. [mani: reworded commit message]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix a memleak in gss_import_v2_context The ctx->mech_used.data allocated by kmemdup is not freed in neither gss_import_v2_context nor it only caller gss_krb5_import_sec_context, which frees ctx on error. Thus, this patch reform the last call of gss_import_v2_context to the gss_krb5_import_ctx_v2, preventing the memleak while keepping the return formation.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: disable sending io_uring over sockets File reference cycles have caused lots of problems for io_uring in the past, and it still doesn't work exactly right and races with unix_stream_read_generic(). The safest fix would be to completely disallow sending io_uring files via sockets via SCM_RIGHT, so there are no possible cycles invloving registered files and thus rendering SCM accounting on the io_uring side unnecessary.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: aqc111: check packet for fixup for true limit If a device sends a packet that is inbetween 0 and sizeof(u64) the value passed to skb_trim() as length will wrap around ending up as some very large value. The driver will then proceed to parse the header located at that position, which will either oops or process some random value. The fix is to check against sizeof(u64) rather than 0, which the driver currently does. The issue exists since the introduction of the driver.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amd/pm: resolve reboot exception for si oland" This reverts commit e490d60a2f76bff636c68ce4fe34c1b6c34bbd86. This causes hangs on SI when DC is enabled and errors on driver reboot and power off cycles.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" This reverts commit 662404b24a4c4d839839ed25e3097571f5938b9b. The revert is required due to the suspicion it is not good for anything and cause crash.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type On 64-bit platforms, the pfn_to_kaddr() macro requires that the input value is 64 bits in order to ensure that valid address bits don't get lost when shifting that input by PAGE_SHIFT to calculate the physical address to provide a virtual address for. One such example is in pvalidate_pages() (used by SEV-SNP guests), where the GFN in the struct used for page-state change requests is a 40-bit bit-field, so attempts to pass this GFN field directly into pfn_to_kaddr() ends up causing guest crashes when dealing with addresses above the 1TB range due to the above. Fix this issue with SEV-SNP guests, as well as any similar cases that might cause issues in current/future code, by using an inline function, instead of a macro, so that the input is implicitly cast to the expected 64-bit input type prior to performing the shift operation. While it might be argued that the issue is on the caller side, other archs/macros have taken similar approaches to deal with instances like this, such as ARM explicitly casting the input to phys_addr_t: e48866647b48 ("ARM: 8396/1: use phys_addr_t in pfn_to_kaddr()") A C inline function is even better though. [ mingo: Refined the changelog some more & added __always_inline. ]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: media: rkisp1: Fix IRQ handling due to shared interrupts The driver requests the interrupts as IRQF_SHARED, so the interrupt handlers can be called at any time. If such a call happens while the ISP is powered down, the SoC will hang as the driver tries to access the ISP registers. This can be reproduced even without the platform sharing the IRQ line: Enable CONFIG_DEBUG_SHIRQ and unload the driver, and the board will hang. Fix this by adding a new field, 'irqs_enabled', which is used to bail out from the interrupt handler when the ISP is not operational.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe() If clk_get_sys(..., "pll_d2_out0") fails, the clk_get_sys() call must be undone. Add the missing clk_put and a new 'put_pll_d_out0' label in the error handling path, and use it.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node When ida_alloc_max fails, resources allocated before should be freed, including *res allocated by kmalloc and ttm_resource_init.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe() Driver uses kasprintf() to initialize fw_{code,data}_bin members of struct acp_dev_data, but kfree() is never called to deallocate the memory, which results in a memory leak. Fix the issue by switching to devm_kasprintf(). Additionally, ensure the allocation was successful by checking the pointer validity.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is under stress and got memory allocation error. Ring pointer was used as an indicator of failure, but this is not correct since only ring data is allocated/deallocated. Ring itself is an array member. Changing ring allocation functions to return error code directly. This simplifies error handling and eliminates aq_ring_free on higher layer.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a potential double-free in fs_any_create_groups When kcalloc() for ft->g succeeds but kvzalloc() for in fails, fs_any_create_groups() will free ft->g. However, its caller fs_any_create_table() will free ft->g again through calling mlx5e_destroy_flow_table(), which will lead to a double-free. Fix this by setting ft->g to NULL in fs_any_create_groups().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: crypto: s390/aes - Fix buffer overread in CTR mode When processing the last block, the s390 ctr code will always read a whole block, even if there isn't a whole block of data left. Fix this by using the actual length left and copy it into a buffer first for processing.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: rpmsg: virtio: Free driver_override when rpmsg_remove() Free driver_override when rpmsg_remove(), otherwise the following memory leak will occur: unreferenced object 0xffff0000d55d7080 (size 128): comm "kworker/u8:2", pid 56, jiffies 4294893188 (age 214.272s) hex dump (first 32 bytes): 72 70 6d 73 67 5f 6e 73 00 00 00 00 00 00 00 00 rpmsg_ns........ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000009c94c9c1>] __kmem_cache_alloc_node+0x1f8/0x320 [<000000002300d89b>] __kmalloc_node_track_caller+0x44/0x70 [<00000000228a60c3>] kstrndup+0x4c/0x90 [<0000000077158695>] driver_set_override+0xd0/0x164 [<000000003e9c4ea5>] rpmsg_register_device_override+0x98/0x170 [<000000001c0c89a8>] rpmsg_ns_register_device+0x24/0x30 [<000000008bbf8fa2>] rpmsg_probe+0x2e0/0x3ec [<00000000e65a68df>] virtio_dev_probe+0x1c0/0x280 [<00000000443331cc>] really_probe+0xbc/0x2dc [<00000000391064b1>] __driver_probe_device+0x78/0xe0 [<00000000a41c9a5b>] driver_probe_device+0xd8/0x160 [<000000009c3bd5df>] __device_attach_driver+0xb8/0x140 [<0000000043cd7614>] bus_for_each_drv+0x7c/0xd4 [<000000003b929a36>] __device_attach+0x9c/0x19c [<00000000a94e0ba8>] device_initial_probe+0x14/0x20 [<000000003c999637>] bus_probe_device+0xa0/0xac


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix hang/underflow when transitioning to ODM4:1 [Why] Under some circumstances, disabling an OPTC and attempting to reclaim its OPP(s) for a different OPTC could cause a hang/underflow due to OPPs not being properly disconnected from the disabled OPTC. [How] Ensure that all OPPs are unassigned from an OPTC when it gets disabled.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a debugfs null pointer error [WHY & HOW] Check whether get_subvp_en() callback exists before calling it.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() Ensure the value passed to scarlett2_mixer_ctl_put() is between 0 and SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside scarlett2_mixer_values[].


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: powerpc/imc-pmu: Add a null pointer check in update_events_in_group() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard stack limits against 32bit overflow This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498 [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Confirm list is non-empty before utilizing list_first_entry in kfd_topology.c Before using list_first_entry, make sure to check that list is not empty, if list is empty return -ENODATA. Fixes the below: drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1347 kfd_create_indirect_link_prop() warn: can 'gpu_link' even be NULL? drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1428 kfd_add_peer_prop() warn: can 'iolink1' even be NULL? drivers/gpu/drm/amd/amdgpu/../amdkfd/kfd_topology.c:1433 kfd_add_peer_prop() warn: can 'iolink2' even be NULL?


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: of: Fix double free in of_parse_phandle_with_args_map In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the inner loop. This assumes that the value of "new" is NULL on the first iteration of the inner loop. Make sure that this is true in all iterations of the outer loop by setting "new" to NULL after its value is assigned to "cur". Extend the unittest to detect the double free and add an additional test case that actually triggers this path.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add missing error checks to *_ctl_get() The *_ctl_get() functions which call scarlett2_update_*() were not checking the return value. Fix to check the return value and pass to the caller.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: efivarfs: Free s_fs_info on unmount Now that we allocate a s_fs_info struct on fs context creation, we should ensure that we free it again when the superblock goes away.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ACPI: LPIT: Avoid u32 multiplication overflow In lpit_update_residency() there is a possibility of overflow in multiplication, if tsc_khz is large enough (> UINT_MAX/1000). Change multiplication to mul_u32_u32(). Found by Linux Verification Center (linuxtesting.org) with SVACE.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check in opal_event_init() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: crypto: safexcel - Add error handling for dma_map_sg() calls Macro dma_map_sg() may return 0 on error. This patch enables checks in case of the macro failure and ensures unmapping of previously mapped buffers with dma_unmap_sg(). Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check to scom_debug_init_one() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Add a null pointer check, and release 'ent' to avoid memory leaks.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a double-free in si_dpm_init When the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free some fields of adev. However, when the control flow returns to si_dpm_sw_init, it goes to label dpm_failed and calls si_dpm_fini, which calls amdgpu_free_extended_power_table again and free those fields again. Thus a double-free is triggered.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config() scarlett2_usb_set_config() calls scarlett2_usb_get() but was not checking the result. Return the error if it fails rather than continuing with an invalid value.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ACPI: video: check for error while searching for backlight device parent If acpi_get_parent() called in acpi_video_dev_register_backlight() fails, for example, because acpi_ut_acquire_mutex() fails inside acpi_get_parent), this can lead to incorrect (uninitialized) acpi_parent handle being passed to acpi_get_pci_dev() for detecting the parent pci device. Check acpi_get_parent() result and set parent device only in case of success. Found by Linux Verification Center (linuxtesting.org) with SVACE.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function With tpd12s015_remove() marked with __exit this function is discarded when the driver is compiled as a built-in. The result is that when the driver unbinds there is no cleanup done which results in resource leakage or worse.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check writeback connectors in create_validate_stream_for_sink [WHY & HOW] This is to check connector type to avoid unhandled null pointer for writeback connectors.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv: Add a null pointer check in opal_powercap_init() kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL sof_sdw_rt_sdca_jack_exit() are used by different codecs, and some of them use the same dai name. For example, rt712 and rt713 both use "rt712-sdca-aif1" and sof_sdw_rt_sdca_jack_exit(). As a result, sof_sdw_rt_sdca_jack_exit() will be called twice by mc_dailink_exit_loop(). Set ctx->headset_codec_dev = NULL; after put_device(ctx->headset_codec_dev); to avoid ctx->headset_codec_dev being put twice.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: calipso: fix memory leak in netlbl_calipso_add_pass() If IPv6 support is disabled at boot (ipv6.disable=1), the calipso_init() -> netlbl_calipso_ops_register() function isn't called, and the netlbl_calipso_ops_get() function always returns NULL. In this case, the netlbl_calipso_add_pass() function allocates memory for the doi_def variable but doesn't free it with the calipso_doi_free(). BUG: memory leak unreferenced object 0xffff888011d68180 (size 64): comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s) hex dump (first 32 bytes): 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<...>] kmalloc include/linux/slab.h:552 [inline] [<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline] [<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111 [<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739 [<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline] [<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800 [<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515 [<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811 [<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] [<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339 [<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934 [<...>] sock_sendmsg_nosec net/socket.c:651 [inline] [<...>] sock_sendmsg+0x157/0x190 net/socket.c:671 [<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342 [<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396 [<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429 [<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 [<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6 Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller [PM: merged via the LSM tree at Jakub Kicinski request]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix delete_endpoint() vs parent unregistration race The CXL subsystem, at cxl_mem ->probe() time, establishes a lineage of ports (struct cxl_port objects) between an endpoint and the root of a CXL topology. Each port including the endpoint port is attached to the cxl_port driver. Given that setup, it follows that when either any port in that lineage goes through a cxl_port ->remove() event, or the memdev goes through a cxl_mem ->remove() event. The hierarchy below the removed port, or the entire hierarchy if the memdev is removed needs to come down. The delete_endpoint() callback is careful to check whether it is being called to tear down the hierarchy, or if it is only being called to teardown the memdev because an ancestor port is going through ->remove(). That care needs to take the device_lock() of the endpoint's parent. Which requires 2 bugs to be fixed: 1/ A reference on the parent is needed to prevent use-after-free scenarios like this signature: BUG: spinlock bad magic on CPU#0, kworker/u56:0/11 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230524-3.fc38 05/24/2023 Workqueue: cxl_port detach_memdev [cxl_core] RIP: 0010:spin_bug+0x65/0xa0 Call Trace: do_raw_spin_lock+0x69/0xa0 __mutex_lock+0x695/0xb80 delete_endpoint+0xad/0x150 [cxl_core] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1d2/0x210 detach_memdev+0x15/0x20 [cxl_core] process_one_work+0x1e3/0x4c0 worker_thread+0x1dd/0x3d0 2/ In the case of RCH topologies, the parent device that needs to be locked is not always @port->dev as returned by cxl_mem_find_port(), use endpoint->dev.parent instead.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: af_unix: fix use-after-free in unix_stream_read_actor() syzbot reported the following crash [1] After releasing unix socket lock, u->oob_skb can be changed by another thread. We must temporarily increase skb refcount to make sure this other thread will not free the skb under us. [1] BUG: KASAN: slab-use-after-free in unix_stream_read_actor+0xa7/0xc0 net/unix/af_unix.c:2866 Read of size 4 at addr ffff88801f3b9cc4 by task syz-executor107/5297 CPU: 1 PID: 5297 Comm: syz-executor107 Not tainted 6.6.0-syzkaller-15910-gb8e3a87a627b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xc4/0x620 mm/kasan/report.c:475 kasan_report+0xda/0x110 mm/kasan/report.c:588 unix_stream_read_actor+0xa7/0xc0 net/unix/af_unix.c:2866 unix_stream_recv_urg net/unix/af_unix.c:2587 [inline] unix_stream_read_generic+0x19a5/0x2480 net/unix/af_unix.c:2666 unix_stream_recvmsg+0x189/0x1b0 net/unix/af_unix.c:2903 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0xe2/0x170 net/socket.c:1066 ____sys_recvmsg+0x21f/0x5c0 net/socket.c:2803 ___sys_recvmsg+0x115/0x1a0 net/socket.c:2845 __sys_recvmsg+0x114/0x1e0 net/socket.c:2875 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fc67492c559 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc6748ab228 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 000000000000001c RCX: 00007fc67492c559 RDX: 0000000040010083 RSI: 0000000020000140 RDI: 0000000000000004 RBP: 00007fc6749b6348 R08: 00007fc6748ab6c0 R09: 00007fc6748ab6c0 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc6749b6340 R13: 00007fc6749b634c R14: 00007ffe9fac52a0 R15: 00007ffe9fac5388 </TASK> Allocated by task 5295: kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x180/0x3c0 mm/slub.c:3523 __alloc_skb+0x287/0x330 net/core/skbuff.c:641 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331 sock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780 sock_alloc_send_skb include/net/sock.h:1884 [inline] queue_oob net/unix/af_unix.c:2147 [inline] unix_stream_sendmsg+0xb5f/0x10a0 net/unix/af_unix.c:2301 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b Freed by task 5295: kasan_save_stack+0x33/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1800 [inline] slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826 slab_free mm/slub.c:3809 [inline] kmem_cache_free+0xf8/0x340 mm/slub.c:3831 kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:1015 __kfree_skb net/core/skbuff.c:1073 [inline] consume_skb net/core/skbuff.c:1288 [inline] consume_skb+0xdf/0x170 net/core/skbuff.c:1282 queue_oob net/unix/af_unix.c:2178 [inline] u ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: use cpuhp_state_remove_instance_nocalls() for hisi_hns3_pmu uninit process When tearing down a 'hisi_hns3' PMU, we mistakenly run the CPU hotplug callbacks after the device has been unregistered, leading to fireworks when we try to execute empty function callbacks within the driver: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | CPU: 0 PID: 15 Comm: cpuhp/0 Tainted: G W O 5.12.0-rc4+ #1 | Hardware name: , BIOS KpxxxFPGA 1P B600 V143 04/22/2021 | pstate: 80400009 (Nzcv daif +PAN -UAO -TCO BTYPE=--) | pc : perf_pmu_migrate_context+0x98/0x38c | lr : perf_pmu_migrate_context+0x94/0x38c | | Call trace: | perf_pmu_migrate_context+0x98/0x38c | hisi_hns3_pmu_offline_cpu+0x104/0x12c [hisi_hns3_pmu] Use cpuhp_state_remove_instance_nocalls() instead of cpuhp_state_remove_instance() so that the notifiers don't execute after the PMU device has been unregistered. [will: Rewrote commit message]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: h6: Reparent CPUX during PLL CPUX rate change While PLL CPUX clock rate change when CPU is running from it works in vast majority of cases, now and then it causes instability. This leads to system crashes and other undefined behaviour. After a lot of testing (30+ hours) while also doing a lot of frequency switches, we can't observe any instability issues anymore when doing reparenting to stable clock like 24 MHz oscillator.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memory corruption.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel's SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors may allow an authorized user to potentially enable escalation of privilege local access


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth modules) allows Overflow Buffers. This vulnerability is associated with program files /net/bluetooth/rfcomm/core.C. This issue affects Linux kernel: v2.6.12-rc2.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

A race condition was found in the Linux kernel's media/xc4000 device driver in xc4000 xc4000_get_frequency() function. This can result in return value overflow issue, possibly leading to malfunction or denial of service issue.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a missing check for ubi->leb_size.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on code in mb_free_blocks(), fast commit replay can end up marking as free blocks that are already marked as such. This causes corruption of the buddy bitmap so we need to regenerate it in that case.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: xsk: fix usage of multi-buffer BPF helpers for ZC XDP Currently when packet is shrunk via bpf_xdp_adjust_tail() and memory type is set to MEM_TYPE_XSK_BUFF_POOL, null ptr dereference happens: [1136314.192256] BUG: kernel NULL pointer dereference, address: 0000000000000034 [1136314.203943] #PF: supervisor read access in kernel mode [1136314.213768] #PF: error_code(0x0000) - not-present page [1136314.223550] PGD 0 P4D 0 [1136314.230684] Oops: 0000 [#1] PREEMPT SMP NOPTI [1136314.239621] CPU: 8 PID: 54203 Comm: xdpsock Not tainted 6.6.0+ #257 [1136314.250469] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [1136314.265615] RIP: 0010:__xdp_return+0x6c/0x210 [1136314.274653] Code: ad 00 48 8b 47 08 49 89 f8 a8 01 0f 85 9b 01 00 00 0f 1f 44 00 00 f0 41 ff 48 34 75 32 4c 89 c7 e9 79 cd 80 ff 83 fe 03 75 17 <f6> 41 34 01 0f 85 02 01 00 00 48 89 cf e9 22 cc 1e 00 e9 3d d2 86 [1136314.302907] RSP: 0018:ffffc900089f8db0 EFLAGS: 00010246 [1136314.312967] RAX: ffffc9003168aed0 RBX: ffff8881c3300000 RCX: 0000000000000000 [1136314.324953] RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffc9003168c000 [1136314.336929] RBP: 0000000000000ae0 R08: 0000000000000002 R09: 0000000000010000 [1136314.348844] R10: ffffc9000e495000 R11: 0000000000000040 R12: 0000000000000001 [1136314.360706] R13: 0000000000000524 R14: ffffc9003168aec0 R15: 0000000000000001 [1136314.373298] FS: 00007f8df8bbcb80(0000) GS:ffff8897e0e00000(0000) knlGS:0000000000000000 [1136314.386105] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1136314.396532] CR2: 0000000000000034 CR3: 00000001aa912002 CR4: 00000000007706f0 [1136314.408377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1136314.420173] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1136314.431890] PKRU: 55555554 [1136314.439143] Call Trace: [1136314.446058] <IRQ> [1136314.452465] ? __die+0x20/0x70 [1136314.459881] ? page_fault_oops+0x15b/0x440 [1136314.468305] ? exc_page_fault+0x6a/0x150 [1136314.476491] ? asm_exc_page_fault+0x22/0x30 [1136314.484927] ? __xdp_return+0x6c/0x210 [1136314.492863] bpf_xdp_adjust_tail+0x155/0x1d0 [1136314.501269] bpf_prog_ccc47ae29d3b6570_xdp_sock_prog+0x15/0x60 [1136314.511263] ice_clean_rx_irq_zc+0x206/0xc60 [ice] [1136314.520222] ? ice_xmit_zc+0x6e/0x150 [ice] [1136314.528506] ice_napi_poll+0x467/0x670 [ice] [1136314.536858] ? ttwu_do_activate.constprop.0+0x8f/0x1a0 [1136314.546010] __napi_poll+0x29/0x1b0 [1136314.553462] net_rx_action+0x133/0x270 [1136314.561619] __do_softirq+0xbe/0x28e [1136314.569303] do_softirq+0x3f/0x60 This comes from __xdp_return() call with xdp_buff argument passed as NULL which is supposed to be consumed by xsk_buff_free() call. To address this properly, in ZC case, a node that represents the frag being removed has to be pulled out of xskb_list. Introduce appropriate xsk helpers to do such node operation and use them accordingly within bpf_xdp_adjust_tail().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the accept_queue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value 0x0! WARNING: CPU: 19 PID: 21160 at __pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508) Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:__pv_queued_spin_unlock_slowpath (kernel/locking/qspinlock_paravirt.h:508) Code: 73 56 3a ff 90 c3 cc cc cc cc 8b 05 bb 1f 48 01 85 c0 74 05 c3 cc cc cc cc 8b 17 48 89 fe 48 c7 c7 30 20 ce 8f e8 ad 56 42 ff <0f> 0b c3 cc cc cc cc 0f 0b 0f 1f 40 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffa8d200604cb8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9d1ef60e0908 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff9d1ef60e0900 RBP: ffff9d181cd5c280 R08: 0000000000000000 R09: 00000000ffff7fff R10: ffffa8d200604b68 R11: ffffffff907dcdc8 R12: 0000000000000000 R13: ffff9d181cd5c660 R14: ffff9d1813a3f330 R15: 0000000000001000 FS: 00007fa110184640(0000) GS:ffff9d1ef60c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000011f65e000 CR4: 00000000000006f0 Call Trace: <IRQ> _raw_spin_unlock (kernel/locking/spinlock.c:186) inet_csk_reqsk_queue_add (net/ipv4/inet_connection_sock.c:1321) inet_csk_complete_hashdance (net/ipv4/inet_connection_sock.c:1358) tcp_check_req (net/ipv4/tcp_minisocks.c:868) tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2260) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) ip_local_deliver_finish (net/ipv4/ip_input.c:234) __netif_receive_skb_one_core (net/core/dev.c:5529) process_backlog (./include/linux/rcupdate.h:779) __napi_poll (net/core/dev.c:6533) net_rx_action (net/core/dev.c:6604) __do_softirq (./arch/x86/include/asm/jump_label.h:27) do_softirq (kernel/softirq.c:454 kernel/softirq.c:441) </IRQ> <TASK> __local_bh_enable_ip (kernel/softirq.c:381) __dev_queue_xmit (net/core/dev.c:4374) ip_finish_output2 (./include/net/neighbour.h:540 net/ipv4/ip_output.c:235) __ip_queue_xmit (net/ipv4/ip_output.c:535) __tcp_transmit_skb (net/ipv4/tcp_output.c:1462) tcp_rcv_synsent_state_process (net/ipv4/tcp_input.c:6469) tcp_rcv_state_process (net/ipv4/tcp_input.c:6657) tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1929) __release_sock (./include/net/sock.h:1121 net/core/sock.c:2968) release_sock (net/core/sock.c:3536) inet_wait_for_connect (net/ipv4/af_inet.c:609) __inet_stream_connect (net/ipv4/af_inet.c:702) inet_stream_connect (net/ipv4/af_inet.c:748) __sys_connect (./include/linux/file.h:45 net/socket.c:2064) __x64_sys_connect (net/socket.c:2073 net/socket.c:2070 net/socket.c:2070) do_syscall_64 (arch/x86/entry/common.c:51 arch/x86/entry/common.c:82) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:129) RIP: 0033:0x7fa10ff05a3d Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ab a3 0e 00 f7 d8 64 89 01 48 RSP: 002b:00007fa110183de8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000020000054 RCX: 00007fa10ff05a3d RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003 RBP: 00007fa110183e20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007fa110184640 R13: 0000000000000000 R14: 00007fa10fe8b060 R15: 00007fff73e23b20 </TASK> The issue triggering process is analyzed as follows: Thread A Thread B tcp_v4_rcv //receive ack TCP packet inet_shutdown tcp_check_req tcp_disconnect //disconnect sock ... tcp_set_state(sk, TCP_CLOSE) inet_csk_complete_hashdance ... inet_csk_reqsk_queue_add ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: block: Fix iterating over an empty bio with bio_for_each_folio_all If the bio contains no data, bio_first_folio() calls page_folio() on a NULL pointer and oopses. Move the test that we've reached the end of the bio from bio_next_folio() to bio_first_folio(). [axboe: add unlikely() to error case]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nbd: always initialize struct msghdr completely syzbot complains that msg->msg_get_inq value can be uninitialized [1] struct msghdr got many new fields recently, we should always make sure their values is zero by default. [1] BUG: KMSAN: uninit-value in tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 tcp_recvmsg+0x686/0xac0 net/ipv4/tcp.c:2571 inet_recvmsg+0x131/0x580 net/ipv4/af_inet.c:879 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg+0x12b/0x1e0 net/socket.c:1066 __sock_xmit+0x236/0x5c0 drivers/block/nbd.c:538 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x104e/0x1e70 kernel/workqueue.c:2700 worker_thread+0xf45/0x1490 kernel/workqueue.c:2781 kthread+0x3ed/0x540 kernel/kthread.c:388 ret_from_fork+0x66/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242 Local variable msg created at: __sock_xmit+0x4c/0x5c0 drivers/block/nbd.c:513 nbd_read_reply drivers/block/nbd.c:732 [inline] recv_work+0x262/0x3100 drivers/block/nbd.c:863 CPU: 1 PID: 7465 Comm: kworker/u5:1 Not tainted 6.7.0-rc7-syzkaller-00041-gf016f7547aee #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: nbd5-recv recv_work


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow anonymous set with timeout flag Anonymous sets are never used with timeout from userspace, reject this. Exception to this rule is NFT_SET_EVAL to ensure legacy meters still work.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout While the rhashtable set gc runs asynchronously, a race allows it to collect elements from anonymous sets with timeouts while it is being released from the commit path. Mingi Cho originally reported this issue in a different path in 6.1.x with a pipapo set with low timeouts which is not possible upstream since 7395dfacfff6 ("netfilter: nf_tables: use timestamp to check for set element timeout"). Fix this by setting on the dead flag for anonymous sets to skip async gc in this case. According to 08e4c8c5919f ("netfilter: nf_tables: mark newset as dead on transaction abort"), Florian plans to accelerate abort path by releasing objects via workqueue, therefore, this sets on the dead flag for abort path too.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), Callback function pdsc_auxbus_dev_release calls kfree(padev) to free memory. We shouldn't call kfree(padev) again in the error handling path. Fix this by cleaning up the redundant kfree() and putting the error handling back to where the errors happened.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs The dreamcastcard->timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard->timer. When the snd_pcm_substream is closing, the aica_channel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that del_timer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below: (Thread 1) | (Thread 2) snd_aicapcm_pcm_close() | ... | run_spu_dma() //worker | mod_timer() flush_work() | del_timer() | aica_period_elapsed() //timer kfree(dreamcastcard->channel) | schedule_work() | run_spu_dma() //worker ... | dreamcastcard->channel-> //USE In order to mitigate this bug and other possible corner cases, call mod_timer() conditionally in run_spu_dma(), then implement PCM sync_stop op to cancel both the timer and worker. The sync_stop op will be called from PCM core appropriately when needed.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free bug The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo Jung <joonkyoj@yonsei.ac.kr>. For example the following code: static void Syzkaller1(int fd) { struct drm_amdgpu_gem_userptr arg; int ret; arg.addr = 0xffffffffffff0000; arg.size = 0x80000000; /*2 Gb*/ arg.flags = 0x7; ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg); } Due to the address and size are not valid there is a failure in amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert-> check_shl_overflow, but we even the amdgpu_hmm_register failure we still call amdgpu_hmm_unregister into amdgpu_gem_object_free which causes access to a bad address. The following stack is below when the issue is reproduced when Kazan is enabled: [ +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340 [ +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80 [ +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246 [ +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b [ +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260 [ +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25 [ +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00 [ +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260 [ +0.000011] FS: 00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000 [ +0.000012] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0 [ +0.000010] Call Trace: [ +0.000006] <TASK> [ +0.000007] ? show_regs+0x6a/0x80 [ +0.000018] ? __warn+0xa5/0x1b0 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000018] ? report_bug+0x24a/0x290 [ +0.000022] ? handle_bug+0x46/0x90 [ +0.000015] ? exc_invalid_op+0x19/0x50 [ +0.000016] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000017] ? kasan_save_stack+0x26/0x50 [ +0.000017] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x327/0x340 [ +0.000019] ? mmu_interval_notifier_remove+0x23b/0x340 [ +0.000020] ? __pfx_mmu_interval_notifier_remove+0x10/0x10 [ +0.000017] ? kasan_save_alloc_info+0x1e/0x30 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __kasan_kmalloc+0xb1/0xc0 [ +0.000018] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? __kasan_check_read+0x11/0x20 [ +0.000020] amdgpu_hmm_unregister+0x34/0x50 [amdgpu] [ +0.004695] amdgpu_gem_object_free+0x66/0xa0 [amdgpu] [ +0.004534] ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu] [ +0.004291] ? do_syscall_64+0x5f/0xe0 [ +0.000023] ? srso_return_thunk+0x5/0x5f [ +0.000017] drm_gem_object_free+0x3b/0x50 [drm] [ +0.000489] amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu] [ +0.004295] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004270] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? __this_cpu_preempt_check+0x13/0x20 [ +0.000015] ? srso_return_thunk+0x5/0x5f [ +0.000013] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ +0.000020] ? srso_return_thunk+0x5/0x5f [ +0.000014] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.000022] ? drm_ioctl_kernel+0x17b/0x1f0 [drm] [ +0.000496] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004272] ? drm_ioctl_kernel+0x190/0x1f0 [drm] [ +0.000492] drm_ioctl_kernel+0x140/0x1f0 [drm] [ +0.000497] ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu] [ +0.004297] ? __pfx_drm_ioctl_kernel+0x10/0x10 [d ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/sched: fix null-ptr-deref in init entity The bug can be triggered by sending an amdgpu_cs_wait_ioctl to the AMDGPU DRM driver on any ASICs with valid context. The bug was reported by Joonkyo Jung <joonkyoj@yonsei.ac.kr>. For example the following code: static void Syzkaller2(int fd) { union drm_amdgpu_ctx arg1; union drm_amdgpu_wait_cs arg2; arg1.in.op = AMDGPU_CTX_OP_ALLOC_CTX; ret = drmIoctl(fd, 0x140106442 /* amdgpu_ctx_ioctl */, &arg1); arg2.in.handle = 0x0; arg2.in.timeout = 0x2000000000000; arg2.in.ip_type = AMD_IP_VPE /* 0x9 */; arg2->in.ip_instance = 0x0; arg2.in.ring = 0x0; arg2.in.ctx_id = arg1.out.alloc.ctx_id; drmIoctl(fd, 0xc0206449 /* AMDGPU_WAIT_CS * /, &arg2); } The ioctl AMDGPU_WAIT_CS without previously submitted job could be assumed that the error should be returned, but the following commit 1decbf6bb0b4dc56c9da6c5e57b994ebfc2be3aa modified the logic and allowed to have sched_rq equal to NULL. As a result when there is no job the ioctl AMDGPU_WAIT_CS returns success. The change fixes null-ptr-deref in init entity and the stack below demonstrates the error condition: [ +0.000007] BUG: kernel NULL pointer dereference, address: 0000000000000028 [ +0.007086] #PF: supervisor read access in kernel mode [ +0.005234] #PF: error_code(0x0000) - not-present page [ +0.005232] PGD 0 P4D 0 [ +0.002501] Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI [ +0.005034] CPU: 10 PID: 9229 Comm: amd_basic Tainted: G B W L 6.7.0+ #4 [ +0.007797] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.009798] RIP: 0010:drm_sched_entity_init+0x2d3/0x420 [gpu_sched] [ +0.006426] Code: 80 00 00 00 00 00 00 00 e8 1a 81 82 e0 49 89 9c 24 c0 00 00 00 4c 89 ef e8 4a 80 82 e0 49 8b 5d 00 48 8d 7b 28 e8 3d 80 82 e0 <48> 83 7b 28 00 0f 84 28 01 00 00 4d 8d ac 24 98 00 00 00 49 8d 5c [ +0.019094] RSP: 0018:ffffc90014c1fa40 EFLAGS: 00010282 [ +0.005237] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff8113f3fa [ +0.007326] RDX: fffffbfff0a7889d RSI: 0000000000000008 RDI: ffffffff853c44e0 [ +0.007264] RBP: ffffc90014c1fa80 R08: 0000000000000001 R09: fffffbfff0a7889c [ +0.007266] R10: ffffffff853c44e7 R11: 0000000000000001 R12: ffff8881a719b010 [ +0.007263] R13: ffff88810d412748 R14: 0000000000000002 R15: 0000000000000000 [ +0.007264] FS: 00007ffff7045540(0000) GS:ffff8883cc900000(0000) knlGS:0000000000000000 [ +0.008236] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.005851] CR2: 0000000000000028 CR3: 000000011912e000 CR4: 0000000000350ef0 [ +0.007175] Call Trace: [ +0.002561] <TASK> [ +0.002141] ? show_regs+0x6a/0x80 [ +0.003473] ? __die+0x25/0x70 [ +0.003124] ? page_fault_oops+0x214/0x720 [ +0.004179] ? preempt_count_sub+0x18/0xc0 [ +0.004093] ? __pfx_page_fault_oops+0x10/0x10 [ +0.004590] ? srso_return_thunk+0x5/0x5f [ +0.004000] ? vprintk_default+0x1d/0x30 [ +0.004063] ? srso_return_thunk+0x5/0x5f [ +0.004087] ? vprintk+0x5c/0x90 [ +0.003296] ? drm_sched_entity_init+0x2d3/0x420 [gpu_sched] [ +0.005807] ? srso_return_thunk+0x5/0x5f [ +0.004090] ? _printk+0xb3/0xe0 [ +0.003293] ? __pfx__printk+0x10/0x10 [ +0.003735] ? asm_sysvec_apic_timer_interrupt+0x1b/0x20 [ +0.005482] ? do_user_addr_fault+0x345/0x770 [ +0.004361] ? exc_page_fault+0x64/0xf0 [ +0.003972] ? asm_exc_page_fault+0x27/0x30 [ +0.004271] ? add_taint+0x2a/0xa0 [ +0.003476] ? drm_sched_entity_init+0x2d3/0x420 [gpu_sched] [ +0.005812] amdgpu_ctx_get_entity+0x3f9/0x770 [amdgpu] [ +0.009530] ? finish_task_switch.isra.0+0x129/0x470 [ +0.005068] ? __pfx_amdgpu_ctx_get_entity+0x10/0x10 [amdgpu] [ +0.010063] ? __kasan_check_write+0x14/0x20 [ +0.004356] ? srso_return_thunk+0x5/0x5f [ +0.004001] ? mutex_unlock+0x81/0xd0 [ +0.003802] ? srso_return_thunk+0x5/0x5f [ +0.004096] amdgpu_cs_wait_ioctl+0xf6/0x270 [amdgpu] [ +0.009355] ? __pfx_ ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime blk_mq_mark_tag_wait() can't get driver tag successfully. This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop. modprobe -r scsi_debug modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ --runtime=100 --numjobs=40 --time_based --name=test \ --ioengine=libaio Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which is just fine in case of running out of tag.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations - Disallow families other than NFPROTO_{IPV4,IPV6,INET}. - Disallow layer 4 protocol with no ports, since destination port is a mandatory attribute for this object.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups During memory error injection test on kernels >= v6.4, the kernel panics like below. However, this issue couldn't be reproduced on kernels <= v6.3. mce: [Hardware Error]: CPU 296: Machine Check Exception: f Bank 1: bd80000000100134 mce: [Hardware Error]: RIP 10:<ffffffff821b9776> {__get_user_nocheck_4+0x6/0x20} mce: [Hardware Error]: TSC 411a93533ed ADDR 346a8730040 MISC 86 mce: [Hardware Error]: PROCESSOR 0:a06d0 TIME 1706000767 SOCKET 1 APIC 211 microcode 80001490 mce: [Hardware Error]: Run the above through 'mcelog --ascii' mce: [Hardware Error]: Machine check: Data load in unrecoverable area of kernel Kernel panic - not syncing: Fatal local machine check The MCA code can recover from an in-kernel #MC if the fixup type is EX_TYPE_UACCESS, explicitly indicating that the kernel is attempting to access userspace memory. However, if the fixup type is EX_TYPE_DEFAULT the only thing that is raised for an in-kernel #MC is a panic. ex_handler_uaccess() would warn if users gave a non-canonical addresses (with bit 63 clear) to {get, put}_user(), which was unexpected. Therefore, commit b19b74bc99b1 ("x86/mm: Rework address range check in get_user() and put_user()") replaced _ASM_EXTABLE_UA() with _ASM_EXTABLE() for {get, put}_user() fixups. However, the new fixup type EX_TYPE_DEFAULT results in a panic. Commit 6014bc27561f ("x86-64: make access_ok() independent of LAM") added the check gp_fault_address_ok() right before the WARN_ONCE() in ex_handler_uaccess() to not warn about non-canonical user addresses due to LAM. With that in place, revert back to _ASM_EXTABLE_UA() for {get,put}_user() exception fixups in order to be able to handle in-kernel MCEs correctly again. [ bp: Massage commit message. ]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K") Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU) [1]: WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 Modules linked in: CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 Workqueue: events_unbound flush_to_ldisc pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537 sp : ffff800093967580 x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000 x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0 x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8 x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120 x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005 x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000 x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001 x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0 Call trace: __alloc_pages+0x308/0x698 mm/page_alloc.c:4543 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926 __do_kmalloc_node mm/slub.c:3969 [inline] __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001 kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590 __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651 __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715 netdev_alloc_skb include/linux/skbuff.h:3235 [inline] dev_alloc_skb include/linux/skbuff.h:3248 [inline] ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline] ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341 tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390 tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:444 [inline] flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494 process_one_work+0x694/0x1204 kernel/workqueue.c:2633 process_scheduled_works kernel/workqueue.c:2706 [inline] worker_thread+0x938/0xef4 kernel/workqueue.c:2787 kthread+0x288/0x310 kernel/kthread.c:388 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error() inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac: fix handling of DPP safety error for DMA channels Commit 56e58d6c8a56 ("net: stmmac: Implement Safety Features in XGMAC core") checks and reports safety errors, but leaves the Data Path Parity Errors for each channel in DMA unhandled at all, lead to a storm of interrupt. Fix it by checking and clearing the DMA_DPP_Interrupt_Status register.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in end_buffer_async_write According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition of the buffer async_write flag and cause a BUG_ON failure when using nilfs2. Nilfs2 itself does not use end_buffer_async_write(). But, the async_write flag is now used as a marker by commit 7f42ec394156 ("nilfs2: fix issue with race condition of competition between segments for dirty blocks") as a means of resolving double list insertion of dirty blocks in nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the resulting crash. This modification is safe as long as it is used for file data and b-tree node blocks where the page caches are independent. However, it was irrelevant and redundant to also introduce async_write for segment summary and super root blocks that share buffers with the backing device. This led to the possibility that the BUG_ON check in end_buffer_async_write would fail as described above, if independent writebacks of the backing device occurred in parallel. The use of async_write for segment summary buffers has already been removed in a previous change. Fix this issue by removing the manipulation of the async_write flag for the remaining super root block buffer.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: Fix regression in writes when non-standard maximum write size negotiated The conversion to netfs in the 6.3 kernel caused a regression when maximum write size is set by the server to an unexpected value which is not a multiple of 4096 (similarly if the user overrides the maximum write size by setting mount parm "wsize", but sets it to a value that is not a multiple of 4096). When negotiated write size is not a multiple of 4096 the netfs code can skip the end of the final page when doing large sequential writes, causing data corruption. This section of code is being rewritten/removed due to a large netfs change, but until that point (ie for the 6.3 kernel until now) we can not support non-standard maximum write sizes. Add a warning if a user specifies a wsize on mount that is not a multiple of 4096 (and round down), also add a change where we round down the maximum write size if the server negotiates a value that is not a multiple of 4096 (we also have to check to make sure that we do not round it down to zero).


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() Syzbot reported a hang issue in migrate_pages_batch() called by mbind() and nilfs_lookup_dirty_data_buffers() called in the log writer of nilfs2. While migrate_pages_batch() locks a folio and waits for the writeback to complete, the log writer thread that should bring the writeback to completion picks up the folio being written back in nilfs_lookup_dirty_data_buffers() that it calls for subsequent log creation and was trying to lock the folio. Thus causing a deadlock. In the first place, it is unexpected that folios/pages in the middle of writeback will be updated and become dirty. Nilfs2 adds a checksum to verify the validity of the log being written and uses it for recovery at mount, so data changes during writeback are suppressed. Since this is broken, an unclean shutdown could potentially cause recovery to fail. Investigation revealed that the root cause is that the wait for writeback completion in nilfs_page_mkwrite() is conditional, and if the backing device does not require stable writes, data may be modified without waiting. Fix these issues by making nilfs_page_mkwrite() wait for writeback to finish regardless of the stable write requirement of the backing device.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the on-page offset when copying repair data to the file's page cache. In environments where the block size is smaller than the page size, this flaw can cause data corruption and leak uninitialized memory bytes during the recovery process. Fix these issues by correcting this byte offset calculation on the page.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents moved_len In ext4_move_extents(), moved_len is only updated when all moves are successfully executed, and only discards orig_inode and donor_inode preallocations when moved_len is not zero. When the loop fails to exit after successfully moving some extents, moved_len is not updated and remains at 0, so it does not discard the preallocations. If the moved extents overlap with the preallocated extents, the overlapped extents are freed twice in ext4_mb_release_inode_pa() and ext4_process_freed_data() (as described in commit 94d7c16cbbbd ("ext4: Fix double-free of blocks with EXT4_IOC_MOVE_EXT")), and bb_free is incremented twice. Hence when trim is executed, a zero-division bug is triggered in mb_update_avg_fragment_size() because bb_free is not zero and bb_fragments is zero. Therefore, update move_len after each extent move to avoid the issue.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: interconnect: qcom: sc8180x: Mark CO0 BCM keepalive The CO0 BCM needs to be up at all times, otherwise some hardware (like the UFS controller) loses its connection to the rest of the SoC, resulting in a hang of the platform, accompanied by a spectacular logspam. Mark it as keepalive to prevent such cases.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't drop extent_map for free space inode on write error While running the CI for an unrelated change I hit the following panic with generic/648 on btrfs_holes_spacecache. assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1385! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G W 6.8.0-rc2+ #1 RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0 Call Trace: <TASK> extent_write_cache_pages+0x2ac/0x8f0 extent_writepages+0x87/0x110 do_writepages+0xd5/0x1f0 filemap_fdatawrite_wbc+0x63/0x90 __filemap_fdatawrite_range+0x5c/0x80 btrfs_fdatawrite_range+0x1f/0x50 btrfs_write_out_cache+0x507/0x560 btrfs_write_dirty_block_groups+0x32a/0x420 commit_cowonly_roots+0x21b/0x290 btrfs_commit_transaction+0x813/0x1360 btrfs_sync_file+0x51a/0x640 __x64_sys_fdatasync+0x52/0x90 do_syscall_64+0x9c/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76 This happens because we fail to write out the free space cache in one instance, come back around and attempt to write it again. However on the second pass through we go to call btrfs_get_extent() on the inode to get the extent mapping. Because this is a new block group, and with the free space inode we always search the commit root to avoid deadlocking with the tree, we find nothing and return a EXTENT_MAP_HOLE for the requested range. This happens because the first time we try to write the space cache out we hit an error, and on an error we drop the extent mapping. This is normal for normal files, but the free space cache inode is special. We always expect the extent map to be correct. Thus the second time through we end up with a bogus extent map. Since we're deprecating this feature, the most straightforward way to fix this is to simply skip dropping the extent map range for this failed range. I shortened the test by using error injection to stress the area to make it easier to reproduce. With this patch in place we no longer panic with my error injection test.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready() syzbot reported the following NULL pointer dereference issue [1]: BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:0x0 [...] Call Trace: <TASK> sk_psock_verdict_data_ready+0x232/0x340 net/core/skmsg.c:1230 unix_stream_sendmsg+0x9b4/0x1230 net/unix/af_unix.c:2293 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 If sk_psock_verdict_data_ready() and sk_psock_stop_verdict() are called concurrently, psock->saved_data_ready can be NULL, causing the above issue. This patch fixes this issue by calling the appropriate data ready function using the sk_psock_data_ready() helper and protecting it from concurrency with sk->sk_callback_lock.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour entry and copies neigh->ha to struct arpreq.arp_ha.sa_data. The arp_ha here is struct sockaddr, not struct sockaddr_storage, so the sa_data buffer is just 14 bytes. In the splat below, 2 bytes are overflown to the next int field, arp_flags. We initialise the field just after the memcpy(), so it's not a problem. However, when dev->addr_len is greater than 22 (e.g. MAX_ADDR_LEN), arp_netmask is overwritten, which could be set as htonl(0xFFFFFFFFUL) in arp_ioctl() before calling arp_req_get(). To avoid the overflow, let's limit the max length of memcpy(). Note that commit b5f0de6df6dc ("net: dev: Convert sa_data to flexible array in struct sockaddr") just silenced syzkaller. [0]: memcpy: detected field-spanning write (size 16) of single field "r->arp_ha.sa_data" at net/ipv4/arp.c:1128 (size 14) WARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128 Modules linked in: CPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014 RIP: 0010:arp_req_get+0x411/0x4a0 net/ipv4/arp.c:1128 Code: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb <0f> 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6 RSP: 0018:ffffc900050b7998 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001 RBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000 R13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010 FS: 00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> arp_ioctl+0x33f/0x4b0 net/ipv4/arp.c:1261 inet_ioctl+0x314/0x3a0 net/ipv4/af_inet.c:981 sock_do_ioctl+0xdf/0x260 net/socket.c:1204 sock_ioctl+0x3ef/0x650 net/socket.c:1321 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x18e/0x220 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x37/0x90 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x64/0xce RIP: 0033:0x7f172b262b8d Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d RDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003 RBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000 </TASK>


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: afs: Increase buffer size in afs_update_volume_status() The max length of volume->vid value is 20 characters. So increase idbuf[] size up to 24 to avoid overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. [DH: Actually, it's 20 + NUL, so increase it to 24 and use snprintf()]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel The following race is possible between bpf_timer_cancel_and_free and bpf_timer_cancel. It will lead a UAF on the timer->timer. bpf_timer_cancel(); spin_lock(); t = timer->time; spin_unlock(); bpf_timer_cancel_and_free(); spin_lock(); t = timer->timer; timer->timer = NULL; spin_unlock(); hrtimer_cancel(&t->timer); kfree(t); /* UAF on t */ hrtimer_cancel(&t->timer); In bpf_timer_cancel_and_free, this patch frees the timer->timer after a rcu grace period. This requires a rcu_head addition to the "struct bpf_hrtimer". Another kfree(t) happens in bpf_timer_init, this does not need a kfree_rcu because it is still under the spin_lock and timer->timer has not been visible by others yet. In bpf_timer_cancel, rcu_read_lock() is added because this helper can be used in a non rcu critical section context (e.g. from a sleepable bpf prog). Other timer->timer usages in helpers.c have been audited, bpf_timer_cancel() is the only place where timer->timer is used outside of the spin_lock. Another solution considered is to mark a t->flag in bpf_timer_cancel and clear it after hrtimer_cancel() is done. In bpf_timer_cancel_and_free, it busy waits for the flag to be cleared before kfree(t). This patch goes with a straight forward solution and frees timer->timer after a rcu grace period.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: use the backlog for mirred ingress The test Davide added in commit ca22da2fbd69 ("act_mirred: use the backlog for nested calls to mirred ingress") hangs our testing VMs every 10 or so runs, with the familiar tcp_v4_rcv -> tcp_v4_rcv deadlock reported by lockdep. The problem as previously described by Davide (see Link) is that if we reverse flow of traffic with the redirect (egress -> ingress) we may reach the same socket which generated the packet. And we may still be holding its socket lock. The common solution to such deadlocks is to put the packet in the Rx backlog, rather than run the Rx path inline. Do that for all egress -> ingress reversals, not just once we started to nest mirred calls. In the past there was a concern that the backlog indirection will lead to loss of error reporting / less accurate stats. But the current workaround does not seem to address the issue.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix disable_managed_interrupts Correct blk-mq registration issue with module parameter disable_managed_interrupts enabled. When we turn off the default PCI_IRQ_AFFINITY flag, the driver needs to register with blk-mq using blk_mq_map_queues(). The driver is currently calling blk_mq_pci_map_queues() which results in a stack trace and possibly undefined behavior. Stack Trace: [ 7.860089] scsi host2: smartpqi [ 7.871934] WARNING: CPU: 0 PID: 238 at block/blk-mq-pci.c:52 blk_mq_pci_map_queues+0xca/0xd0 [ 7.889231] Modules linked in: sd_mod t10_pi sg uas smartpqi(+) crc32c_intel scsi_transport_sas usb_storage dm_mirror dm_region_hash dm_log dm_mod ipmi_devintf ipmi_msghandler fuse [ 7.924755] CPU: 0 PID: 238 Comm: kworker/0:3 Not tainted 4.18.0-372.88.1.el8_6_smartpqi_test.x86_64 #1 [ 7.944336] Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 03/08/2022 [ 7.963026] Workqueue: events work_for_cpu_fn [ 7.978275] RIP: 0010:blk_mq_pci_map_queues+0xca/0xd0 [ 7.978278] Code: 48 89 de 89 c7 e8 f6 0f 4f 00 3b 05 c4 b7 8e 01 72 e1 5b 31 c0 5d 41 5c 41 5d 41 5e 41 5f e9 7d df 73 00 31 c0 e9 76 df 73 00 <0f> 0b eb bc 90 90 0f 1f 44 00 00 41 57 49 89 ff 41 56 41 55 41 54 [ 7.978280] RSP: 0018:ffffa95fc3707d50 EFLAGS: 00010216 [ 7.978283] RAX: 00000000ffffffff RBX: 0000000000000000 RCX: 0000000000000010 [ 7.978284] RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffff9190c32d4310 [ 7.978286] RBP: 0000000000000000 R08: ffffa95fc3707d38 R09: ffff91929b81ac00 [ 7.978287] R10: 0000000000000001 R11: ffffa95fc3707ac0 R12: 0000000000000000 [ 7.978288] R13: ffff9190c32d4000 R14: 00000000ffffffff R15: ffff9190c4c950a8 [ 7.978290] FS: 0000000000000000(0000) GS:ffff9193efc00000(0000) knlGS:0000000000000000 [ 7.978292] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.172814] CR2: 000055d11166c000 CR3: 00000002dae10002 CR4: 00000000007706f0 [ 8.172816] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8.172817] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8.172818] PKRU: 55555554 [ 8.172819] Call Trace: [ 8.172823] blk_mq_alloc_tag_set+0x12e/0x310 [ 8.264339] scsi_add_host_with_dma.cold.9+0x30/0x245 [ 8.279302] pqi_ctrl_init+0xacf/0xc8e [smartpqi] [ 8.294085] ? pqi_pci_probe+0x480/0x4c8 [smartpqi] [ 8.309015] pqi_pci_probe+0x480/0x4c8 [smartpqi] [ 8.323286] local_pci_probe+0x42/0x80 [ 8.337855] work_for_cpu_fn+0x16/0x20 [ 8.351193] process_one_work+0x1a7/0x360 [ 8.364462] ? create_worker+0x1a0/0x1a0 [ 8.379252] worker_thread+0x1ce/0x390 [ 8.392623] ? create_worker+0x1a0/0x1a0 [ 8.406295] kthread+0x10a/0x120 [ 8.418428] ? set_kthread_struct+0x50/0x50 [ 8.431532] ret_from_fork+0x1f/0x40 [ 8.444137] ---[ end trace 1bf0173d39354506 ]---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: md: Don't register sync_thread for reshape directly Currently, if reshape is interrupted, then reassemble the array will register sync_thread directly from pers->run(), in this case 'MD_RECOVERY_RUNNING' is set directly, however, there is no guarantee that md_do_sync() will be executed, hence stop_sync_thread() will hang because 'MD_RECOVERY_RUNNING' can't be cleared. Last patch make sure that md_do_sync() will set MD_RECOVERY_DONE, however, following hang can still be triggered by dm-raid test shell/lvconvert-raid-reshape.sh occasionally: [root@fedora ~]# cat /proc/1982/stack [<0>] stop_sync_thread+0x1ab/0x270 [md_mod] [<0>] md_frozen_sync_thread+0x5c/0xa0 [md_mod] [<0>] raid_presuspend+0x1e/0x70 [dm_raid] [<0>] dm_table_presuspend_targets+0x40/0xb0 [dm_mod] [<0>] __dm_destroy+0x2a5/0x310 [dm_mod] [<0>] dm_destroy+0x16/0x30 [dm_mod] [<0>] dev_remove+0x165/0x290 [dm_mod] [<0>] ctl_ioctl+0x4bb/0x7b0 [dm_mod] [<0>] dm_ctl_ioctl+0x11/0x20 [dm_mod] [<0>] vfs_ioctl+0x21/0x60 [<0>] __x64_sys_ioctl+0xb9/0xe0 [<0>] do_syscall_64+0xc6/0x230 [<0>] entry_SYSCALL_64_after_hwframe+0x6c/0x74 Meanwhile mddev->recovery is: MD_RECOVERY_RUNNING | MD_RECOVERY_INTR | MD_RECOVERY_RESHAPE | MD_RECOVERY_FROZEN Fix this problem by remove the code to register sync_thread directly from raid10 and raid5. And let md_check_recovery() to register sync_thread.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: md: Don't ignore read-only array in md_check_recovery() Usually if the array is not read-write, md_check_recovery() won't register new sync_thread in the first place. And if the array is read-write and sync_thread is registered, md_set_readonly() will unregister sync_thread before setting the array read-only. md/raid follow this behavior hence there is no problem. After commit f52f5c71f3d4 ("md: fix stopping sync thread"), following hang can be triggered by test shell/integrity-caching.sh: 1) array is read-only. dm-raid update super block: rs_update_sbs ro = mddev->ro mddev->ro = 0 -> set array read-write md_update_sb 2) register new sync thread concurrently. 3) dm-raid set array back to read-only: rs_update_sbs mddev->ro = ro 4) stop the array: raid_dtr md_stop stop_sync_thread set_bit(MD_RECOVERY_INTR, &mddev->recovery); md_wakeup_thread_directly(mddev->sync_thread); wait_event(..., !test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) 5) sync thread done: md_do_sync set_bit(MD_RECOVERY_DONE, &mddev->recovery); md_wakeup_thread(mddev->thread); 6) daemon thread can't unregister sync thread: md_check_recovery if (!md_is_rdwr(mddev) && !test_bit(MD_RECOVERY_NEEDED, &mddev->recovery)) return; -> -> MD_RECOVERY_RUNNING can't be cleared, hence step 4 hang; The root cause is that dm-raid manipulate 'mddev->ro' by itself, however, dm-raid really should stop sync thread before setting the array read-only. Unfortunately, I need to read more code before I can refacter the handler of 'mddev->ro' in dm-raid, hence let's fix the problem the easy way for now to prevent dm-raid regression.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: scsi: target: pscsi: Fix bio_put() for error case As of commit 066ff571011d ("block: turn bio_kmalloc into a simple kmalloc wrapper"), a bio allocated by bio_kmalloc() must be freed by bio_uninit() and kfree(). That is not done properly for the error case, hitting WARN and NULL pointer dereference in bio_free().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

unknown


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window The Linux CXL subsystem is built on the assumption that HPA == SPA. That is, the host physical address (HPA) the HDM decoder registers are programmed with are system physical addresses (SPA). During HDM decoder setup, the DVSEC CXL range registers (cxl-3.1, 8.1.3.8) are checked if the memory is enabled and the CXL range is in a HPA window that is described in a CFMWS structure of the CXL host bridge (cxl-3.1, 9.18.1.3). Now, if the HPA is not an SPA, the CXL range does not match a CFMWS window and the CXL memory range will be disabled then. The HDM decoder stops working which causes system memory being disabled and further a system hang during HDM decoder initialization, typically when a CXL enabled kernel boots. Prevent a system hang and do not disable the HDM decoder if the decoder's CXL range is not found in a CFMWS window. Note the change only fixes a hardware hang, but does not implement HPA/SPA translation. Support for this can be added in a follow on patch series.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the following kernel warning appears: WARNING: CPU: 3 PID: 368 at fs/aio.c:598 kiocb_set_cancel_fn+0x9c/0xa8 Call trace: kiocb_set_cancel_fn+0x9c/0xa8 ffs_epfile_read_iter+0x144/0x1d0 io_read+0x19c/0x498 io_issue_sqe+0x118/0x27c io_submit_sqes+0x25c/0x5fc __arm64_sys_io_uring_enter+0x104/0xab0 invoke_syscall+0x58/0x11c el0_svc_common+0xb4/0xf4 do_el0_svc+0x2c/0xb0 el0_svc+0x2c/0xa4 el0t_64_sync_handler+0x68/0xb4 el0t_64_sync+0x1a4/0x1a8 Fix this by setting the IOCB_AIO_RW flag for read and write I/O that is submitted by libaio.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid deadlock on delete association path When deleting an association the shutdown path is deadlocking because we try to flush the nvmet_wq nested. Avoid this by deadlock by deferring the put work into its own work item.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid allocating blocks from a group with a corrupted block bitmap in the following concurrency and making the situation worse. ext4_mb_regular_allocator ext4_lock_group(sb, group) ext4_mb_good_group // check if the group bbitmap is corrupted ext4_mb_complex_scan_group // Scan group gets ac_b_ex but doesn't use it ext4_unlock_group(sb, group) ext4_mark_group_bitmap_corrupted(group) // The block bitmap was corrupted during // the group unlock gap. ext4_mb_try_best_found ext4_lock_group(ac->ac_sb, group) ext4_mb_use_best_found mb_mark_used // Allocating blocks in block bitmap corrupted group


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt Determine if bb_fragments is 0 instead of determining bb_free to eliminate the risk of dividing by zero when the block bitmap is corrupted.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: aoe: avoid potential deadlock at set_capacity Move set_capacity() outside of the section procected by (&d->lock). To avoid possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- [1] lock(&bdev->bd_size_lock); local_irq_disable(); [2] lock(&d->lock); [3] lock(&bdev->bd_size_lock); <Interrupt> [4] lock(&d->lock); *** DEADLOCK *** Where [1](&bdev->bd_size_lock) hold by zram_add()->set_capacity(). [2]lock(&d->lock) hold by aoeblk_gdalloc(). And aoeblk_gdalloc() is trying to acquire [3](&bdev->bd_size_lock) at set_capacity() call. In this situation an attempt to acquire [4]lock(&d->lock) from aoecmd_cfg_rsp() will lead to deadlock. So the simplest solution is breaking lock dependency [2](&d->lock) -> [3](&bdev->bd_size_lock) by moving set_capacity() outside.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix race condition on enabling fast-xmit fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls to the driver, leading to potential crashes because of uninitialized drv_priv data. Add a missing sta->uploaded check and re-check fast xmit after inserting a sta.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index With numa balancing on, when a numa system is running where a numa node doesn't have its local memory so it has no managed zones, the following oops has been observed. It's because wakeup_kswapd() is called with a wrong zone index, -1. Fixed it by checking the index before calling wakeup_kswapd(). > BUG: unable to handle page fault for address: 00000000000033f3 > #PF: supervisor read access in kernel mode > #PF: error_code(0x0000) - not-present page > PGD 0 P4D 0 > Oops: 0000 [#1] PREEMPT SMP NOPTI > CPU: 2 PID: 895 Comm: masim Not tainted 6.6.0-dirty #255 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS > rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 > RIP: 0010:wakeup_kswapd (./linux/mm/vmscan.c:7812) > Code: (omitted) > RSP: 0000:ffffc90004257d58 EFLAGS: 00010286 > RAX: ffffffffffffffff RBX: ffff88883fff0480 RCX: 0000000000000003 > RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88883fff0480 > RBP: ffffffffffffffff R08: ff0003ffffffffff R09: ffffffffffffffff > R10: ffff888106c95540 R11: 0000000055555554 R12: 0000000000000003 > R13: 0000000000000000 R14: 0000000000000000 R15: ffff88883fff0940 > FS: 00007fc4b8124740(0000) GS:ffff888827c00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00000000000033f3 CR3: 000000026cc08004 CR4: 0000000000770ee0 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > PKRU: 55555554 > Call Trace: > <TASK> > ? __die > ? page_fault_oops > ? __pte_offset_map_lock > ? exc_page_fault > ? asm_exc_page_fault > ? wakeup_kswapd > migrate_misplaced_page > __handle_mm_fault > handle_mm_fault > do_user_addr_fault > exc_page_fault > asm_exc_page_fault > RIP: 0033:0x55b897ba0808 > Code: (omitted) > RSP: 002b:00007ffeefa821a0 EFLAGS: 00010287 > RAX: 000055b89983acd0 RBX: 00007ffeefa823f8 RCX: 000055b89983acd0 > RDX: 00007fc2f8122010 RSI: 0000000000020000 RDI: 000055b89983acd0 > RBP: 00007ffeefa821a0 R08: 0000000000000037 R09: 0000000000000075 > R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 > R13: 00007ffeefa82410 R14: 000055b897ba5dd8 R15: 00007fc4b8340000 > </TASK>


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix iopt_access_list_id overwrite bug Syzkaller reported the following WARN_ON: WARNING: CPU: 1 PID: 4738 at drivers/iommu/iommufd/io_pagetable.c:1360 Call Trace: iommufd_access_change_ioas+0x2fe/0x4e0 iommufd_access_destroy_object+0x50/0xb0 iommufd_object_remove+0x2a3/0x490 iommufd_object_destroy_user iommufd_access_destroy+0x71/0xb0 iommufd_test_staccess_release+0x89/0xd0 __fput+0x272/0xb50 __fput_sync+0x4b/0x60 __do_sys_close __se_sys_close __x64_sys_close+0x8b/0x110 do_syscall_x64 The mismatch between the access pointer in the list and the passed-in pointer is resulting from an overwrite of access->iopt_access_list_id, in iopt_add_access(). Called from iommufd_access_change_ioas() when xa_alloc() succeeds but iopt_calculate_iova_alignment() fails. Add a new_id in iopt_add_access() and only update iopt_access_list_id when returning successfully.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel(). Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later. This was originally analyzed and fixed in a different way by Edward Adam Davis (see links).


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_newlink() The gtp_link_ops operations structure for the subsystem must be registered after registering the gtp_net_ops pernet operations structure. Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug: [ 1010.702740] gtp: GTP module unloaded [ 1010.715877] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI [ 1010.715888] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 1010.715895] CPU: 1 PID: 128616 Comm: a.out Not tainted 6.8.0-rc6-std-def-alt1 #1 [ 1010.715899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-alt1 04/01/2014 [ 1010.715908] RIP: 0010:gtp_newlink+0x4d7/0x9c0 [gtp] [ 1010.715915] Code: 80 3c 02 00 0f 85 41 04 00 00 48 8b bb d8 05 00 00 e8 ed f6 ff ff 48 89 c2 48 89 c5 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 4f 04 00 00 4c 89 e2 4c 8b 6d 00 48 b8 00 00 00 [ 1010.715920] RSP: 0018:ffff888020fbf180 EFLAGS: 00010203 [ 1010.715929] RAX: dffffc0000000000 RBX: ffff88800399c000 RCX: 0000000000000000 [ 1010.715933] RDX: 0000000000000001 RSI: ffffffff84805280 RDI: 0000000000000282 [ 1010.715938] RBP: 000000000000000d R08: 0000000000000001 R09: 0000000000000000 [ 1010.715942] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88800399cc80 [ 1010.715947] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000400 [ 1010.715953] FS: 00007fd1509ab5c0(0000) GS:ffff88805b300000(0000) knlGS:0000000000000000 [ 1010.715958] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1010.715962] CR2: 0000000000000000 CR3: 000000001c07a000 CR4: 0000000000750ee0 [ 1010.715968] PKRU: 55555554 [ 1010.715972] Call Trace: [ 1010.715985] ? __die_body.cold+0x1a/0x1f [ 1010.715995] ? die_addr+0x43/0x70 [ 1010.716002] ? exc_general_protection+0x199/0x2f0 [ 1010.716016] ? asm_exc_general_protection+0x1e/0x30 [ 1010.716026] ? gtp_newlink+0x4d7/0x9c0 [gtp] [ 1010.716034] ? gtp_net_exit+0x150/0x150 [gtp] [ 1010.716042] __rtnl_newlink+0x1063/0x1700 [ 1010.716051] ? rtnl_setlink+0x3c0/0x3c0 [ 1010.716063] ? is_bpf_text_address+0xc0/0x1f0 [ 1010.716070] ? kernel_text_address.part.0+0xbb/0xd0 [ 1010.716076] ? __kernel_text_address+0x56/0xa0 [ 1010.716084] ? unwind_get_return_address+0x5a/0xa0 [ 1010.716091] ? create_prof_cpu_mask+0x30/0x30 [ 1010.716098] ? arch_stack_walk+0x9e/0xf0 [ 1010.716106] ? stack_trace_save+0x91/0xd0 [ 1010.716113] ? stack_trace_consume_entry+0x170/0x170 [ 1010.716121] ? __lock_acquire+0x15c5/0x5380 [ 1010.716139] ? mark_held_locks+0x9e/0xe0 [ 1010.716148] ? kmem_cache_alloc_trace+0x35f/0x3c0 [ 1010.716155] ? __rtnl_newlink+0x1700/0x1700 [ 1010.716160] rtnl_newlink+0x69/0xa0 [ 1010.716166] rtnetlink_rcv_msg+0x43b/0xc50 [ 1010.716172] ? rtnl_fdb_dump+0x9f0/0x9f0 [ 1010.716179] ? lock_acquire+0x1fe/0x560 [ 1010.716188] ? netlink_deliver_tap+0x12f/0xd50 [ 1010.716196] netlink_rcv_skb+0x14d/0x440 [ 1010.716202] ? rtnl_fdb_dump+0x9f0/0x9f0 [ 1010.716208] ? netlink_ack+0xab0/0xab0 [ 1010.716213] ? netlink_deliver_tap+0x202/0xd50 [ 1010.716220] ? netlink_deliver_tap+0x218/0xd50 [ 1010.716226] ? __virt_addr_valid+0x30b/0x590 [ 1010.716233] netlink_unicast+0x54b/0x800 [ 1010.716240] ? netlink_attachskb+0x870/0x870 [ 1010.716248] ? __check_object_size+0x2de/0x3b0 [ 1010.716254] netlink_sendmsg+0x938/0xe40 [ 1010.716261] ? netlink_unicast+0x800/0x800 [ 1010.716269] ? __import_iovec+0x292/0x510 [ 1010.716276] ? netlink_unicast+0x800/0x800 [ 1010.716284] __sock_sendmsg+0x159/0x190 [ 1010.716290] ____sys_sendmsg+0x712/0x880 [ 1010.716297] ? sock_write_iter+0x3d0/0x3d0 [ 1010.716304] ? __ia32_sys_recvmmsg+0x270/0x270 [ 1010.716309] ? lock_acquire+0x1fe/0x560 [ 1010.716315] ? drain_array_locked+0x90/0x90 [ 1010.716324] ___sys_sendmsg+0xf8/0x170 [ 1010.716331] ? sendmsg_copy_msghdr+0x170/0x170 [ 1010.716337] ? lockdep_init_map ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between ordered extent completion and fiemap For fiemap we recently stopped locking the target extent range for the whole duration of the fiemap call, in order to avoid a deadlock in a scenario where the fiemap buffer happens to be a memory mapped range of the same file. This use case is very unlikely to be useful in practice but it may be triggered by fuzz testing (syzbot, etc). However by not locking the target extent range for the whole duration of the fiemap call we can race with an ordered extent. This happens like this: 1) The fiemap task finishes processing a file extent item that covers the file range [512K, 1M[, and that file extent item is the last item in the leaf currently being processed; 2) And ordered extent for the file range [768K, 2M[, in COW mode, completes (btrfs_finish_one_ordered()) and the file extent item covering the range [512K, 1M[ is trimmed to cover the range [512K, 768K[ and then a new file extent item for the range [768K, 2M[ is inserted in the inode's subvolume tree; 3) The fiemap task calls fiemap_next_leaf_item(), which then calls btrfs_next_leaf() to find the next leaf / item. This finds that the the next key following the one we previously processed (its type is BTRFS_EXTENT_DATA_KEY and its offset is 512K), is the key corresponding to the new file extent item inserted by the ordered extent, which has a type of BTRFS_EXTENT_DATA_KEY and an offset of 768K; 4) Later the fiemap code ends up at emit_fiemap_extent() and triggers the warning: if (cache->offset + cache->len > offset) { WARN_ON(1); return -EINVAL; } Since we get 1M > 768K, because the previously emitted entry for the old extent covering the file range [512K, 1M[ ends at an offset that is greater than the new extent's start offset (768K). This makes fiemap fail with -EINVAL besides triggering the warning that produces a stack trace like the following: [1621.677651] ------------[ cut here ]------------ [1621.677656] WARNING: CPU: 1 PID: 204366 at fs/btrfs/extent_io.c:2492 emit_fiemap_extent+0x84/0x90 [btrfs] [1621.677899] Modules linked in: btrfs blake2b_generic (...) [1621.677951] CPU: 1 PID: 204366 Comm: pool Not tainted 6.8.0-rc5-btrfs-next-151+ #1 [1621.677954] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [1621.677956] RIP: 0010:emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678033] Code: 2b 4c 89 63 (...) [1621.678035] RSP: 0018:ffffab16089ffd20 EFLAGS: 00010206 [1621.678037] RAX: 00000000004fa000 RBX: ffffab16089ffe08 RCX: 0000000000009000 [1621.678039] RDX: 00000000004f9000 RSI: 00000000004f1000 RDI: ffffab16089ffe90 [1621.678040] RBP: 00000000004f9000 R08: 0000000000001000 R09: 0000000000000000 [1621.678041] R10: 0000000000000000 R11: 0000000000001000 R12: 0000000041d78000 [1621.678043] R13: 0000000000001000 R14: 0000000000000000 R15: ffff9434f0b17850 [1621.678044] FS: 00007fa6e20006c0(0000) GS:ffff943bdfa40000(0000) knlGS:0000000000000000 [1621.678046] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1621.678048] CR2: 00007fa6b0801000 CR3: 000000012d404002 CR4: 0000000000370ef0 [1621.678053] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1621.678055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1621.678056] Call Trace: [1621.678074] <TASK> [1621.678076] ? __warn+0x80/0x130 [1621.678082] ? emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678159] ? report_bug+0x1f4/0x200 [1621.678164] ? handle_bug+0x42/0x70 [1621.678167] ? exc_invalid_op+0x14/0x70 [1621.678170] ? asm_exc_invalid_op+0x16/0x20 [1621.678178] ? emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678253] extent_fiemap+0x766 ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: stmmac: Clear variable when destroying workqueue Currently when suspending driver and stopping workqueue it is checked whether workqueue is not NULL and if so, it is destroyed. Function destroy_workqueue() does drain queue and does clear variable, but it does not set workqueue variable to NULL. This can cause kernel/module panic if code attempts to clear workqueue that was not initialized. This scenario is possible when resuming suspended driver in stmmac_resume(), because there is no handling for failed stmmac_hw_setup(), which can fail and return if DMA engine has failed to initialize, and workqueue is initialized after DMA engine. Should DMA engine fail to initialize, resume will proceed normally, but interface won't work and TX queue will eventually timeout, causing 'Reset adapter' error. This then does destroy workqueue during reset process. And since workqueue is initialized after DMA engine and can be skipped, it will cause kernel/module panic. To secure against this possible crash, set workqueue variable to NULL when destroying workqueue. Log/backtrace from crash goes as follows: [88.031977]------------[ cut here ]------------ [88.031985]NETDEV WATCHDOG: eth0 (sxgmac): transmit queue 1 timed out [88.032017]WARNING: CPU: 0 PID: 0 at net/sched/sch_generic.c:477 dev_watchdog+0x390/0x398 <Skipping backtrace for watchdog timeout> [88.032251]---[ end trace e70de432e4d5c2c0 ]--- [88.032282]sxgmac 16d88000.ethernet eth0: Reset adapter. [88.036359]------------[ cut here ]------------ [88.036519]Call trace: [88.036523] flush_workqueue+0x3e4/0x430 [88.036528] drain_workqueue+0xc4/0x160 [88.036533] destroy_workqueue+0x40/0x270 [88.036537] stmmac_fpe_stop_wq+0x4c/0x70 [88.036541] stmmac_release+0x278/0x280 [88.036546] __dev_close_many+0xcc/0x158 [88.036551] dev_close_many+0xbc/0x190 [88.036555] dev_close.part.0+0x70/0xc0 [88.036560] dev_close+0x24/0x30 [88.036564] stmmac_service_task+0x110/0x140 [88.036569] process_one_work+0x1d8/0x4a0 [88.036573] worker_thread+0x54/0x408 [88.036578] kthread+0x164/0x170 [88.036583] ret_from_fork+0x10/0x20 [88.036588]---[ end trace e70de432e4d5c2c1 ]--- [88.036597]Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` passed as a 1st arg of netlink_to_full_skb() onto new `skb`. The data size is specified as `len` and passed to skb_put_data(). This `len` is based on `skb->end` that is not data offset but buffer offset. The `skb->end` contains data and tailroom. Since the tailroom is not initialized when the new `skb` created, KMSAN detects uninitialized memory area when copying the data. This patch resolved this issue by correct the len from `skb->end` to `skb->len`, which is the actual data offset. BUG: KMSAN: kernel-infoleak-after-free in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak-after-free in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak-after-free in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak-after-free in _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x364/0x2520 lib/iov_iter.c:186 copy_to_iter include/linux/uio.h:197 [inline] simple_copy_to_iter+0x68/0xa0 net/core/datagram.c:532 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:420 skb_copy_datagram_iter+0x5c/0x200 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] packet_recvmsg+0xd9c/0x2000 net/packet/af_packet.c:3482 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg net/socket.c:1066 [inline] sock_read_iter+0x467/0x580 net/socket.c:1136 call_read_iter include/linux/fs.h:2014 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x8f6/0xe00 fs/read_write.c:470 ksys_read+0x20f/0x4c0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x93/0xd0 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was stored to memory at: skb_put_data include/linux/skbuff.h:2622 [inline] netlink_to_full_skb net/netlink/af_netlink.c:181 [inline] __netlink_deliver_tap_skb net/netlink/af_netlink.c:298 [inline] __netlink_deliver_tap+0x5be/0xc90 net/netlink/af_netlink.c:325 netlink_deliver_tap net/netlink/af_netlink.c:338 [inline] netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline] netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x10f1/0x1250 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1238/0x13d0 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: free_pages_prepare mm/page_alloc.c:1087 [inline] free_unref_page_prepare+0xb0/0xa40 mm/page_alloc.c:2347 free_unref_page_list+0xeb/0x1100 mm/page_alloc.c:2533 release_pages+0x23d3/0x2410 mm/swap.c:1042 free_pages_and_swap_cache+0xd9/0xf0 mm/swap_state.c:316 tlb_batch_pages ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Both cadence-quadspi ->runtime_suspend() and ->runtime_resume() implementations start with: struct cqspi_st *cqspi = dev_get_drvdata(dev); struct spi_controller *host = dev_get_drvdata(dev); This obviously cannot be correct, unless "struct cqspi_st" is the first member of " struct spi_controller", or the other way around, but it is not the case. "struct spi_controller" is allocated by devm_spi_alloc_host(), which allocates an extra amount of memory for private data, used to store "struct cqspi_st". The ->probe() function of the cadence-quadspi driver then sets the device drvdata to store the address of the "struct cqspi_st" structure. Therefore: struct cqspi_st *cqspi = dev_get_drvdata(dev); is correct, but: struct spi_controller *host = dev_get_drvdata(dev); is not, as it makes "host" point not to a "struct spi_controller" but to the same "struct cqspi_st" structure as above. This obviously leads to bad things (memory corruption, kernel crashes) directly during ->probe(), as ->probe() enables the device using PM runtime, leading the ->runtime_resume() hook being called, which in turns calls spi_controller_resume() with the wrong pointer. This has at least been reported [0] to cause a kernel crash, but the exact behavior will depend on the memory contents. [0] https://lore.kernel.org/all/20240226121803.5a7r5wkpbbowcxgx@dhruva/ This issue potentially affects all platforms that are currently using the cadence-quadspi driver.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check taprio_parse_tc_entry() is not correctly checking TCA_TAPRIO_TC_ENTRY_INDEX attribute: int tc; // Signed value tc = nla_get_u32(tb[TCA_TAPRIO_TC_ENTRY_INDEX]); if (tc >= TC_QOPT_MAX_QUEUE) { NL_SET_ERR_MSG_MOD(extack, "TC entry index out of range"); return -ERANGE; } syzbot reported that it could fed arbitary negative values: UBSAN: shift-out-of-bounds in net/sched/sch_taprio.c:1722:18 shift exponent -2147418108 is negative CPU: 0 PID: 5066 Comm: syz-executor367 Not tainted 6.8.0-rc7-syzkaller-00136-gc8a5c731fd12 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_shift_out_of_bounds+0x3c7/0x420 lib/ubsan.c:386 taprio_parse_tc_entry net/sched/sch_taprio.c:1722 [inline] taprio_parse_tc_entries net/sched/sch_taprio.c:1768 [inline] taprio_change+0xb87/0x57d0 net/sched/sch_taprio.c:1877 taprio_init+0x9da/0xc80 net/sched/sch_taprio.c:2134 qdisc_create+0x9d4/0x1190 net/sched/sch_api.c:1355 tc_modify_qdisc+0xa26/0x1e40 net/sched/sch_api.c:1776 rtnetlink_rcv_msg+0x885/0x1040 net/core/rtnetlink.c:6617 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2543 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x7ea/0x980 net/netlink/af_netlink.c:1367 netlink_sendmsg+0xa3b/0xd70 net/netlink/af_netlink.c:1908 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2667 do_syscall_64+0xf9/0x240 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f1b2dea3759 Code: 48 83 c4 28 c3 e8 d7 19 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd4de452f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f1b2def0390 RCX: 00007f1b2dea3759 RDX: 0000000000000000 RSI: 00000000200007c0 RDI: 0000000000000004 RBP: 0000000000000003 R08: 0000555500000000 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007ffd4de45340 R13: 00007ffd4de45310 R14: 0000000000000001 R15: 00007ffd4de45340


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section so that Xen can find the "startup_xen" entry point. This information is used prior to booting the kernel, so relocations are not useful. In fact, performing relocations against the .notes section means that the KASLR base is exposed since /sys/kernel/notes is world-readable. To avoid leaking the KASLR base without breaking unprivileged tools that are expecting to read /sys/kernel/notes, skip performing relocations in the .notes section. The values readable in .notes are then identical to those found in System.map.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: set correct id, uid and cruid for multiuser automounts When uid, gid and cruid are not specified, we need to dynamically set them into the filesystem context used for automounting otherwise they'll end up reusing the values from the parent mount.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "bytes_left" is type ssize_t while sizeof() is type size_t. That means that because of type promotion, the comparison is done as an unsigned and if we have negative bytes left the loop continues instead of ending.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mm: zswap: fix missing folio cleanup in writeback race path In zswap_writeback_entry(), after we get a folio from __read_swap_cache_async(), we grab the tree lock again to check that the swap entry was not invalidated and recycled. If it was, we delete the folio we just added to the swap cache and exit. However, __read_swap_cache_async() returns the folio locked when it is newly allocated, which is always true for this path, and the folio is ref'd. Make sure to unlock and put the folio before returning. This was discovered by code inspection, probably because this path handles a race condition that should not happen often, and the bug would not crash the system, it will only strand the folio indefinitely.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix password opcode ordering for workstations The Lenovo workstations require the password opcode to be run before the attribute value is changed (if Admin password is enabled). Tested on some Thinkpads to confirm they are OK with this order too.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: block: Fix WARNING in _copy_from_iter Syzkaller reports a warning in _copy_from_iter because an iov_iter is supposedly used in the wrong direction. The reason is that syzcaller managed to generate a request with a transfer direction of SG_DXFER_TO_FROM_DEV. This instructs the kernel to copy user buffers into the kernel, read into the copied buffers and then copy the data back to user space. Thus the iovec is used in both directions. Detect this situation in the block layer and construct a new iterator with the correct direction for the copy-in.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: do not wait in vain when unloading module The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between nvme_delete_ctrl and ida_destroy has been added by the initial commit. There is some logic around trying to prevent from hanging forever in wait_for_completion, though it does not handling all cases. E.g. blktests is able to reproduce the situation where the module unload hangs forever. If we completely rely on the cleanup code executed from the nvme_delete_ctrl path, all IDs will be freed eventually. This makes calling ida_destroy unnecessary. We only have to ensure that all nvme_delete_ctrl code has been executed before we leave nvme_fc_exit_module. This is done by flushing the nvme_delete_wq workqueue. While at it, remove the unused nvme_fc_wq workqueue too.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: igc: avoid returning frame twice in XDP_REDIRECT When a frame can not be transmitted in XDP_REDIRECT (e.g. due to a full queue), it is necessary to free it by calling xdp_return_frame_rx_napi. However, this is the responsibility of the caller of the ndo_xdp_xmit (see for example bq_xmit_all in kernel/bpf/devmap.c) and thus calling it inside igc_xdp_xmit (which is the ndo_xdp_xmit of the igc driver) as well will lead to memory corruption. In fact, bq_xmit_all expects that it can return all frames after the last successfully transmitted one. Therefore, break for the first not transmitted frame, but do not call xdp_return_frame_rx_napi in igc_xdp_xmit. This is equally implemented in other Intel drivers such as the igb. There are two alternatives to this that were rejected: 1. Return num_frames as all the frames would have been transmitted and release them inside igc_xdp_xmit. While it might work technically, it is not what the return value is meant to represent (i.e. the number of SUCCESSFULLY transmitted packets). 2. Rework kernel/bpf/devmap.c and all drivers to support non-consecutively dropped packets. Besides being complex, it likely has a negative performance impact without a significant gain since it is anyway unlikely that the next frame can be transmitted if the previous one was dropped. The memory corruption can be reproduced with the following script which leads to a kernel panic after a few seconds. It basically generates more traffic than a i225 NIC can transmit and pushes it via XDP_REDIRECT from a virtual interface to the physical interface where frames get dropped. #!/bin/bash INTERFACE=enp4s0 INTERFACE_IDX=`cat /sys/class/net/$INTERFACE/ifindex` sudo ip link add dev veth1 type veth peer name veth2 sudo ip link set up $INTERFACE sudo ip link set up veth1 sudo ip link set up veth2 cat << EOF > redirect.bpf.c SEC("prog") int redirect(struct xdp_md *ctx) { return bpf_redirect($INTERFACE_IDX, 0); } char _license[] SEC("license") = "GPL"; EOF clang -O2 -g -Wall -target bpf -c redirect.bpf.c -o redirect.bpf.o sudo ip link set veth2 xdp obj redirect.bpf.o cat << EOF > pass.bpf.c SEC("prog") int pass(struct xdp_md *ctx) { return XDP_PASS; } char _license[] SEC("license") = "GPL"; EOF clang -O2 -g -Wall -target bpf -c pass.bpf.c -o pass.bpf.o sudo ip link set $INTERFACE xdp obj pass.bpf.o cat << EOF > trafgen.cfg { /* Ethernet Header */ 0xe8, 0x6a, 0x64, 0x41, 0xbf, 0x46, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, const16(ETH_P_IP), /* IPv4 Header */ 0b01000101, 0, # IPv4 version, IHL, TOS const16(1028), # IPv4 total length (UDP length + 20 bytes (IP header)) const16(2), # IPv4 ident 0b01000000, 0, # IPv4 flags, fragmentation off 64, # IPv4 TTL 17, # Protocol UDP csumip(14, 33), # IPv4 checksum /* UDP Header */ 10, 0, 1, 1, # IP Src - adapt as needed 10, 0, 1, 2, # IP Dest - adapt as needed const16(6666), # UDP Src Port const16(6666), # UDP Dest Port const16(1008), # UDP length (UDP header 8 bytes + payload length) csumudp(14, 34), # UDP checksum /* Payload */ fill('W', 1000), } EOF sudo trafgen -i trafgen.cfg -b3000MB -o veth1 --cpp


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ice: fix uninitialized dplls mutex usage The pf->dplls.lock mutex is initialized too late, after its first use. Move it to the top of ice_dpll_init. Note that the "err_exit" error path destroys the mutex. And the mutex is the last thing destroyed in ice_dpll_deinit. This fixes the following warning with CONFIG_DEBUG_MUTEXES: ice 0000:10:00.0: The DDP package was successfully loaded: ICE OS Default Package version 1.3.36.0 ice 0000:10:00.0: 252.048 Gb/s available PCIe bandwidth (16.0 GT/s PCIe x16 link) ice 0000:10:00.0: PTP init successful ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 0 PID: 410 at kernel/locking/mutex.c:587 __mutex_lock+0x773/0xd40 Modules linked in: crct10dif_pclmul crc32_pclmul crc32c_intel polyval_clmulni polyval_generic ice(+) nvme nvme_c> CPU: 0 PID: 410 Comm: kworker/0:4 Not tainted 6.8.0-rc5+ #3 Hardware name: HPE ProLiant DL110 Gen10 Plus/ProLiant DL110 Gen10 Plus, BIOS U56 10/19/2023 Workqueue: events work_for_cpu_fn RIP: 0010:__mutex_lock+0x773/0xd40 Code: c0 0f 84 1d f9 ff ff 44 8b 35 0d 9c 69 01 45 85 f6 0f 85 0d f9 ff ff 48 c7 c6 12 a2 a9 85 48 c7 c7 12 f1 a> RSP: 0018:ff7eb1a3417a7ae0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 0000000000000002 RSI: ffffffff85ac2bff RDI: 00000000ffffffff RBP: ff7eb1a3417a7b80 R08: 0000000000000000 R09: 00000000ffffbfff R10: ff7eb1a3417a7978 R11: ff32b80f7fd2e568 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ff32b7f02c50e0d8 FS: 0000000000000000(0000) GS:ff32b80efe800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055b5852cc000 CR3: 000000003c43a004 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x84/0x170 ? __mutex_lock+0x773/0xd40 ? report_bug+0x1c7/0x1d0 ? prb_read_valid+0x1b/0x30 ? handle_bug+0x42/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? __mutex_lock+0x773/0xd40 ? rcu_is_watching+0x11/0x50 ? __kmalloc_node_track_caller+0x346/0x490 ? ice_dpll_lock_status_get+0x28/0x50 [ice] ? __pfx_ice_dpll_lock_status_get+0x10/0x10 [ice] ? ice_dpll_lock_status_get+0x28/0x50 [ice] ice_dpll_lock_status_get+0x28/0x50 [ice] dpll_device_get_one+0x14f/0x2e0 dpll_device_event_send+0x7d/0x150 dpll_device_register+0x124/0x180 ice_dpll_init_dpll+0x7b/0xd0 [ice] ice_dpll_init+0x224/0xa40 [ice] ? _dev_info+0x70/0x90 ice_load+0x468/0x690 [ice] ice_probe+0x75b/0xa10 [ice] ? _raw_spin_unlock_irqrestore+0x4f/0x80 ? process_one_work+0x1a3/0x500 local_pci_probe+0x47/0xa0 work_for_cpu_fn+0x17/0x30 process_one_work+0x20d/0x500 worker_thread+0x1df/0x3e0 ? __pfx_worker_thread+0x10/0x10 kthread+0x103/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> irq event stamp: 125197 hardirqs last enabled at (125197): [<ffffffff8416409d>] finish_task_switch.isra.0+0x12d/0x3d0 hardirqs last disabled at (125196): [<ffffffff85134044>] __schedule+0xea4/0x19f0 softirqs last enabled at (105334): [<ffffffff84e1e65a>] napi_get_frags_check+0x1a/0x60 softirqs last disabled at (105332): [<ffffffff84e1e65a>] napi_get_frags_check+0x1a/0x60 ---[ end trace 0000000000000000 ]---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() The function ice_bridge_setlink() may encounter a NULL pointer dereference if nlmsg_find_attr() returns NULL and br_spec is dereferenced subsequently in nla_for_each_nested(). To address this issue, add a check to ensure that br_spec is not NULL before proceeding with the nested attribute iteration.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: Fix use after free inside sparx5_del_mact_entry Based on the static analyzis of the code it looks like when an entry from the MAC table was removed, the entry was still used after being freed. More precise the vid of the mac_entry was used after calling devm_kfree on the mac_entry. The fix consists in first using the vid of the mac_entry to delete the entry from the HW and after that to free it.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneve_rx() syzbot triggered a bug in geneve_rx() [1] Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call. pskb_inet_may_pull() makes sure the needed headers are in skb->head. [1] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] BUG: KMSAN: uninit-value in geneve_rx drivers/net/geneve.c:279 [inline] BUG: KMSAN: uninit-value in geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] geneve_rx drivers/net/geneve.c:279 [inline] geneve_udp_encap_recv+0x36f9/0x3c10 drivers/net/geneve.c:391 udp_queue_rcv_one_skb+0x1d39/0x1f20 net/ipv4/udp.c:2108 udp_queue_rcv_skb+0x6ae/0x6e0 net/ipv4/udp.c:2186 udp_unicast_rcv_skb+0x184/0x4b0 net/ipv4/udp.c:2346 __udp4_lib_rcv+0x1c6b/0x3010 net/ipv4/udp.c:2422 udp_rcv+0x7d/0xa0 net/ipv4/udp.c:2604 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 process_backlog+0x480/0x8b0 net/core/dev.c:5976 __napi_poll+0xe3/0x980 net/core/dev.c:6576 napi_poll net/core/dev.c:6645 [inline] net_rx_action+0x8b8/0x1870 net/core/dev.c:6778 __do_softirq+0x1b7/0x7c5 kernel/softirq.c:553 do_softirq+0x9a/0xf0 kernel/softirq.c:454 __local_bh_enable_ip+0x9b/0xa0 kernel/softirq.c:381 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:820 [inline] __dev_queue_xmit+0x2768/0x51c0 net/core/dev.c:4378 dev_queue_xmit include/linux/netdevice.h:3171 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8aef/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook mm/slub.c:3819 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_node+0x5cb/0xbc0 mm/slub.c:3903 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x352/0x790 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1296 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6394 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2783 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x70c2/0x9f10 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map Just simply reordering the functions mlx5e_ptp_metadata_map_put and mlx5e_ptpsq_track_metadata in the mlx5e_txwqe_complete context is not good enough since both the compiler and CPU are free to reorder these two functions. If reordering does occur, the issue that was supposedly fixed by 7e3f3ba97e6c ("net/mlx5e: Track xmit submission to PTP WQ after populating metadata map") will be seen. This will lead to NULL pointer dereferences in mlx5e_ptpsq_mark_ts_cqes_undelivered in the NAPI polling context due to the tracking list being populated before the metadata map.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix a memory leak when rechecking the data Memory for the "checksums" pointer will leak if the data is rechecked after checksum failure (because the associated kfree won't happen due to 'goto skip_io'). Fix this by freeing the checksums memory before recheck, and just use the "checksum_onstack" memory for storing checksum during recheck.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wireguard: receive: annotate data-race around receiving_counter.counter Syzkaller with KCSAN identified a data-race issue when accessing keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE() annotations to mark the data race as intentional. BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0: counter_validate drivers/net/wireguard/receive.c:321 [inline] wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461 __napi_poll+0x60/0x3b0 net/core/dev.c:6536 napi_poll net/core/dev.c:6605 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6738 __do_softirq+0xc4/0x279 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499 process_one_work kernel/workqueue.c:2633 [inline] ... read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1: decrypt_packet drivers/net/wireguard/receive.c:252 [inline] wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706 worker_thread+0x525/0x730 kernel/workqueue.c:2787 ...


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: packet: annotate data-races around ignore_outgoing ignore_outgoing is read locklessly from dev_queue_xmit_nit() and packet_getsockopt() Add appropriate READ_ONCE()/WRITE_ONCE() annotations. syzbot reported: BUG: KCSAN: data-race in dev_queue_xmit_nit / packet_setsockopt write to 0xffff888107804542 of 1 bytes by task 22618 on cpu 0: packet_setsockopt+0xd83/0xfd0 net/packet/af_packet.c:4003 do_sock_setsockopt net/socket.c:2311 [inline] __sys_setsockopt+0x1d8/0x250 net/socket.c:2334 __do_sys_setsockopt net/socket.c:2343 [inline] __se_sys_setsockopt net/socket.c:2340 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2340 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 read to 0xffff888107804542 of 1 bytes by task 27 on cpu 1: dev_queue_xmit_nit+0x82/0x620 net/core/dev.c:2248 xmit_one net/core/dev.c:3527 [inline] dev_hard_start_xmit+0xcc/0x3f0 net/core/dev.c:3547 __dev_queue_xmit+0xf24/0x1dd0 net/core/dev.c:4335 dev_queue_xmit include/linux/netdevice.h:3091 [inline] batadv_send_skb_packet+0x264/0x300 net/batman-adv/send.c:108 batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0x3f0/0x4b0 net/batman-adv/bat_iv_ogm.c:1700 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335 worker_thread+0x526/0x730 kernel/workqueue.c:3416 kthread+0x1d1/0x210 kernel/kthread.c:388 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 value changed: 0x00 -> 0x01 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 27 Comm: kworker/u8:1 Tainted: G W 6.8.0-syzkaller-08073-g480e035fc4c7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: spi: lpspi: Avoid potential use-after-free in probe() fsl_lpspi_probe() is allocating/disposing memory manually with spi_alloc_host()/spi_alloc_target(), but uses devm_spi_register_controller(). In case of error after the latter call the memory will be explicitly freed in the probe function by spi_controller_put() call, but used afterwards by "devm" management outside probe() (spi_unregister_controller() <- devm_spi_unregister() below). Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070 ... Call trace: kernfs_find_ns kernfs_find_and_get_ns sysfs_remove_group sysfs_remove_groups device_remove_attrs device_del spi_unregister_controller devm_spi_unregister release_nodes devres_release_all really_probe driver_probe_device __device_attach_driver bus_for_each_drv __device_attach device_initial_probe bus_probe_device deferred_probe_work_func process_one_work worker_thread kthread ret_from_fork


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nfs: fix panic when nfs4_ff_layout_prepare_ds() fails We've been seeing the following panic in production BUG: kernel NULL pointer dereference, address: 0000000000000065 PGD 2f485f067 P4D 2f485f067 PUD 2cc5d8067 PMD 0 RIP: 0010:ff_layout_cancel_io+0x3a/0x90 [nfs_layout_flexfiles] Call Trace: <TASK> ? __die+0x78/0xc0 ? page_fault_oops+0x286/0x380 ? __rpc_execute+0x2c3/0x470 [sunrpc] ? rpc_new_task+0x42/0x1c0 [sunrpc] ? exc_page_fault+0x5d/0x110 ? asm_exc_page_fault+0x22/0x30 ? ff_layout_free_layoutreturn+0x110/0x110 [nfs_layout_flexfiles] ? ff_layout_cancel_io+0x3a/0x90 [nfs_layout_flexfiles] ? ff_layout_cancel_io+0x6f/0x90 [nfs_layout_flexfiles] pnfs_mark_matching_lsegs_return+0x1b0/0x360 [nfsv4] pnfs_error_mark_layout_for_return+0x9e/0x110 [nfsv4] ? ff_layout_send_layouterror+0x50/0x160 [nfs_layout_flexfiles] nfs4_ff_layout_prepare_ds+0x11f/0x290 [nfs_layout_flexfiles] ff_layout_pg_init_write+0xf0/0x1f0 [nfs_layout_flexfiles] __nfs_pageio_add_request+0x154/0x6c0 [nfs] nfs_pageio_add_request+0x26b/0x380 [nfs] nfs_do_writepage+0x111/0x1e0 [nfs] nfs_writepages_callback+0xf/0x30 [nfs] write_cache_pages+0x17f/0x380 ? nfs_pageio_init_write+0x50/0x50 [nfs] ? nfs_writepages+0x6d/0x210 [nfs] ? nfs_writepages+0x6d/0x210 [nfs] nfs_writepages+0x125/0x210 [nfs] do_writepages+0x67/0x220 ? generic_perform_write+0x14b/0x210 filemap_fdatawrite_wbc+0x5b/0x80 file_write_and_wait_range+0x6d/0xc0 nfs_file_fsync+0x81/0x170 [nfs] ? nfs_file_mmap+0x60/0x60 [nfs] __x64_sys_fsync+0x53/0x90 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Inspecting the core with drgn I was able to pull this >>> prog.crashed_thread().stack_trace()[0] #0 at 0xffffffffa079657a (ff_layout_cancel_io+0x3a/0x84) in ff_layout_cancel_io at fs/nfs/flexfilelayout/flexfilelayout.c:2021:27 >>> prog.crashed_thread().stack_trace()[0]['idx'] (u32)1 >>> prog.crashed_thread().stack_trace()[0]['flseg'].mirror_array[1].mirror_ds (struct nfs4_ff_layout_ds *)0xffffffffffffffed This is clear from the stack trace, we call nfs4_ff_layout_prepare_ds() which could error out initializing the mirror_ds, and then we go to clean it all up and our check is only for if (!mirror->mirror_ds). This is inconsistent with the rest of the users of mirror_ds, which have if (IS_ERR_OR_NULL(mirror_ds)) to keep from tripping over this exact scenario. Fix this up in ff_layout_cancel_io() to make sure we don't panic when we get an error. I also spot checked all the other instances of checking mirror_ds and we appear to be doing the correct checks everywhere, only unconditionally dereferencing mirror_ds when we know it would be valid.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs4_listxattr() does not return an error because either generic_listxattr() or nfs4_listxattr_nfs4_label() consumes exactly all the bytes then size is 0 when calling nfs4_listxattr_nfs4_user() which then triggers the following kernel BUG: [ 99.403778] kernel BUG at mm/usercopy.c:102! [ 99.404063] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 99.408463] CPU: 0 PID: 3310 Comm: python3 Not tainted 6.6.0-61.fc40.aarch64 #1 [ 99.415827] Call trace: [ 99.415985] usercopy_abort+0x70/0xa0 [ 99.416227] __check_heap_object+0x134/0x158 [ 99.416505] check_heap_object+0x150/0x188 [ 99.416696] __check_object_size.part.0+0x78/0x168 [ 99.416886] __check_object_size+0x28/0x40 [ 99.417078] listxattr+0x8c/0x120 [ 99.417252] path_listxattr+0x78/0xe0 [ 99.417476] __arm64_sys_listxattr+0x28/0x40 [ 99.417723] invoke_syscall+0x78/0x100 [ 99.417929] el0_svc_common.constprop.0+0x48/0xf0 [ 99.418186] do_el0_svc+0x24/0x38 [ 99.418376] el0_svc+0x3c/0x110 [ 99.418554] el0t_64_sync_handler+0x120/0x130 [ 99.418788] el0t_64_sync+0x194/0x198 [ 99.418994] Code: aa0003e3 d000a3e0 91310000 97f49bdb (d4210000) Issue is reproduced when generic_listxattr() returns 'system.nfs4_acl', thus calling lisxattr() with size = 16 will trigger the bug. Add check on nfs4_listxattr() to return ERANGE error when it is called with size > 0 and the return value is greater than size.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is received on HIP08 devices The HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL, but the hardware can receive 1588 messages, and set the HNS3_RXD_TS_VLD_B bit, so, if match this case, the access of hdev->ptp->flags will cause a kernel crash: [ 5888.946472] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 [ 5888.946475] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 ... [ 5889.266118] pc : hclge_ptp_get_rx_hwts+0x40/0x170 [hclge] [ 5889.272612] lr : hclge_ptp_get_rx_hwts+0x34/0x170 [hclge] [ 5889.279101] sp : ffff800012c3bc50 [ 5889.283516] x29: ffff800012c3bc50 x28: ffff2040002be040 [ 5889.289927] x27: ffff800009116484 x26: 0000000080007500 [ 5889.296333] x25: 0000000000000000 x24: ffff204001c6f000 [ 5889.302738] x23: ffff204144f53c00 x22: 0000000000000000 [ 5889.309134] x21: 0000000000000000 x20: ffff204004220080 [ 5889.315520] x19: ffff204144f53c00 x18: 0000000000000000 [ 5889.321897] x17: 0000000000000000 x16: 0000000000000000 [ 5889.328263] x15: 0000004000140ec8 x14: 0000000000000000 [ 5889.334617] x13: 0000000000000000 x12: 00000000010011df [ 5889.340965] x11: bbfeff4d22000000 x10: 0000000000000000 [ 5889.347303] x9 : ffff800009402124 x8 : 0200f78811dfbb4d [ 5889.353637] x7 : 2200000000191b01 x6 : ffff208002a7d480 [ 5889.359959] x5 : 0000000000000000 x4 : 0000000000000000 [ 5889.366271] x3 : 0000000000000000 x2 : 0000000000000000 [ 5889.372567] x1 : 0000000000000000 x0 : ffff20400095c080 [ 5889.378857] Call trace: [ 5889.382285] hclge_ptp_get_rx_hwts+0x40/0x170 [hclge] [ 5889.388304] hns3_handle_bdinfo+0x324/0x410 [hns3] [ 5889.394055] hns3_handle_rx_bd+0x60/0x150 [hns3] [ 5889.399624] hns3_clean_rx_ring+0x84/0x170 [hns3] [ 5889.405270] hns3_nic_common_poll+0xa8/0x220 [hns3] [ 5889.411084] napi_poll+0xcc/0x264 [ 5889.415329] net_rx_action+0xd4/0x21c [ 5889.419911] __do_softirq+0x130/0x358 [ 5889.424484] irq_exit+0x134/0x154 [ 5889.428700] __handle_domain_irq+0x88/0xf0 [ 5889.433684] gic_handle_irq+0x78/0x2c0 [ 5889.438319] el1_irq+0xb8/0x140 [ 5889.442354] arch_cpu_idle+0x18/0x40 [ 5889.446816] default_idle_call+0x5c/0x1c0 [ 5889.451714] cpuidle_idle_call+0x174/0x1b0 [ 5889.456692] do_idle+0xc8/0x160 [ 5889.460717] cpu_startup_entry+0x30/0xfc [ 5889.465523] secondary_start_kernel+0x158/0x1ec [ 5889.470936] Code: 97ffab78 f9411c14 91408294 f9457284 (f9400c80) [ 5889.477950] SMP: stopping secondary CPUs [ 5890.514626] SMP: failed to stop secondary CPUs 0-69,71-95 [ 5890.522951] Starting crashdump kernel...


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() Apply the same fix than ones found in : 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") 1ca1ba465e55 ("geneve: make sure to pull inner header in geneve_rx()") We have to save skb->network_header in a temporary variable in order to be able to recompute the network_header pointer after a pskb_inet_may_pull() call. pskb_inet_may_pull() makes sure the needed headers are in skb->head. syzbot reported: BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] BUG: KMSAN: uninit-value in ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP_ECN_decapsulate include/net/inet_ecn.h:302 [inline] ip_tunnel_rcv+0xed9/0x2ed0 net/ipv4/ip_tunnel.c:409 __ipgre_rcv+0x9bc/0xbc0 net/ipv4/ip_gre.c:389 ipgre_rcv net/ipv4/ip_gre.c:411 [inline] gre_rcv+0x423/0x19f0 net/ipv4/ip_gre.c:447 gre_rcv+0x2a4/0x390 net/ipv4/gre_demux.c:163 ip_protocol_deliver_rcu+0x264/0x1300 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2b8/0x440 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] ip_local_deliver+0x21f/0x490 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:461 [inline] ip_rcv_finish net/ipv4/ip_input.c:449 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip_rcv+0x46f/0x760 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core net/core/dev.c:5534 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5648 netif_receive_skb_internal net/core/dev.c:5734 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5793 tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1556 tun_get_user+0x53b9/0x66e0 drivers/net/tun.c:2009 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055 call_write_iter include/linux/fs.h:2087 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb6b/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 alloc_pages_mpol+0x62b/0x9d0 mm/mempolicy.c:2133 alloc_pages+0x1be/0x1e0 mm/mempolicy.c:2204 skb_page_frag_refill+0x2bf/0x7c0 net/core/sock.c:2909 tun_build_skb drivers/net/tun.c:1686 [inline] tun_get_user+0xe0a/0x66e0 drivers/net/tun.c:1826 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2055 call_write_iter include/linux/fs.h:2087 [inline] new_sync_write fs/read_write.c:497 [inline] vfs_write+0xb6b/0x1520 fs/read_write.c:590 ksys_write+0x20f/0x4c0 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. The commit in the fixes tag actually attempted to fix this, but the fix did not account for the UB, so the fix only works on CPUs where an overflow does result in a neat truncation to zero, which is not guaranteed. Checking the value before rounding does not have this problem.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resulting value is 0. However, on 32-bit arches, the roundup code itself can overflow by doing a 32-bit left-shift of an unsigned long value, which is undefined behaviour, so it is not guaranteed to truncate neatly. This was triggered by syzbot on the DEVMAP_HASH type, which contains the same check, copied from the hashtab code. So apply the same fix to hashtab, by moving the overflow check to before the roundup.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches The devmap code allocates a number hash buckets equal to the next power of two of the max_entries value provided when creating the map. When rounding up to the next power of two, the 32-bit variable storing the number of buckets can overflow, and the code checks for overflow by checking if the truncated 32-bit value is equal to 0. However, on 32-bit arches the rounding up itself can overflow mid-way through, because it ends up doing a left-shift of 32 bits on an unsigned long value. If the size of an unsigned long is four bytes, this is undefined behaviour, so there is no guarantee that we'll end up with a nice and tidy 0-value at the end. Syzbot managed to turn this into a crash on arm32 by creating a DEVMAP_HASH with max_entries > 0x80000000 and then trying to update it. Fix this by moving the overflow check to before the rounding up operation.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution. In aoecmd_cfg_pkts(), it always calls dev_put(ifp) when skb initial code is finished. But the net_device ifp will still be used in later tx()->dev_queue_xmit() in kthread. Which means that the dev_put(ifp) should NOT be called in the success path of skb initial code in aoecmd_cfg_pkts(). Otherwise tx() may run into use-after-free because the net_device is freed. This patch removed the dev_put(ifp) in the success path in aoecmd_cfg_pkts(), and added dev_put() after skb xmit in tx().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: block: fix deadlock between bd_link_disk_holder and partition scan 'open_mutex' of gendisk is used to protect open/close block devices. But in bd_link_disk_holder(), it is used to protect the creation of symlink between holding disk and slave bdev, which introduces some issues. When bd_link_disk_holder() is called, the driver is usually in the process of initialization/modification and may suspend submitting io. At this time, any io hold 'open_mutex', such as scanning partitions, can cause deadlocks. For example, in raid: T1 T2 bdev_open_by_dev lock open_mutex [1] ... efi_partition ... md_submit_bio md_ioctl mddev_syspend -> suspend all io md_add_new_disk bind_rdev_to_array bd_link_disk_holder try lock open_mutex [2] md_handle_request -> wait mddev_resume T1 scan partition, T2 add a new device to raid. T1 waits for T2 to resume mddev, but T2 waits for open_mutex held by T1. Deadlock occurs. Fix it by introducing a local mutex 'blk_holder_mutex' to replace 'open_mutex'.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: md: fix kmemleak of rdev->serial If kobject_add() is fail in bind_rdev_to_array(), 'rdev->serial' will be alloc not be freed, and kmemleak occurs. unreferenced object 0xffff88815a350000 (size 49152): comm "mdadm", pid 789, jiffies 4294716910 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc f773277a): [<0000000058b0a453>] kmemleak_alloc+0x61/0xe0 [<00000000366adf14>] __kmalloc_large_node+0x15e/0x270 [<000000002e82961b>] __kmalloc_node.cold+0x11/0x7f [<00000000f206d60a>] kvmalloc_node+0x74/0x150 [<0000000034bf3363>] rdev_init_serial+0x67/0x170 [<0000000010e08fe9>] mddev_create_serial_pool+0x62/0x220 [<00000000c3837bf0>] bind_rdev_to_array+0x2af/0x630 [<0000000073c28560>] md_add_new_disk+0x400/0x9f0 [<00000000770e30ff>] md_ioctl+0x15bf/0x1c10 [<000000006cfab718>] blkdev_ioctl+0x191/0x3f0 [<0000000085086a11>] vfs_ioctl+0x22/0x60 [<0000000018b656fe>] __x64_sys_ioctl+0xba/0xe0 [<00000000e54e675e>] do_syscall_64+0x71/0x150 [<000000008b0ad622>] entry_SYSCALL_64_after_hwframe+0x6c/0x74


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak syzbot identified a kernel information leak vulnerability in do_sys_name_to_handle() and issued the following report [1]. [1] "BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _copy_to_user+0xbc/0x100 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline] do_sys_name_to_handle fs/fhandle.c:73 [inline] __do_sys_name_to_handle_at fs/fhandle.c:112 [inline] __se_sys_name_to_handle_at+0x949/0xb10 fs/fhandle.c:94 __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94 ... Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc+0x121/0x3c0 mm/slab_common.c:1020 kmalloc include/linux/slab.h:604 [inline] do_sys_name_to_handle fs/fhandle.c:39 [inline] __do_sys_name_to_handle_at fs/fhandle.c:112 [inline] __se_sys_name_to_handle_at+0x441/0xb10 fs/fhandle.c:94 __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94 ... Bytes 18-19 of 20 are uninitialized Memory access of size 20 starts at ffff888128a46380 Data copied to user address 0000000020000240" Per Chuck Lever's suggestion, use kzalloc() instead of kmalloc() to solve the problem.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security During our fuzz testing of the connection and disconnection process at the RFCOMM layer, we discovered this bug. By comparing the packets from a normal connection and disconnection process with the testcase that triggered a KASAN report. We analyzed the cause of this bug as follows: 1. In the packets captured during a normal connection, the host sends a `Read Encryption Key Size` type of `HCI_CMD` packet (Command Opcode: 0x1408) to the controller to inquire the length of encryption key.After receiving this packet, the controller immediately replies with a Command Completepacket (Event Code: 0x0e) to return the Encryption Key Size. 2. In our fuzz test case, the timing of the controller's response to this packet was delayed to an unexpected point: after the RFCOMM and L2CAP layers had disconnected but before the HCI layer had disconnected. 3. After receiving the Encryption Key Size Response at the time described in point 2, the host still called the rfcomm_check_security function. However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;` had already been released, and when the function executed `return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`, specifically when accessing `conn->hcon`, a null-ptr-deref error occurred. To fix this bug, check if `sk->sk_state` is BT_CLOSED before calling rfcomm_recv_frame in rfcomm_process_rx.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported: BUG: unable to handle page fault for address: ffffffffff600000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 3231067 P4D 3231067 PUD 3233067 PMD 3235067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 PID: 20390 Comm: test_progs ...... 6.7.0+ #58 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:copy_from_kernel_nofault+0x6f/0x110 ...... Call Trace: <TASK> ? copy_from_kernel_nofault+0x6f/0x110 bpf_probe_read_kernel+0x1d/0x50 bpf_prog_2061065e56845f08_do_probe_read+0x51/0x8d trace_call_bpf+0xc5/0x1c0 perf_call_bpf_enter.isra.0+0x69/0xb0 perf_syscall_enter+0x13e/0x200 syscall_trace_enter+0x188/0x1c0 do_syscall_64+0xb5/0xe0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ...... ---[ end trace 0000000000000000 ]--- The oops is triggered when: 1) A bpf program uses bpf_probe_read_kernel() to read from the vsyscall page and invokes copy_from_kernel_nofault() which in turn calls __get_user_asm(). 2) Because the vsyscall page address is not readable from kernel space, a page fault exception is triggered accordingly. 3) handle_page_fault() considers the vsyscall page address as a user space address instead of a kernel space address. This results in the fix-up setup by bpf not being applied and a page_fault_oops() is invoked due to SMAP. Considering handle_page_fault() has already considered the vsyscall page address as a userspace address, fix the problem by disallowing vsyscall page read for copy_from_kernel_nofault().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pmic_glink_altmode: fix drm bridge use-after-free A recent DRM series purporting to simplify support for "transparent bridges" and handling of probe deferrals ironically exposed a use-after-free issue on pmic_glink_altmode probe deferral. This has manifested itself as the display subsystem occasionally failing to initialise and NULL-pointer dereferences during boot of machines like the Lenovo ThinkPad X13s. Specifically, the dp-hpd bridge is currently registered before all resources have been acquired which means that it can also be deregistered on probe deferrals. In the meantime there is a race window where the new aux bridge driver (or PHY driver previously) may have looked up the dp-hpd bridge and stored a (non-reference-counted) pointer to the bridge which is about to be deallocated. When the display controller is later initialised, this triggers a use-after-free when attaching the bridges: dp -> aux -> dp-hpd (freed) which may, for example, result in the freed bridge failing to attach: [drm:drm_bridge_attach [drm]] *ERROR* failed to attach bridge /soc@0/phy@88eb000 to encoder TMDS-31: -16 or a NULL-pointer dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ... Call trace: drm_bridge_attach+0x70/0x1a8 [drm] drm_aux_bridge_attach+0x24/0x38 [aux_bridge] drm_bridge_attach+0x80/0x1a8 [drm] dp_bridge_init+0xa8/0x15c [msm] msm_dp_modeset_init+0x28/0xc4 [msm] The DRM bridge implementation is clearly fragile and implicitly built on the assumption that bridges may never go away. In this case, the fix is to move the bridge registration in the pmic_glink_altmode driver to after all resources have been looked up. Incidentally, with the new dp-hpd bridge implementation, which registers child devices, this is also a requirement due to a long-standing issue in driver core that can otherwise lead to a probe deferral loop (see commit fbc35b45f9f6 ("Add documentation on meaning of -EPROBE_DEFER")). [DB: slightly fixed commit message by adding the word 'commit']


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and other functions can pass skb->sk as function argument. If the skb is a fragment and reassembly happens before such function call returns, the sk must not be released. This affects skb fragments reassembled via netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as part of tx pipeline. Eric Dumazet made an initial analysis of this bug. Quoting Eric: Calling ip_defrag() in output path is also implying skb_orphan(), which is buggy because output path relies on sk not disappearing. A relevant old patch about the issue was : 8282f27449bf ("inet: frag: Always orphan skbs inside ip_defrag()") [..] net/ipv4/ip_output.c depends on skb->sk being set, and probably to an inet socket, not an arbitrary one. If we orphan the packet in ipvlan, then downstream things like FQ packet scheduler will not work properly. We need to change ip_defrag() to only use skb_orphan() when really needed, ie whenever frag_list is going to be used. Eric suggested to stash sk in fragment queue and made an initial patch. However there is a problem with this: If skb is refragmented again right after, ip_do_fragment() will copy head->sk to the new fragments, and sets up destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem accouting to reflect the fully reassembled skb, else wmem will underflow. This change moves the orphan down into the core, to last possible moment. As ip_defrag_offset is aliased with sk_buff->sk member, we must move the offset into the FRAG_CB, else skb->sk gets clobbered. This allows to delay the orphaning long enough to learn if the skb has to be queued or if the skb is completing the reasm queue. In the former case, things work as before, skb is orphaned. This is safe because skb gets queued/stolen and won't continue past reasm engine. In the latter case, we will steal the skb->sk reference, reattach it to the head skb, and fix up wmem accouting when inet_frag inflates truesize.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate the parameters of bo mapping operations more clearly Verify the parameters of amdgpu_vm_bo_(map/replace_map/clearing_mappings) in one common place.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCM_RIGHTS, two consecutive passes of scan_children() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gc_inflight_list. sockets are AF_UNIX/SOCK_STREAM S is an unconnected socket L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped connect(S, addr) sendmsg(S, [V]); close(V) __unix_gc() ---------------- ------------------------- ----------- NS = unix_create1() skb1 = sock_wmalloc(NS) L = unix_find_other(addr) unix_state_lock(L) unix_peer(S) = NS // V count=1 inflight=0 NS = unix_peer(S) skb2 = sock_alloc() skb_queue_tail(NS, skb2[V]) // V became in-flight // V count=2 inflight=1 close(V) // V count=1 inflight=1 // GC candidate condition met for u in gc_inflight_list: if (total_refs == inflight_refs) add u to gc_candidates // gc_candidates={L, V} for u in gc_candidates: scan_children(u, dec_inflight) // embryo (skb1) was not // reachable from L yet, so V's // inflight remains unchanged __skb_queue_tail(L, skb1) unix_state_unlock(L) for u in gc_candidates: if (u.inflight) scan_children(u, inc_inflight_move_tail) // V count=1 inflight=2 (!) If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCM_RIGHTS. At this point, unix_inflight() can not happen because unix_gc_lock is already taken. Inflight graph remains unaffected.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path The commit mutex should not be released during the critical section between nft_gc_seq_begin() and nft_gc_seq_end(), otherwise, async GC worker could collect expired objects and get the released commit lock within the same GC sequence. nf_tables_module_autoload() temporarily releases the mutex to load module dependencies, then it goes back to replay the transaction again. Move it at the end of the abort phase after nft_gc_seq_end() is called.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_debug_files_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd() When unregister pd capabilitie in tcpm, KASAN will capture below double -free issue. The root cause is the same capabilitiy will be kfreed twice, the first time is kfreed by pd_capabilities_release() and the second time is explicitly kfreed by tcpm_port_unregister_pd(). [ 3.988059] BUG: KASAN: double-free in tcpm_port_unregister_pd+0x1a4/0x3dc [ 3.995001] Free of addr ffff0008164d3000 by task kworker/u16:0/10 [ 4.001206] [ 4.002712] CPU: 2 PID: 10 Comm: kworker/u16:0 Not tainted 6.8.0-rc5-next-20240220-05616-g52728c567a55 #53 [ 4.012402] Hardware name: Freescale i.MX8QXP MEK (DT) [ 4.017569] Workqueue: events_unbound deferred_probe_work_func [ 4.023456] Call trace: [ 4.025920] dump_backtrace+0x94/0xec [ 4.029629] show_stack+0x18/0x24 [ 4.032974] dump_stack_lvl+0x78/0x90 [ 4.036675] print_report+0xfc/0x5c0 [ 4.040289] kasan_report_invalid_free+0xa0/0xc0 [ 4.044937] __kasan_slab_free+0x124/0x154 [ 4.049072] kfree+0xb4/0x1e8 [ 4.052069] tcpm_port_unregister_pd+0x1a4/0x3dc [ 4.056725] tcpm_register_port+0x1dd0/0x2558 [ 4.061121] tcpci_register_port+0x420/0x71c [ 4.065430] tcpci_probe+0x118/0x2e0 To fix the issue, this will remove kree() from tcpm_port_unregister_pd().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent hub device. This can cause problems if another process has locked the hub to remove it or change its configuration: Removing the hub or changing its configuration requires the hub interface to be removed, which requires the port device to be removed, and device_del() waits until all outstanding sysfs attribute callbacks for the ports have returned. The lock can't be released until then. But the disable_show() or disable_store() routine can't return until after it has acquired the lock. The resulting deadlock can be avoided by calling sysfs_break_active_protection(). This will cause the sysfs core not to wait for the attribute's callback routine to return, allowing the removal to proceed. The disadvantage is that after making this call, there is no guarantee that the hub structure won't be deallocated at any moment. To prevent this, we have to acquire a reference to it first by calling hub_get().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in usb_deauthorize_interface() Among the attribute file callback routines in drivers/usb/core/sysfs.c, the interface_authorized_store() function is the only one which acquires a device lock on an ancestor device: It calls usb_deauthorize_interface(), which locks the interface's parent USB device. The will lead to deadlock if another process already owns that lock and tries to remove the interface, whether through a configuration change or because the device has been disconnected. As part of the removal procedure, device_del() waits for all ongoing sysfs attribute callbacks to complete. But usb_deauthorize_interface() can't complete until the device lock has been released, and the lock won't be released until the removal has finished. The mechanism provided by sysfs to prevent this kind of deadlock is to use the sysfs_break_active_protection() function, which tells sysfs not to wait for the attribute callback. Reported-and-tested by: Yue Sun <samsun1006219@gmail.com> Reported by: xingwei lee <xrivendell7@gmail.com>


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") fixed a bug related to modules loading/unloading, by adding a call to scsi_proc_hostdir_rm() on scsi_remove_host(). But that led to a potential duplicate call to the hostdir_rm() routine, since it's also called from scsi_host_dev_release(). That triggered a regression report, which was then fixed by commit be03df3d4bfe ("scsi: core: Fix a procfs host directory removal regression"). The fix just dropped the hostdir_rm() call from dev_release(). But it happens that this proc directory is created on scsi_host_alloc(), and that function "pairs" with scsi_host_dev_release(), while scsi_remove_host() pairs with scsi_add_host(). In other words, it seems the reason for removing the proc directory on dev_release() was meant to cover cases in which a SCSI host structure was allocated, but the call to scsi_add_host() didn't happen. And that pattern happens to exist in some error paths, for example. Syzkaller causes that by using USB raw gadget device, error'ing on usb-storage driver, at usb_stor_probe2(). By checking that path, we can see that the BadDevice label leads to a scsi_host_put() after a SCSI host allocation, but there's no call to scsi_add_host() in such path. That leads to messages like this in dmesg (and a leak of the SCSI host proc structure): usb-storage 4-1:87.51: USB Mass Storage device detected proc_dir_entry 'scsi/usb-storage' already registered WARNING: CPU: 1 PID: 3519 at fs/proc/generic.c:377 proc_register+0x347/0x4e0 fs/proc/generic.c:376 The proper fix seems to still call scsi_proc_hostdir_rm() on dev_release(), but guard that with the state check for SHOST_CREATED; there is even a comment in scsi_host_dev_release() detailing that: such conditional is meant for cases where the SCSI host was allocated but there was no calls to {add,remove}_host(), like the usb-storage case. This is what we propose here and with that, the error path of usb-storage does not trigger the warning anymore.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Reset queue_priority_hint on parking Originally, with strict in order execution, we could complete execution only when the queue was empty. Preempt-to-busy allows replacement of an active request that may complete before the preemption is processed by HW. If that happens, the request is retired from the queue, but the queue_priority_hint remains set, preventing direct submission until after the next CS interrupt is processed. This preempt-to-busy race can be triggered by the heartbeat, which will also act as the power-management barrier and upon completion allow us to idle the HW. We may process the completion of the heartbeat, and begin parking the engine before the CS event that restores the queue_priority_hint, causing us to fail the assertion that it is MIN. <3>[ 166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 166.210781] Dumping ftrace buffer: <0>[ 166.210795] --------------------------------- ... <0>[ 167.302811] drm_fdin-1097 2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 } <0>[ 167.302861] drm_fdin-1097 2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646 <0>[ 167.302928] drm_fdin-1097 2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0 <0>[ 167.302992] drm_fdin-1097 2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659 <0>[ 167.303044] drm_fdin-1097 2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40 <0>[ 167.303095] drm_fdin-1097 2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 } <0>[ 167.303159] kworker/-89 11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2 <0>[ 167.303208] kworker/-89 11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin <0>[ 167.303272] kworker/-89 11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2 <0>[ 167.303321] kworker/-89 11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin <0>[ 167.303384] kworker/-89 11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660 <0>[ 167.303434] kworker/-89 11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns } <0>[ 167.303484] kworker/-89 11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked <0>[ 167.303534] <idle>-0 5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040 <0>[ 167.303583] kworker/-89 11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns } <0>[ 167.303756] kworker/-89 11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns } <0>[ 167.303806] kworker/-89 11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1)) <0>[ 167.303811] --------------------------------- <4>[ 167.304722] ------------[ cut here ]------------ <2>[ 167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283! <4>[ 167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI <4>[ 167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G W 6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1 <4>[ 167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 <4>[ 167.304738] Workqueue: i915-unordered retire_work_handler [i915] <4>[ 16 ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() If we have no VBT, or the VBT didn't declare the encoder in question, we won't have the 'devdata' for the encoder. Instead of oopsing just bail early. We won't be able to tell whether the port is DP++ or not, but so be it. (cherry picked from commit 26410896206342c8a80d2b027923e9ee7d33b733)


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed The driver creates /sys/kernel/debug/dri/0/mob_ttm even when the corresponding ttm_resource_manager is not allocated. This leads to a crash when trying to read from this file. Add a check to create mob_ttm, system_mob_ttm, and gmr_ttm debug file only when the corresponding ttm_resource_manager is allocated. crash> bt PID: 3133409 TASK: ffff8fe4834a5000 CPU: 3 COMMAND: "grep" #0 [ffffb954506b3b20] machine_kexec at ffffffffb2a6bec3 #1 [ffffb954506b3b78] __crash_kexec at ffffffffb2bb598a #2 [ffffb954506b3c38] crash_kexec at ffffffffb2bb68c1 #3 [ffffb954506b3c50] oops_end at ffffffffb2a2a9b1 #4 [ffffb954506b3c70] no_context at ffffffffb2a7e913 #5 [ffffb954506b3cc8] __bad_area_nosemaphore at ffffffffb2a7ec8c #6 [ffffb954506b3d10] do_page_fault at ffffffffb2a7f887 #7 [ffffb954506b3d40] page_fault at ffffffffb360116e [exception RIP: ttm_resource_manager_debug+0x11] RIP: ffffffffc04afd11 RSP: ffffb954506b3df0 RFLAGS: 00010246 RAX: ffff8fe41a6d1200 RBX: 0000000000000000 RCX: 0000000000000940 RDX: 0000000000000000 RSI: ffffffffc04b4338 RDI: 0000000000000000 RBP: ffffb954506b3e08 R8: ffff8fee3ffad000 R9: 0000000000000000 R10: ffff8fe41a76a000 R11: 0000000000000001 R12: 00000000ffffffff R13: 0000000000000001 R14: ffff8fe5bb6f3900 R15: ffff8fe41a6d1200 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #8 [ffffb954506b3e00] ttm_resource_manager_show at ffffffffc04afde7 [ttm] #9 [ffffb954506b3e30] seq_read at ffffffffb2d8f9f3 RIP: 00007f4c4eda8985 RSP: 00007ffdbba9e9f8 RFLAGS: 00000246 RAX: ffffffffffffffda RBX: 000000000037e000 RCX: 00007f4c4eda8985 RDX: 000000000037e000 RSI: 00007f4c41573000 RDI: 0000000000000003 RBP: 000000000037e000 R8: 0000000000000000 R9: 000000000037fe30 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4c41573000 R13: 0000000000000003 R14: 00007f4c41572010 R15: 0000000000000003 ORIG_RAX: 0000000000000000 CS: 0033 SS: 002b


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: handle kcalloc() allocation failure The kcalloc() in nouveau_dmem_evict_chunk() will return null if the physical memory has run out. As a result, if we dereference src_pfns, dst_pfns or dma_addrs, the null pointer dereference bugs will happen. Moreover, the GPU is going away. If the kcalloc() fails, we could not evict all pages mapping a chunk. So this patch adds a __GFP_NOFAIL flag in kcalloc(). Finally, as there is no need to have physically contiguous memory, this patch switches kcalloc() to kvcalloc() in order to avoid failing allocations.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix nr_cpus < nr_iaa case If nr_cpus < nr_iaa, the calculated cpus_per_iaa will be 0, which causes a divide-by-0 in rebalance_wq_table(). Make sure cpus_per_iaa is 1 in that case, and also in the nr_iaa == 0 case, even though cpus_per_iaa is never used if nr_iaa == 0, for paranoia.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address Read from an unsafe address with copy_from_kernel_nofault() in arch_adjust_kprobe_addr() because this function is used before checking the address is in text or not. Syzcaller bot found a bug and reported the case if user specifies inaccessible data area, arch_adjust_kprobe_addr() will cause a kernel panic. [ mingo: Clarified the comment. ]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add a dc_state NULL check in dc_state_release [How] Check wheather state is NULL before releasing it.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: Fix NULL pointer dereference when get power limit Because powerplay_table initialization is skipped under sriov case, We check and set default lower and upper OD value if powerplay_table is NULL.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: access device through ctx instead of peer The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's actually easier and faster performance-wise to instead get the device from ctx->wg. This semantically makes more sense too, since ctx->wg->peer_allowedips.seq is compared with ctx->allowedips_seq, basing them both in ctx. This also acts as a defence in depth provision against freed peers.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for dangling peer via is_dead instead of empty list If all peers are removed via wg_peer_remove_all(), rather than setting peer_list to empty, the peer is added to a temporary list with a head on the stack of wg_peer_remove_all(). If a netlink dump is resumed and the cursored peer is one that has been removed via wg_peer_remove_all(), it will iterate from that peer and then attempt to dump freed peers. Fix this by instead checking peer->is_dead, which was explictly created for this purpose. Also move up the device_update_lock lockdep assertion, since reading is_dead relies on that. It can be reproduced by a small script like: echo "Setting config..." ip link add dev wg0 type wireguard wg setconf wg0 /big-config ( while true; do echo "Showing config..." wg showconf wg0 > /dev/null done ) & sleep 4 wg setconf wg0 <(printf "[Peer]\nPublicKey=$(wg genkey)\n") Resulting in: BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20 Read of size 8 at addr ffff88811956ec70 by task wg/59 CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5 Call Trace: <TASK> dump_stack_lvl+0x47/0x70 print_address_description.constprop.0+0x2c/0x380 print_report+0xab/0x250 kasan_report+0xba/0xf0 __lock_acquire+0x182a/0x1b20 lock_acquire+0x191/0x4b0 down_read+0x80/0x440 get_peer+0x140/0xcb0 wg_get_device_dump+0x471/0x1130


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submit_bh_wbc()". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one a separate patch. The first patch alone resolves the syzbot-reported bug, but I think both fixes should be sent to stable, so I've tagged them as such. This patch (of 2): Syzbot has reported a kernel bug in submit_bh_wbc() when writing file data to a nilfs2 file system whose metadata is corrupted. There are two flaws involved in this issue. The first flaw is that when nilfs_get_block() locates a data block using btree or direct mapping, if the disk address translation routine nilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata corruption, it can be passed back to nilfs_get_block(). This causes nilfs_get_block() to misidentify an existing block as non-existent, causing both data block lookup and insertion to fail inconsistently. The second flaw is that nilfs_get_block() returns a successful status in this inconsistent state. This causes the caller __block_write_begin_int() or others to request a read even though the buffer is not mapped, resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc() failing. This fixes the first issue by changing the return value to code -EINVAL when a conversion using DAT fails with code -ENOENT, avoiding the conflicting condition that leads to the kernel bug described above. Here, code -EINVAL indicates that metadata corruption was detected during the block lookup, which will be properly handled as a file system error and converted to -EIO when passing through the nilfs2 bmap layer.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference counting on zcrypt card objects Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object which could lead to a free of the zcrypt card object while it was still in use. This is an example of the slab message: kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43 kernel: kmalloc_trace+0x3f2/0x470 kernel: zcrypt_card_alloc+0x36/0x70 [zcrypt] kernel: zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4] kernel: ap_device_probe+0x15c/0x290 kernel: really_probe+0xd2/0x468 kernel: driver_probe_device+0x40/0xf0 kernel: __device_attach_driver+0xc0/0x140 kernel: bus_for_each_drv+0x8c/0xd0 kernel: __device_attach+0x114/0x198 kernel: bus_probe_device+0xb4/0xc8 kernel: device_add+0x4d2/0x6e0 kernel: ap_scan_adapter+0x3d0/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43 kernel: kfree+0x37e/0x418 kernel: zcrypt_card_put+0x54/0x80 [zcrypt] kernel: ap_device_remove+0x4c/0xe0 kernel: device_release_driver_internal+0x1c4/0x270 kernel: bus_remove_device+0x100/0x188 kernel: device_del+0x164/0x3c0 kernel: device_unregister+0x30/0x90 kernel: ap_scan_adapter+0xc8/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: kthread+0x150/0x168 kernel: __ret_from_fork+0x3c/0x58 kernel: ret_from_fork+0xa/0x30 kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff) kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88 kernel: Redzone 00000000885a74b0: bb bb bb bb bb bb bb bb ........ kernel: Object 00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5 kkkkkkkkkkhKkkk. kernel: Redzone 00000000885a7518: bb bb bb bb bb bb bb bb ........ kernel: Padding 00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2 kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux) kernel: Call Trace: kernel: [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120 kernel: [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140 kernel: [<00000000c99d53cc>] check_object+0x334/0x3f8 kernel: [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8 kernel: [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0 kernel: [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8 kernel: [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8 kernel: [<00000000c99dc8dc>] __kmalloc+0x434/0x590 kernel: [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0 kernel: [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0 kernel: ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 17 PID: 1800359 at lib/refcount.c:28 refcount_warn_saturate+0x9c/0xe0 Workqueue: nfsiod nfs_direct_write_schedule_work [nfs] RIP: 0010:refcount_warn_saturate+0x9c/0xe0 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x9f/0x130 ? refcount_warn_saturate+0x9c/0xe0 ? report_bug+0xcc/0x150 ? handle_bug+0x3d/0x70 ? exc_invalid_op+0x16/0x40 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0x9c/0xe0 nfs_direct_write_schedule_work+0x237/0x250 [nfs] process_one_work+0x12f/0x4a0 worker_thread+0x14e/0x3b0 ? ZSTD_getCParams_internal+0x220/0x220 kthread+0xdc/0x120 ? __btf_name_valid+0xa0/0xa0 ret_from_fork+0x1f/0x30 This is because we're completing the nfs_direct_request twice in a row. The source of this is when we have our commit requests to submit, we process them and send them off, and then in the completion path for the commit requests we have if (nfs_commit_end(cinfo.mds)) nfs_direct_write_complete(dreq); However since we're submitting asynchronous requests we sometimes have one that completes before we submit the next one, so we end up calling complete on the nfs_direct_request twice. The only other place we use nfs_generic_commit_list() is in __nfs_commit_inode, which wraps this call in a nfs_commit_begin(); nfs_commit_end(); Which is a common pattern for this style of completion handling, one that is also repeated in the direct code with get_dreq()/put_dreq() calls around where we process events as well as in the completion paths. Fix this by using the same pattern for the commit requests. Before with my 200 node rocksdb stress running this warning would pop every 10ish minutes. With my patch the stress test has been running for several hours without popping.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() There was previously a theoretical window where swapoff() could run and teardown a swap_info_struct while a call to free_swap_and_cache() was running in another thread. This could cause, amongst other bad possibilities, swap_page_trans_huge_swapped() (called by free_swap_and_cache()) to access the freed memory for swap_map. This is a theoretical problem and I haven't been able to provoke it from a test case. But there has been agreement based on code review that this is possible (see link below). Fix it by using get_swap_device()/put_swap_device(), which will stall swapoff(). There was an extra check in _swap_info_get() to confirm that the swap entry was not free. This isn't present in get_swap_device() because it doesn't make sense in general due to the race between getting the reference and swapoff. So I've added an equivalent check directly in free_swap_and_cache(). Details of how to provoke one possible issue (thanks to David Hildenbrand for deriving this): --8<----- __swap_entry_free() might be the last user and result in "count == SWAP_HAS_CACHE". swapoff->try_to_unuse() will stop as soon as soon as si->inuse_pages==0. So the question is: could someone reclaim the folio and turn si->inuse_pages==0, before we completed swap_page_trans_huge_swapped(). Imagine the following: 2 MiB folio in the swapcache. Only 2 subpages are still references by swap entries. Process 1 still references subpage 0 via swap entry. Process 2 still references subpage 1 via swap entry. Process 1 quits. Calls free_swap_and_cache(). -> count == SWAP_HAS_CACHE [then, preempted in the hypervisor etc.] Process 2 quits. Calls free_swap_and_cache(). -> count == SWAP_HAS_CACHE Process 2 goes ahead, passes swap_page_trans_huge_swapped(), and calls __try_to_reclaim_swap(). __try_to_reclaim_swap()->folio_free_swap()->delete_from_swap_cache()-> put_swap_folio()->free_swap_slot()->swapcache_free_entries()-> swap_entry_free()->swap_range_free()-> ... WRITE_ONCE(si->inuse_pages, si->inuse_pages - nr_entries); What stops swapoff to succeed after process 2 reclaimed the swap cache but before process1 finished its call to swap_page_trans_huge_swapped()? --8<-----


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end of a grace period. This may lead to use-after-free in case llsec_lookup_key() is traversing the list of keys in parallel with a key deletion: refcount_t: addition on 0; use-after-free. WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0 Modules linked in: CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:refcount_warn_saturate+0x162/0x2a0 Call Trace: <TASK> llsec_lookup_key.isra.0+0x890/0x9e0 mac802154_llsec_encrypt+0x30c/0x9c0 ieee802154_subif_start_xmit+0x24/0x1e0 dev_hard_start_xmit+0x13e/0x690 sch_direct_xmit+0x2ae/0xbc0 __dev_queue_xmit+0x11dd/0x3c20 dgram_sendmsg+0x90b/0xd60 __sys_sendto+0x466/0x4c0 __x64_sys_sendto+0xe0/0x1c0 do_syscall_64+0x45/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 Also, ieee802154_llsec_key_entry structures are not freed by mac802154_llsec_key_del(): unreferenced object 0xffff8880613b6980 (size 64): comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s) hex dump (first 32 bytes): 78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de x......."....... 00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00 ................ backtrace: [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0 [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0 [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0 [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80 [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0 [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0 [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0 [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440 [<ffffffff86ff1d88>] genl_rcv+0x28/0x40 [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820 [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60 [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0 [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0 [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0 [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0 [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 Handle the proper resource release in the RCU callback function mac802154_llsec_key_del_rcu(). Note that if llsec_lookup_key() finds a key, it gets a refcount via llsec_key_get() and locally copies key id from key_entry (which is a list element). So it's safe to call llsec_key_put() and free the list entry after the RCU grace period elapses. Found by Linux Verification Center (linuxtesting.org).


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape For raid456, if reshape is still in progress, then IO across reshape position will wait for reshape to make progress. However, for dm-raid, in following cases reshape will never make progress hence IO will hang: 1) the array is read-only; 2) MD_RECOVERY_WAIT is set; 3) MD_RECOVERY_FROZEN is set; After commit c467e97f079f ("md/raid6: use valid sector values to determine if an I/O should wait on the reshape") fix the problem that IO across reshape position doesn't wait for reshape, the dm-raid test shell/lvconvert-raid-reshape.sh start to hang: [root@fedora ~]# cat /proc/979/stack [<0>] wait_woken+0x7d/0x90 [<0>] raid5_make_request+0x929/0x1d70 [raid456] [<0>] md_handle_request+0xc2/0x3b0 [md_mod] [<0>] raid_map+0x2c/0x50 [dm_raid] [<0>] __map_bio+0x251/0x380 [dm_mod] [<0>] dm_submit_bio+0x1f0/0x760 [dm_mod] [<0>] __submit_bio+0xc2/0x1c0 [<0>] submit_bio_noacct_nocheck+0x17f/0x450 [<0>] submit_bio_noacct+0x2bc/0x780 [<0>] submit_bio+0x70/0xc0 [<0>] mpage_readahead+0x169/0x1f0 [<0>] blkdev_readahead+0x18/0x30 [<0>] read_pages+0x7c/0x3b0 [<0>] page_cache_ra_unbounded+0x1ab/0x280 [<0>] force_page_cache_ra+0x9e/0x130 [<0>] page_cache_sync_ra+0x3b/0x110 [<0>] filemap_get_pages+0x143/0xa30 [<0>] filemap_read+0xdc/0x4b0 [<0>] blkdev_read_iter+0x75/0x200 [<0>] vfs_read+0x272/0x460 [<0>] ksys_read+0x7a/0x170 [<0>] __x64_sys_read+0x1c/0x30 [<0>] do_syscall_64+0xc6/0x230 [<0>] entry_SYSCALL_64_after_hwframe+0x6c/0x74 This is because reshape can't make progress. For md/raid, the problem doesn't exist because register new sync_thread doesn't rely on the IO to be done any more: 1) If array is read-only, it can switch to read-write by ioctl/sysfs; 2) md/raid never set MD_RECOVERY_WAIT; 3) If MD_RECOVERY_FROZEN is set, mddev_suspend() doesn't hold 'reconfig_mutex', hence it can be cleared and reshape can continue by sysfs api 'sync_action'. However, I'm not sure yet how to avoid the problem in dm-raid yet. This patch on the one hand make sure raid_message() can't change sync_thread() through raid_message() after presuspend(), on the other hand detect the above 3 cases before wait for IO do be done in dm_suspend(), and let dm-raid requeue those IO.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3-am62: fix module unload/reload behavior As runtime PM is enabled, the module can be runtime suspended when .remove() is called. Do a pm_runtime_get_sync() to make sure module is active before doing any register operations. Doing a pm_runtime_put_sync() should disable the refclk so no need to disable it again. Fixes the below warning at module removel. [ 39.705310] ------------[ cut here ]------------ [ 39.710004] clk:162:3 already disabled [ 39.713941] WARNING: CPU: 0 PID: 921 at drivers/clk/clk.c:1090 clk_core_disable+0xb0/0xb8 We called of_platform_populate() in .probe() so call the cleanup function of_platform_depopulate() in .remove(). Get rid of the now unnnecessary dwc3_ti_remove_core(). Without this, module re-load doesn't work properly.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Add error handling in xhci_map_urb_for_dma Currently xhci_map_urb_for_dma() creates a temporary buffer and copies the SG list to the new linear buffer. But if the kzalloc_node() fails, then the following sg_pcopy_to_buffer() can lead to crash since it tries to memcpy to NULL pointer. So return -ENOMEM if kzalloc returns null pointer.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of the file handle must be a multiple of 4 so the file handle is actually 12 bytes long and the last two bytes remain uninitialized. This is not great at we potentially leak uninitialized information with the handle to userspace. Properly initialize the full handle length.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: serial: max310x: fix NULL pointer dereference in I2C instantiation When trying to instantiate a max14830 device from userspace: echo max14830 0x60 > /sys/bus/i2c/devices/i2c-2/new_device we get the following error: Unable to handle kernel NULL pointer dereference at virtual address... ... Call trace: max310x_i2c_probe+0x48/0x170 [max310x] i2c_device_probe+0x150/0x2a0 ... Add check for validity of devtype to prevent the error, and abort probe with a meaningful error message.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix OOB in nilfs_set_de_type The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses this array, specifies the index to read from the array in the same way as "(mode & S_IFMT) >> S_SHIFT". static void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode *inode) { umode_t mode = inode->i_mode; de->file_type = nilfs_type_by_mode[(mode & S_IFMT)>>S_SHIFT]; // oob } However, when the index is determined this way, an out-of-bounds (OOB) error occurs by referring to an index that is 1 larger than the array size when the condition "mode & S_IFMT == S_IFMT" is satisfied. Therefore, a patch to resize the nilfs_type_by_mode array should be applied to prevent OOB errors.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has produced an out of bounds access in fill_meta_index(). That out of bounds access is ultimately caused because the inode has an inode number with the invalid value of zero, which was not checked. The reason this causes the out of bounds access is due to following sequence of events: 1. Fill_meta_index() is called to allocate (via empty_meta_index()) and fill a metadata index. It however suffers a data read error and aborts, invalidating the newly returned empty metadata index. It does this by setting the inode number of the index to zero, which means unused (zero is not a valid inode number). 2. When fill_meta_index() is subsequently called again on another read operation, locate_meta_index() returns the previous index because it matches the inode number of 0. Because this index has been returned it is expected to have been filled, and because it hasn't been, an out of bounds access is performed. This patch adds a sanity check which checks that the inode number is not zero when the inode is created and returns -EINVAL if it is. [phillip@squashfs.org.uk: whitespace fix] Link: https://lkml.kernel.org/r/20240409204723.446925-1-phillip@squashfs.org.uk


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bootconfig: use memblock_free_late to free xbc memory to buddy On the time to free xbc memory in xbc_exit(), memblock may has handed over memory to buddy allocator. So it doesn't make sense to free memory back to memblock. memblock_free() called by xbc_exit() even causes UAF bugs on architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86. Following KASAN logs shows this case. This patch fixes the xbc memory free problem by calling memblock_free() in early xbc init error rewind path and calling memblock_free_late() in xbc exit path to free memory to buddy allocator. [ 9.410890] ================================================================== [ 9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260 [ 9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1 [ 9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G U 6.9.0-rc3-00208-g586b5dfb51b9 #5 [ 9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023 [ 9.460789] Call Trace: [ 9.463518] <TASK> [ 9.465859] dump_stack_lvl+0x53/0x70 [ 9.469949] print_report+0xce/0x610 [ 9.473944] ? __virt_addr_valid+0xf5/0x1b0 [ 9.478619] ? memblock_isolate_range+0x12d/0x260 [ 9.483877] kasan_report+0xc6/0x100 [ 9.487870] ? memblock_isolate_range+0x12d/0x260 [ 9.493125] memblock_isolate_range+0x12d/0x260 [ 9.498187] memblock_phys_free+0xb4/0x160 [ 9.502762] ? __pfx_memblock_phys_free+0x10/0x10 [ 9.508021] ? mutex_unlock+0x7e/0xd0 [ 9.512111] ? __pfx_mutex_unlock+0x10/0x10 [ 9.516786] ? kernel_init_freeable+0x2d4/0x430 [ 9.521850] ? __pfx_kernel_init+0x10/0x10 [ 9.526426] xbc_exit+0x17/0x70 [ 9.529935] kernel_init+0x38/0x1e0 [ 9.533829] ? _raw_spin_unlock_irq+0xd/0x30 [ 9.538601] ret_from_fork+0x2c/0x50 [ 9.542596] ? __pfx_kernel_init+0x10/0x10 [ 9.547170] ret_from_fork_asm+0x1a/0x30 [ 9.551552] </TASK> [ 9.555649] The buggy address belongs to the physical page: [ 9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30 [ 9.570821] flags: 0x200000000000000(node=0|zone=2) [ 9.576271] page_type: 0xffffffff() [ 9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000 [ 9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 9.597476] page dumped because: kasan: bad access detected [ 9.605362] Memory state around the buggy address: [ 9.610714] ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.618786] ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.626857] >ffff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.634930] ^ [ 9.638534] ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.646605] ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.654675] ==================================================================


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL pointer dereference, address: 0000000000000008 PGD 8000000114e6e067 P4D 8000000114e6e067 PUD 109046067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 7 PID: 53891 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 RIP: 0010:gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] Code: c7 48 01 c8 49 89 45 58 85 d2 0f 84 95 00 00 00 41 0f b7 46 12 49 8b 7e 08 89 da 42 8d 2c f8 48 8b 47 08 41 83 c7 01 48 89 ee <48> 8b 40 08 ff d0 0f 1f 00 49 8b 7e 08 48 89 d9 48 8d 75 04 48 c1 RSP: 0000:ffffac20c5857838 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000004d8001 RCX: 0000000000000001 RDX: 00000000004d8001 RSI: 00000000000006d8 RDI: ffffa07afe332180 RBP: 00000000000006d8 R08: ffffac20c5857ad0 R09: 0000000000ffff10 R10: 0000000000000001 R11: ffffa07af27e2de0 R12: 000000000000001c R13: ffffac20c5857ad0 R14: ffffa07a96fe9040 R15: 000000000000001c FS: 00007fe395eed7c0(0000) GS:ffffa07e2c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000008 CR3: 000000011febe001 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ... ? gp100_vmm_pgt_mem+0xe3/0x180 [nouveau] ? gp100_vmm_pgt_mem+0x37/0x180 [nouveau] nvkm_vmm_iter+0x351/0xa20 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] ? __lock_acquire+0x3ed/0x2170 ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_ptes_get_map+0xc2/0x100 [nouveau] ? __pfx_nvkm_vmm_ref_ptes+0x10/0x10 [nouveau] ? __pfx_gp100_vmm_pgt_mem+0x10/0x10 [nouveau] nvkm_vmm_map_locked+0x224/0x3a0 [nouveau] Adding any sort of useful debug usually makes it go away, so I hand wrote the function in a line, and debugged the asm. Every so often pt->memory->ptrs is NULL. This ptrs ptr is set in the nv50_instobj_acquire called from nvkm_kmap. If Thread A and Thread B both get to nv50_instobj_acquire around the same time, and Thread A hits the refcount_set line, and in lockstep thread B succeeds at refcount_inc_not_zero, there is a chance the ptrs value won't have been stored since refcount_set is unordered. Force a memory barrier here, I picked smp_mb, since we want it on all CPUs and it's write followed by a read. v2: use paired smp_rmb/smp_wmb.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix memory leak in create_process failure Fix memory leak due to a leaked mmget reference on an error handling code path that is triggered when attempting to create KFD processes while a GPU reset is in progress.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_command_line are extra_command_line and command_line, rather than extra_command_line and boot_command_line. When strlen(command_line) > strlen(boot_command_line), static_command_line will overflow. This patch just recovers strlen(command_line) which was miss-consolidated with strlen(boot_command_line) in the commit f5c7310ac73e ("init/main: add checks for the return value of memblock_alloc*()")


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Fix level3 translation fault in swsusp_save() On arm64 machines, swsusp_save() faults if it attempts to access MEMBLOCK_NOMAP memory ranges. This can be reproduced in QEMU using UEFI when booting with rodata=off debug_pagealloc=off and CONFIG_KFENCE=n: Unable to handle kernel paging request at virtual address ffffff8000000000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=00000000eeb0b000 [ffffff8000000000] pgd=180000217fff9803, p4d=180000217fff9803, pud=180000217fff9803, pmd=180000217fff8803, pte=0000000000000000 Internal error: Oops: 0000000096000007 [#1] SMP Internal error: Oops: 0000000096000007 [#1] SMP Modules linked in: xt_multiport ipt_REJECT nf_reject_ipv4 xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c iptable_filter bpfilter rfkill at803x snd_hda_codec_hdmi snd_hda_intel snd_intel_dspcfg dwmac_generic stmmac_platform snd_hda_codec stmmac joydev pcs_xpcs snd_hda_core phylink ppdev lp parport ramoops reed_solomon ip_tables x_tables nls_iso8859_1 vfat multipath linear amdgpu amdxcp drm_exec gpu_sched drm_buddy hid_generic usbhid hid radeon video drm_suballoc_helper drm_ttm_helper ttm i2c_algo_bit drm_display_helper cec drm_kms_helper drm CPU: 0 PID: 3663 Comm: systemd-sleep Not tainted 6.6.2+ #76 Source Version: 4e22ed63a0a48e7a7cff9b98b7806d8d4add7dc0 Hardware name: Greatwall GW-XXXXXX-XXX/GW-XXXXXX-XXX, BIOS KunLun BIOS V4.0 01/19/2021 pstate: 600003c5 (nZCv DAIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : swsusp_save+0x280/0x538 lr : swsusp_save+0x280/0x538 sp : ffffffa034a3fa40 x29: ffffffa034a3fa40 x28: ffffff8000001000 x27: 0000000000000000 x26: ffffff8001400000 x25: ffffffc08113e248 x24: 0000000000000000 x23: 0000000000080000 x22: ffffffc08113e280 x21: 00000000000c69f2 x20: ffffff8000000000 x19: ffffffc081ae2500 x18: 0000000000000000 x17: 6666662074736420 x16: 3030303030303030 x15: 3038666666666666 x14: 0000000000000b69 x13: ffffff9f89088530 x12: 00000000ffffffea x11: 00000000ffff7fff x10: 00000000ffff7fff x9 : ffffffc08193f0d0 x8 : 00000000000bffe8 x7 : c0000000ffff7fff x6 : 0000000000000001 x5 : ffffffa0fff09dc8 x4 : 0000000000000000 x3 : 0000000000000027 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000004e Call trace: swsusp_save+0x280/0x538 swsusp_arch_suspend+0x148/0x190 hibernation_snapshot+0x240/0x39c hibernate+0xc4/0x378 state_store+0xf0/0x10c kobj_attr_store+0x14/0x24 The reason is swsusp_save() -> copy_data_pages() -> page_is_saveable() -> kernel_page_present() assuming that a page is always present when can_set_direct_map() is false (all of rodata_full, debug_pagealloc_enabled() and arm64_kfence_can_set_direct_map() false), irrespective of the MEMBLOCK_NOMAP ranges. Such MEMBLOCK_NOMAP regions should not be saved during hibernation. This problem was introduced by changes to the pfn_valid() logic in commit a7d9f306ba70 ("arm64: drop pfn_valid_within() and simplify pfn_valid()"). Similar to other architectures, drop the !can_set_direct_map() check in kernel_page_present() so that page_is_savable() skips such pages. [catalin.marinas@arm.com: rework commit message]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status Check kvm_mmu_page_ad_need_write_protect() when deciding whether to write-protect or clear D-bits on TDP MMU SPTEs, so that the TDP MMU accounts for any role-specific reasons for disabling D-bit dirty logging. Specifically, TDP MMU SPTEs must be write-protected when the TDP MMU is being used to run an L2 (i.e. L1 has disabled EPT) and PML is enabled. KVM always disables PML when running L2, even when L1 and L2 GPAs are in the some domain, so failing to write-protect TDP MMU SPTEs will cause writes made by L2 to not be reflected in the dirty log. [sean: massage shortlog and changelog, tweak ternary op formatting]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes Fix KVM_SET_MEMORY_ATTRIBUTES to not overflow lpage_info array and trigger KASAN splat, as seen in the private_mem_conversions_test selftest. When memory attributes are set on a GFN range, that range will have specific properties applied to the TDP. A huge page cannot be used when the attributes are inconsistent, so they are disabled for those the specific huge pages. For internal KVM reasons, huge pages are also not allowed to span adjacent memslots regardless of whether the backing memory could be mapped as huge. What GFNs support which huge page sizes is tracked by an array of arrays 'lpage_info' on the memslot, of 'kvm_lpage_info' structs. Each index of lpage_info contains a vmalloc allocated array of these for a specific supported page size. The kvm_lpage_info denotes whether a specific huge page (GFN and page size) on the memslot is supported. These arrays include indices for unaligned head and tail huge pages. Preventing huge pages from spanning adjacent memslot is covered by incrementing the count in head and tail kvm_lpage_info when the memslot is allocated, but disallowing huge pages for memory that has mixed attributes has to be done in a more complicated way. During the KVM_SET_MEMORY_ATTRIBUTES ioctl KVM updates lpage_info for each memslot in the range that has mismatched attributes. KVM does this a memslot at a time, and marks a special bit, KVM_LPAGE_MIXED_FLAG, in the kvm_lpage_info for any huge page. This bit is essentially a permanently elevated count. So huge pages will not be mapped for the GFN at that page size if the count is elevated in either case: a huge head or tail page unaligned to the memslot or if KVM_LPAGE_MIXED_FLAG is set because it has mixed attributes. To determine whether a huge page has consistent attributes, the KVM_SET_MEMORY_ATTRIBUTES operation checks an xarray to make sure it consistently has the incoming attribute. Since level - 1 huge pages are aligned to level huge pages, it employs an optimization. As long as the level - 1 huge pages are checked first, it can just check these and assume that if each level - 1 huge page contained within the level sized huge page is not mixed, then the level size huge page is not mixed. This optimization happens in the helper hugepage_has_attrs(). Unfortunately, although the kvm_lpage_info array representing page size 'level' will contain an entry for an unaligned tail page of size level, the array for level - 1 will not contain an entry for each GFN at page size level. The level - 1 array will only contain an index for any unaligned region covered by level - 1 huge page size, which can be a smaller region. So this causes the optimization to overflow the level - 1 kvm_lpage_info and perform a vmalloc out of bounds read. In some cases of head and tail pages where an overflow could happen, callers skip the operation completely as KVM_LPAGE_MIXED_FLAG is not required to prevent huge pages as discussed earlier. But for memslots that are smaller than the 1GB page size, it does call hugepage_has_attrs(). In this case the huge page is both the head and tail page. The issue can be observed simply by compiling the kernel with CONFIG_KASAN_VMALLOC and running the selftest "private_mem_conversions_test", which produces the output like the following: BUG: KASAN: vmalloc-out-of-bounds in hugepage_has_attrs+0x7e/0x110 Read of size 4 at addr ffffc900000a3008 by task private_mem_con/169 Call Trace: dump_stack_lvl print_report ? __virt_addr_valid ? hugepage_has_attrs ? hugepage_has_attrs kasan_report ? hugepage_has_attrs hugepage_has_attrs kvm_arch_post_set_memory_attributes kvm_vm_ioctl It is a little ambiguous whether the unaligned head page (in the bug case also the tail page) should be expected to have KVM_LPAGE_MIXED_FLAG set. It is not functionally required, as the unal ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/pmu: Disable support for adaptive PEBS Drop support for virtualizing adaptive PEBS, as KVM's implementation is architecturally broken without an obvious/easy path forward, and because exposing adaptive PEBS can leak host LBRs to the guest, i.e. can leak host kernel addresses to the guest. Bug #1 is that KVM doesn't account for the upper 32 bits of IA32_FIXED_CTR_CTRL when (re)programming fixed counters, e.g fixed_ctrl_field() drops the upper bits, reprogram_fixed_counters() stores local variables as u8s and truncates the upper bits too, etc. Bug #2 is that, because KVM _always_ sets precise_ip to a non-zero value for PEBS events, perf will _always_ generate an adaptive record, even if the guest requested a basic record. Note, KVM will also enable adaptive PEBS in individual *counter*, even if adaptive PEBS isn't exposed to the guest, but this is benign as MSR_PEBS_DATA_CFG is guaranteed to be zero, i.e. the guest will only ever see Basic records. Bug #3 is in perf. intel_pmu_disable_fixed() doesn't clear the upper bits either, i.e. leaves ICL_FIXED_0_ADAPTIVE set, and intel_pmu_enable_fixed() effectively doesn't clear ICL_FIXED_0_ADAPTIVE either. I.e. perf _always_ enables ADAPTIVE counters, regardless of what KVM requests. Bug #4 is that adaptive PEBS *might* effectively bypass event filters set by the host, as "Updated Memory Access Info Group" records information that might be disallowed by userspace via KVM_SET_PMU_EVENT_FILTER. Bug #5 is that KVM doesn't ensure LBR MSRs hold guest values (or at least zeros) when entering a vCPU with adaptive PEBS, which allows the guest to read host LBRs, i.e. host RIPs/addresses, by enabling "LBR Entries" records. Disable adaptive PEBS support as an immediate fix due to the severity of the LBR leak in particular, and because fixing all of the bugs will be non-trivial, e.g. not suitable for backporting to stable kernels. Note! This will break live migration, but trying to make KVM play nice with live migration would be quite complicated, wouldn't be guaranteed to work (i.e. KVM might still kill/confuse the guest), and it's not clear that there are any publicly available VMMs that support adaptive PEBS, let alone live migrate VMs that support adaptive PEBS, e.g. QEMU doesn't support PEBS in any capacity.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_get() fails then kn will be NULL, so the companion sysfs_unbreak_active_protection() routine won't get called (and would only cause an access violation by trying to dereference kn->parent if it was called). As a result, the reference to kobj acquired at the start of the function will never be released. Fix the leak by adding an explicit kobject_put() call when kn is NULL.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: speakup: Avoid crash on very long word In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Correct the PDO counting in pd_set Off-by-one errors happen because nr_snk_pdo and nr_src_pdo are incorrectly added one. The index of the loop is equal to the number of PDOs to be updated when leaving the loop and it doesn't need to be added one. When doing the power negotiation, TCPM relies on the "nr_snk_pdo" as the size of the local sink PDO array to match the Source capabilities of the partner port. If the off-by-one overflow occurs, a wrong RDO might be sent and unexpected power transfer might happen such as over voltage or over current (than expected). "nr_src_pdo" is used to set the Rp level when the port is in Source role. It is also the array size of the local Source capabilities when filling up the buffer which will be sent as the Source PDOs (such as in Power Negotiation). If the off-by-one overflow occurs, a wrong Rp level might be set and wrong Source PDOs will be sent to the partner port. This could potentially cause over current or port resets.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error When ncm function is working and then stop usb0 interface for link down, eth_stop() is called. At this piont, accidentally if usb transport error should happen in usb_ep_enable(), 'in_ep' and/or 'out_ep' may not be enabled. After that, ncm_disable() is called to disable for ncm unbind but gether_disconnect() is never called since 'in_ep' is not enabled. As the result, ncm object is released in ncm unbind but 'dev->port_usb' associated to 'ncm->port' is not NULL. And when ncm bind again to recover netdev, ncm object is reallocated but usb0 interface is already associated to previous released ncm object. Therefore, once usb0 interface is up and eth_start_xmit() is called, released ncm object is dereferrenced and it might cause use-after-free memory. [function unlink via configfs] usb0: eth_stop dev->port_usb=ffffff9b179c3200 --> error happens in usb_ep_enable(). NCM: ncm_disable: ncm=ffffff9b179c3200 --> no gether_disconnect() since ncm->port.in_ep->enabled is false. NCM: ncm_unbind: ncm unbind ncm=ffffff9b179c3200 NCM: ncm_free: ncm free ncm=ffffff9b179c3200 <-- released ncm [function link via configfs] NCM: ncm_alloc: ncm alloc ncm=ffffff9ac4f8a000 NCM: ncm_bind: ncm bind ncm=ffffff9ac4f8a000 NCM: ncm_set_alt: ncm=ffffff9ac4f8a000 alt=0 usb0: eth_open dev->port_usb=ffffff9b179c3200 <-- previous released ncm usb0: eth_start dev->port_usb=ffffff9b179c3200 <-- eth_start_xmit() --> dev->wrap() Unable to handle kernel paging request at virtual address dead00000000014f This patch addresses the issue by checking if 'ncm->netdev' is not NULL at ncm_disable() to call gether_disconnect() to deassociate 'dev->port_usb'. It's more reasonable to check 'ncm->netdev' to call gether_connect/disconnect rather than check 'ncm->port.in_ep->enabled' since it might not be enabled but the gether connection might be established.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference issue in DDMA completion flow.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: serial/pmac_zilog: Remove flawed mitigation for rx irq flood The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a crash anyway if you're using pmac_zilog as a serial console: ttyPZ0: pmz: rx irq flood ! BUG: spinlock recursion on CPU#0, swapper/0 That's because the pr_err() call in pmz_receive_chars() results in pmz_console_write() attempting to lock a spinlock already locked in pmz_interrupt(). With CONFIG_DEBUG_SPINLOCK=y, this produces a fatal BUG splat. The spinlock in question is the one in struct uart_port. Even when it's not fatal, the serial port rx function ceases to work. Also, the iteration limit doesn't play nicely with QEMU, as can be seen in the bug report linked below. A web search for other reports of the error message "pmz: rx irq flood" didn't produce anything. So I don't think this code is needed any more. Remove it.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: serial: mxs-auart: add spinlock around changing cts state The uart_handle_cts_change() function in serial_core expects the caller to hold uport->lock. For example, I have seen the below kernel splat, when the Bluetooth driver is loaded on an i.MX28 board. [ 85.119255] ------------[ cut here ]------------ [ 85.124413] WARNING: CPU: 0 PID: 27 at /drivers/tty/serial/serial_core.c:3453 uart_handle_cts_change+0xb4/0xec [ 85.134694] Modules linked in: hci_uart bluetooth ecdh_generic ecc wlcore_sdio configfs [ 85.143314] CPU: 0 PID: 27 Comm: kworker/u3:0 Not tainted 6.6.3-00021-gd62a2f068f92 #1 [ 85.151396] Hardware name: Freescale MXS (Device Tree) [ 85.156679] Workqueue: hci0 hci_power_on [bluetooth] (...) [ 85.191765] uart_handle_cts_change from mxs_auart_irq_handle+0x380/0x3f4 [ 85.198787] mxs_auart_irq_handle from __handle_irq_event_percpu+0x88/0x210 (...)


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix incomplete endpoint checking While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can have either bulk or interrupt type, and current version of vmk80xx_find_usb_endpoints() function does not take that fully into account. While this warning does not seem to be too harmful, at the very least it will crash systems with 'panic_on_warn' set on them. Fix the issue found by Syzkaller [1] by somewhat simplifying the endpoint checking process with usb_find_common_endpoints() and ensuring that only expected endpoint types are present. This patch has not been tested on real hardware. [1] Syzkaller report: usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 781 at drivers/usb/core/urb.c:504 usb_submit_urb+0xc4e/0x18c0 drivers/usb/core/urb.c:503 ... Call Trace: <TASK> usb_start_wait_urb+0x113/0x520 drivers/usb/core/message.c:59 vmk80xx_reset_device drivers/comedi/drivers/vmk80xx.c:227 [inline] vmk80xx_auto_attach+0xa1c/0x1a40 drivers/comedi/drivers/vmk80xx.c:818 comedi_auto_config+0x238/0x380 drivers/comedi/drivers.c:1067 usb_probe_interface+0x5cd/0xb00 drivers/usb/core/driver.c:399 ... Similar issue also found by Syzkaller:


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: Do a runtime PM get on controllers during probe mt8183-mfgcfg has a mutual dependency with genpd during the probing stage, which leads to a deadlock in the following call stack: CPU0: genpd_lock --> clk_prepare_lock genpd_power_off_work_fn() genpd_lock() generic_pm_domain::power_off() clk_unprepare() clk_prepare_lock() CPU1: clk_prepare_lock --> genpd_lock clk_register() __clk_core_init() clk_prepare_lock() clk_pm_runtime_get() genpd_lock() Do a runtime PM get at the probe function to make sure clk_register() won't acquire the genpd lock. Instead of only modifying mt8183-mfgcfg, do this on all mediatek clock controller probings because we don't believe this would cause any regression. Verified on MT8183 and MT8192 Chromebooks.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree for clk_summary Similar to the previous commit, we should make sure that all devices are runtime resumed before printing the clk_summary through debugfs. Failure to do so would result in a deadlock if the thread is resuming a device to print clk state and that device is also runtime resuming in another thread, e.g the screen is turning on and the display driver is starting up. We remove the calls to clk_pm_runtime_{get,put}() in this path because they're superfluous now that we know the devices are runtime resumed. This also squashes a bug where the return value of clk_pm_runtime_get() wasn't checked, leading to an RPM count underflow on error paths.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree during disable_unused Doug reported [1] the following hung task: INFO: task swapper/0:1 blocked for more than 122 seconds. Not tainted 5.15.149-21875-gf795ebc40eb8 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:swapper/0 state:D stack: 0 pid: 1 ppid: 0 flags:0x00000008 Call trace: __switch_to+0xf4/0x1f4 __schedule+0x418/0xb80 schedule+0x5c/0x10c rpm_resume+0xe0/0x52c rpm_resume+0x178/0x52c __pm_runtime_resume+0x58/0x98 clk_pm_runtime_get+0x30/0xb0 clk_disable_unused_subtree+0x58/0x208 clk_disable_unused_subtree+0x38/0x208 clk_disable_unused_subtree+0x38/0x208 clk_disable_unused_subtree+0x38/0x208 clk_disable_unused_subtree+0x38/0x208 clk_disable_unused+0x4c/0xe4 do_one_initcall+0xcc/0x2d8 do_initcall_level+0xa4/0x148 do_initcalls+0x5c/0x9c do_basic_setup+0x24/0x30 kernel_init_freeable+0xec/0x164 kernel_init+0x28/0x120 ret_from_fork+0x10/0x20 INFO: task kworker/u16:0:9 blocked for more than 122 seconds. Not tainted 5.15.149-21875-gf795ebc40eb8 #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u16:0 state:D stack: 0 pid: 9 ppid: 2 flags:0x00000008 Workqueue: events_unbound deferred_probe_work_func Call trace: __switch_to+0xf4/0x1f4 __schedule+0x418/0xb80 schedule+0x5c/0x10c schedule_preempt_disabled+0x2c/0x48 __mutex_lock+0x238/0x488 __mutex_lock_slowpath+0x1c/0x28 mutex_lock+0x50/0x74 clk_prepare_lock+0x7c/0x9c clk_core_prepare_lock+0x20/0x44 clk_prepare+0x24/0x30 clk_bulk_prepare+0x40/0xb0 mdss_runtime_resume+0x54/0x1c8 pm_generic_runtime_resume+0x30/0x44 __genpd_runtime_resume+0x68/0x7c genpd_runtime_resume+0x108/0x1f4 __rpm_callback+0x84/0x144 rpm_callback+0x30/0x88 rpm_resume+0x1f4/0x52c rpm_resume+0x178/0x52c __pm_runtime_resume+0x58/0x98 __device_attach+0xe0/0x170 device_initial_probe+0x1c/0x28 bus_probe_device+0x3c/0x9c device_add+0x644/0x814 mipi_dsi_device_register_full+0xe4/0x170 devm_mipi_dsi_device_register_full+0x28/0x70 ti_sn_bridge_probe+0x1dc/0x2c0 auxiliary_bus_probe+0x4c/0x94 really_probe+0xcc/0x2c8 __driver_probe_device+0xa8/0x130 driver_probe_device+0x48/0x110 __device_attach_driver+0xa4/0xcc bus_for_each_drv+0x8c/0xd8 __device_attach+0xf8/0x170 device_initial_probe+0x1c/0x28 bus_probe_device+0x3c/0x9c deferred_probe_work_func+0x9c/0xd8 process_one_work+0x148/0x518 worker_thread+0x138/0x350 kthread+0x138/0x1e0 ret_from_fork+0x10/0x20 The first thread is walking the clk tree and calling clk_pm_runtime_get() to power on devices required to read the clk hardware via struct clk_ops::is_enabled(). This thread holds the clk prepare_lock, and is trying to runtime PM resume a device, when it finds that the device is in the process of resuming so the thread schedule()s away waiting for the device to finish resuming before continuing. The second thread is runtime PM resuming the same device, but the runtime resume callback is calling clk_prepare(), trying to grab the prepare_lock waiting on the first thread. This is a classic ABBA deadlock. To properly fix the deadlock, we must never runtime PM resume or suspend a device with the clk prepare_lock held. Actually doing that is near impossible today because the global prepare_lock would have to be dropped in the middle of the tree, the device runtime PM resumed/suspended, and then the prepare_lock grabbed again to ensure consistency of the clk tree topology. If anything changes with the clk tree in the meantime, we've lost and will need to start the operation all over again. Luckily, most of the time we're simply incrementing or decrementing the runtime PM count on an active device, so we don't have the chance to schedule away with the prepare_lock held. Let's fix this immediate problem that can be ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhost_worker will call tun call backs to receive packets. If too many illegal packets arrives, tun_do_read will keep dumping packet contents. When console is enabled, it will costs much more cpu time to dump packet and soft lockup will be detected. net_ratelimit mechanism can be used to limit the dumping rate. PID: 33036 TASK: ffff949da6f20000 CPU: 23 COMMAND: "vhost-32980" #0 [fffffe00003fce50] crash_nmi_callback at ffffffff89249253 #1 [fffffe00003fce58] nmi_handle at ffffffff89225fa3 #2 [fffffe00003fceb0] default_do_nmi at ffffffff8922642e #3 [fffffe00003fced0] do_nmi at ffffffff8922660d #4 [fffffe00003fcef0] end_repeat_nmi at ffffffff89c01663 [exception RIP: io_serial_in+20] RIP: ffffffff89792594 RSP: ffffa655314979e8 RFLAGS: 00000002 RAX: ffffffff89792500 RBX: ffffffff8af428a0 RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000000005 RDI: ffffffff8af428a0 RBP: 0000000000002710 R8: 0000000000000004 R9: 000000000000000f R10: 0000000000000000 R11: ffffffff8acbf64f R12: 0000000000000020 R13: ffffffff8acbf698 R14: 0000000000000058 R15: 0000000000000000 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #5 [ffffa655314979e8] io_serial_in at ffffffff89792594 #6 [ffffa655314979e8] wait_for_xmitr at ffffffff89793470 #7 [ffffa65531497a08] serial8250_console_putchar at ffffffff897934f6 #8 [ffffa65531497a20] uart_console_write at ffffffff8978b605 #9 [ffffa65531497a48] serial8250_console_write at ffffffff89796558 #10 [ffffa65531497ac8] console_unlock at ffffffff89316124 #11 [ffffa65531497b10] vprintk_emit at ffffffff89317c07 #12 [ffffa65531497b68] printk at ffffffff89318306 #13 [ffffa65531497bc8] print_hex_dump at ffffffff89650765 #14 [ffffa65531497ca8] tun_do_read at ffffffffc0b06c27 [tun] #15 [ffffa65531497d38] tun_recvmsg at ffffffffc0b06e34 [tun] #16 [ffffa65531497d68] handle_rx at ffffffffc0c5d682 [vhost_net] #17 [ffffa65531497ed0] vhost_worker at ffffffffc0c644dc [vhost] #18 [ffffa65531497f10] kthread at ffffffff892d2e72 #19 [ffffa65531497f50] ret_from_fork at ffffffff89c0022f


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent deadlock while disabling aRFS When disabling aRFS under the `priv->state_lock`, any scheduled aRFS works are canceled using the `cancel_work_sync` function, which waits for the work to end if it has already started. However, while waiting for the work handler, the handler will try to acquire the `state_lock` which is already acquired. The worker acquires the lock to delete the rules if the state is down, which is not the worker's responsibility since disabling aRFS deletes the rules. Add an aRFS state variable, which indicates whether the aRFS is enabled and prevent adding rules when the aRFS is disabled. Kernel log: ====================================================== WARNING: possible circular locking dependency detected 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Tainted: G I ------------------------------------------------------ ethtool/386089 is trying to acquire lock: ffff88810f21ce68 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}, at: __flush_work+0x74/0x4e0 but task is already holding lock: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&priv->state_lock){+.+.}-{3:3}: __mutex_lock+0x80/0xc90 arfs_handle_work+0x4b/0x3b0 [mlx5_core] process_one_work+0x1dc/0x4a0 worker_thread+0x1bf/0x3c0 kthread+0xd7/0x100 ret_from_fork+0x2d/0x50 ret_from_fork_asm+0x11/0x20 -> #0 ((work_completion)(&rule->arfs_work)){+.+.}-{0:0}: __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 __flush_work+0x7a/0x4e0 __cancel_work_timer+0x131/0x1c0 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1a1/0x270 netlink_sendmsg+0x214/0x460 __sock_sendmsg+0x38/0x60 __sys_sendto+0x113/0x170 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x40/0xe0 entry_SYSCALL_64_after_hwframe+0x46/0x4e other info that might help us debug this: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&priv->state_lock); lock((work_completion)(&rule->arfs_work)); lock(&priv->state_lock); lock((work_completion)(&rule->arfs_work)); *** DEADLOCK *** 3 locks held by ethtool/386089: #0: ffffffff82ea7210 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 #1: ffffffff82e94c88 (rtnl_mutex){+.+.}-{3:3}, at: ethnl_default_set_doit+0xd3/0x240 #2: ffff8884a1808cc0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_ethtool_set_channels+0x53/0x200 [mlx5_core] stack backtrace: CPU: 15 PID: 386089 Comm: ethtool Tainted: G I 6.7.0-rc4_net_next_mlx5_5483eb2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x60/0xa0 check_noncircular+0x144/0x160 __lock_acquire+0x17b4/0x2c80 lock_acquire+0xd0/0x2b0 ? __flush_work+0x74/0x4e0 ? save_trace+0x3e/0x360 ? __flush_work+0x74/0x4e0 __flush_work+0x7a/0x4e0 ? __flush_work+0x74/0x4e0 ? __lock_acquire+0xa78/0x2c80 ? lock_acquire+0xd0/0x2b0 ? mark_held_locks+0x49/0x70 __cancel_work_timer+0x131/0x1c0 ? mark_held_locks+0x49/0x70 arfs_del_rules+0x143/0x1e0 [mlx5_core] mlx5e_arfs_disable+0x1b/0x30 [mlx5_core] mlx5e_ethtool_set_channels+0xcb/0x200 [mlx5_core] ethnl_set_channels+0x28f/0x3b0 ethnl_default_set_doit+0xec/0x240 genl_family_rcv_msg_doit+0xd0/0x120 genl_rcv_msg+0x188/0x2c0 ? ethn ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma is fully initialized Thorvald reported a WARNING [1]. And the root cause is below race: CPU 1 CPU 2 fork hugetlbfs_fallocate dup_mmap hugetlbfs_punch_hole i_mmap_lock_write(mapping); vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree. i_mmap_unlock_write(mapping); hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem! i_mmap_lock_write(mapping); hugetlb_vmdelete_list vma_interval_tree_foreach hugetlb_vma_trylock_write -- Vma_lock is cleared. tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem! hugetlb_vma_unlock_write -- Vma_lock is assigned!!! i_mmap_unlock_write(mapping); hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside i_mmap_rwsem lock while vma lock can be used in the same time. Fix this by deferring linking file vma until vma is fully initialized. Those vmas should be initialized first before they can be used.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpll_xa_ref_*_del() for multiple registrations Currently, if there are multiple registrations of the same pin on the same dpll device, following warnings are observed: WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:143 dpll_xa_ref_pin_del.isra.0+0x21e/0x230 WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpll_core.c:223 __dpll_pin_unregister+0x2b3/0x2c0 The problem is, that in both dpll_xa_ref_dpll_del() and dpll_xa_ref_pin_del() registration is only removed from list in case the reference count drops to zero. That is wrong, the registration has to be removed always. To fix this, remove the registration from the list and free it unconditionally, instead of doing it only when the ref reference counter reaches zero.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler The TX buffer in spi_transfer can be a NULL pointer, so the interrupt handler may end up writing to the invalid memory and cause crashes. Add a check to trans->tx_buf before using it.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix mmhub client id out-of-bounds access Properly handle cid 0x140.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Use separate handlers for interrupts For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts are raised to two CPUs at same time then two cores serve same event corrupting the data.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt The loop inside nfs_netfs_issue_read() currently does not disable interrupts while iterating through pages in the xarray to submit for NFS read. This is not safe though since after taking xa_lock, another page in the mapping could be processed for writeback inside an interrupt, and deadlock can occur. The fix is simple and clean if we use xa_for_each_range(), which handles the iteration with RCU while reducing code complexity. The problem is easily reproduced with the following test: mount -o vers=3,fsc 127.0.0.1:/export /mnt/nfs dd if=/dev/zero of=/mnt/nfs/file1.bin bs=4096 count=1 echo 3 > /proc/sys/vm/drop_caches dd if=/mnt/nfs/file1.bin of=/dev/null umount /mnt/nfs On the console with a lockdep-enabled kernel a message similar to the following will be seen: ================================ WARNING: inconsistent lock state 6.7.0-lockdbg+ #10 Not tainted -------------------------------- inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage. test5/1708 [HC0[0]:SC0[0]:HE1:SE1] takes: ffff888127baa598 (&xa->xa_lock#4){+.?.}-{3:3}, at: nfs_netfs_issue_read+0x1b2/0x4b0 [nfs] {IN-SOFTIRQ-W} state was registered at: lock_acquire+0x144/0x380 _raw_spin_lock_irqsave+0x4e/0xa0 __folio_end_writeback+0x17e/0x5c0 folio_end_writeback+0x93/0x1b0 iomap_finish_ioend+0xeb/0x6a0 blk_update_request+0x204/0x7f0 blk_mq_end_request+0x30/0x1c0 blk_complete_reqs+0x7e/0xa0 __do_softirq+0x113/0x544 __irq_exit_rcu+0xfe/0x120 irq_exit_rcu+0xe/0x20 sysvec_call_function_single+0x6f/0x90 asm_sysvec_call_function_single+0x1a/0x20 pv_native_safe_halt+0xf/0x20 default_idle+0x9/0x20 default_idle_call+0x67/0xa0 do_idle+0x2b5/0x300 cpu_startup_entry+0x34/0x40 start_secondary+0x19d/0x1c0 secondary_startup_64_no_verify+0x18f/0x19b irq event stamp: 176891 hardirqs last enabled at (176891): [<ffffffffa67a0be4>] _raw_spin_unlock_irqrestore+0x44/0x60 hardirqs last disabled at (176890): [<ffffffffa67a0899>] _raw_spin_lock_irqsave+0x79/0xa0 softirqs last enabled at (176646): [<ffffffffa515d91e>] __irq_exit_rcu+0xfe/0x120 softirqs last disabled at (176633): [<ffffffffa515d91e>] __irq_exit_rcu+0xfe/0x120 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&xa->xa_lock#4); <Interrupt> lock(&xa->xa_lock#4); *** DEADLOCK *** 2 locks held by test5/1708: #0: ffff888127baa498 (&sb->s_type->i_mutex_key#22){++++}-{4:4}, at: nfs_start_io_read+0x28/0x90 [nfs] #1: ffff888127baa650 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xa4/0x280 stack backtrace: CPU: 6 PID: 1708 Comm: test5 Kdump: loaded Not tainted 6.7.0-lockdbg+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Call Trace: dump_stack_lvl+0x5b/0x90 mark_lock+0xb3f/0xd20 __lock_acquire+0x77b/0x3360 _raw_spin_lock+0x34/0x80 nfs_netfs_issue_read+0x1b2/0x4b0 [nfs] netfs_begin_read+0x77f/0x980 [netfs] nfs_netfs_readahead+0x45/0x60 [nfs] nfs_readahead+0x323/0x5a0 [nfs] read_pages+0xf3/0x5c0 page_cache_ra_unbounded+0x1c8/0x280 filemap_get_pages+0x38c/0xae0 filemap_read+0x206/0x5e0 nfs_file_read+0xb7/0x140 [nfs] vfs_read+0x2a9/0x460 ksys_read+0xb7/0x140


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix writeback data corruption cifs writeback doesn't correctly handle the case where cifs_extend_writeback() hits a point where it is considering an additional folio, but this would overrun the wsize - at which point it drops out of the xarray scanning loop and calls xas_pause(). The problem is that xas_pause() advances the loop counter - thereby skipping that page. What needs to happen is for xas_reset() to be called any time we decide we don't want to process the page we're looking at, but rather send the request we are building and start a new one. Fix this by copying and adapting the netfslib writepages code as a temporary measure, with cifs writeback intending to be offloaded to netfslib in the near future. This also fixes the issue with the use of filemap_get_folios_tag() causing retry of a bunch of pages which the extender already dealt with. This can be tested by creating, say, a 64K file somewhere not on cifs (otherwise copy-offload may get underfoot), mounting a cifs share with a wsize of 64000, copying the file to it and then comparing the original file and the copy: dd if=/dev/urandom of=/tmp/64K bs=64k count=1 mount //192.168.6.1/test /mnt -o user=...,pass=...,wsize=64000 cp /tmp/64K /mnt/64K cmp /tmp/64K /mnt/64K Without the fix, the cmp fails at position 64000 (or shortly thereafter).


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handle acti_netdevs allocation failure The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_netdevs, the null pointer dereference bugs will happen. This patch adds a check to judge whether allocation failure occurs. If it happens, the delayed work will be rescheduled and try again.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: ensure offloading TID queue exists The resume code path assumes that the TX queue for the offloading TID has been configured. At resume time it then tries to sync the write pointer as it may have been updated by the firmware. In the unusual event that no packets have been send on TID 0, the queue will not have been allocated and this causes a crash. Fix this by ensuring the queue exist at suspend time.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend When the system is suspended while audio is active, the sof_ipc4_pcm_hw_free() is invoked to reset the pipelines since during suspend the DSP is turned off, streams will be re-started after resume. If the firmware crashes during while audio is running (or when we reset the stream before suspend) then the sof_ipc4_set_multi_pipeline_state() will fail with IPC error and the state change is interrupted. This will cause misalignment between the kernel and firmware state on next DSP boot resulting errors returned by firmware for IPC messages, eventually failing the audio resume. On stream close the errors are ignored so the kernel state will be corrected on the next DSP boot, so the second boot after the DSP panic. If sof_ipc4_trigger_pipelines() is called from sof_ipc4_pcm_hw_free() then state parameter is SOF_IPC4_PIPE_RESET and only in this case. Treat a forced pipeline reset similarly to how we treat a pcm_free by ignoring error on state sending to allow the kernel's state to be consistent with the state the firmware will have after the next boot.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. It appears the client object tree has no locking unless I've missed something else. Fix races around adding/removing client objects, mostly vram bar mappings. 4562.099306] general protection fault, probably for non-canonical address 0x6677ed422bceb80c: 0000 [#1] PREEMPT SMP PTI [ 4562.099314] CPU: 2 PID: 23171 Comm: deqp-vk Not tainted 6.8.0-rc6+ #27 [ 4562.099324] Hardware name: Gigabyte Technology Co., Ltd. Z390 I AORUS PRO WIFI/Z390 I AORUS PRO WIFI-CF, BIOS F8 11/05/2021 [ 4562.099330] RIP: 0010:nvkm_object_search+0x1d/0x70 [nouveau] [ 4562.099503] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 0f 1f 44 00 00 48 89 f8 48 85 f6 74 39 48 8b 87 a0 00 00 00 48 85 c0 74 12 <48> 8b 48 f8 48 39 ce 73 15 48 8b 40 10 48 85 c0 75 ee 48 c7 c0 fe [ 4562.099506] RSP: 0000:ffffa94cc420bbf8 EFLAGS: 00010206 [ 4562.099512] RAX: 6677ed422bceb814 RBX: ffff98108791f400 RCX: ffff9810f26b8f58 [ 4562.099517] RDX: 0000000000000000 RSI: ffff9810f26b9158 RDI: ffff98108791f400 [ 4562.099519] RBP: ffff9810f26b9158 R08: 0000000000000000 R09: 0000000000000000 [ 4562.099521] R10: ffffa94cc420bc48 R11: 0000000000000001 R12: ffff9810f02a7cc0 [ 4562.099526] R13: 0000000000000000 R14: 00000000000000ff R15: 0000000000000007 [ 4562.099528] FS: 00007f629c5017c0(0000) GS:ffff98142c700000(0000) knlGS:0000000000000000 [ 4562.099534] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4562.099536] CR2: 00007f629a882000 CR3: 000000017019e004 CR4: 00000000003706f0 [ 4562.099541] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 4562.099542] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 4562.099544] Call Trace: [ 4562.099555] <TASK> [ 4562.099573] ? die_addr+0x36/0x90 [ 4562.099583] ? exc_general_protection+0x246/0x4a0 [ 4562.099593] ? asm_exc_general_protection+0x26/0x30 [ 4562.099600] ? nvkm_object_search+0x1d/0x70 [nouveau] [ 4562.099730] nvkm_ioctl+0xa1/0x250 [nouveau] [ 4562.099861] nvif_object_map_handle+0xc8/0x180 [nouveau] [ 4562.099986] nouveau_ttm_io_mem_reserve+0x122/0x270 [nouveau] [ 4562.100156] ? dma_resv_test_signaled+0x26/0xb0 [ 4562.100163] ttm_bo_vm_fault_reserved+0x97/0x3c0 [ttm] [ 4562.100182] ? __mutex_unlock_slowpath+0x2a/0x270 [ 4562.100189] nouveau_ttm_fault+0x69/0xb0 [nouveau] [ 4562.100356] __do_fault+0x32/0x150 [ 4562.100362] do_fault+0x7c/0x560 [ 4562.100369] __handle_mm_fault+0x800/0xc10 [ 4562.100382] handle_mm_fault+0x17c/0x3e0 [ 4562.100388] do_user_addr_fault+0x208/0x860 [ 4562.100395] exc_page_fault+0x7f/0x200 [ 4562.100402] asm_exc_page_fault+0x26/0x30 [ 4562.100412] RIP: 0033:0x9b9870 [ 4562.100419] Code: 85 a8 f7 ff ff 8b 8d 80 f7 ff ff 89 08 e9 18 f2 ff ff 0f 1f 84 00 00 00 00 00 44 89 32 e9 90 fa ff ff 0f 1f 84 00 00 00 00 00 <44> 89 32 e9 f8 f1 ff ff 0f 1f 84 00 00 00 00 00 66 44 89 32 e9 e7 [ 4562.100422] RSP: 002b:00007fff9ba2dc70 EFLAGS: 00010246 [ 4562.100426] RAX: 0000000000000004 RBX: 000000000dd65e10 RCX: 000000fff0000000 [ 4562.100428] RDX: 00007f629a882000 RSI: 00007f629a882000 RDI: 0000000000000066 [ 4562.100432] RBP: 00007fff9ba2e570 R08: 0000000000000000 R09: 0000000123ddf000 [ 4562.100434] R10: 0000000000000001 R11: 0000000000000246 R12: 000000007fffffff [ 4562.100436] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 4562.100446] </TASK> [ 4562.100448] Modules linked in: nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink cmac bnep sunrpc iwlmvm intel_rapl_msr intel_rapl_common snd_sof_pci_intel_cnl x86_pkg_temp_thermal intel_powerclamp snd_sof_intel_hda_common mac80211 coretemp snd_soc_acpi_intel_match kvm_intel snd_soc_acpi snd_soc_hdac_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof_intel_hda_mlink ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: xen/evtchn: avoid WARN() when unbinding an event channel When unbinding a user event channel, the related handler might be called a last time in case the kernel was built with CONFIG_DEBUG_SHIRQ. This might cause a WARN() in the handler. Avoid that by adding an "unbinding" flag to struct user_event which will short circuit the handler.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when detecting delalloc ranges during fiemap For fiemap we recently stopped locking the target extent range for the whole duration of the fiemap call, in order to avoid a deadlock in a scenario where the fiemap buffer happens to be a memory mapped range of the same file. This use case is very unlikely to be useful in practice but it may be triggered by fuzz testing (syzbot, etc). This however introduced a race that makes us miss delalloc ranges for file regions that are currently holes, so the caller of fiemap will not be aware that there's data for some file regions. This can be quite serious for some use cases - for example in coreutils versions before 9.0, the cp program used fiemap to detect holes and data in the source file, copying only regions with data (extents or delalloc) from the source file to the destination file in order to preserve holes (see the documentation for its --sparse command line option). This means that if cp was used with a source file that had delalloc in a hole, the destination file could end up without that data, which is effectively a data loss issue, if it happened to hit the race described below. The race happens like this: 1) Fiemap is called, without the FIEMAP_FLAG_SYNC flag, for a file that has delalloc in the file range [64M, 65M[, which is currently a hole; 2) Fiemap locks the inode in shared mode, then starts iterating the inode's subvolume tree searching for file extent items, without having the whole fiemap target range locked in the inode's io tree - the change introduced recently by commit b0ad381fa769 ("btrfs: fix deadlock with fiemap and extent locking"). It only locks ranges in the io tree when it finds a hole or prealloc extent since that commit; 3) Note that fiemap clones each leaf before using it, and this is to avoid deadlocks when locking a file range in the inode's io tree and the fiemap buffer is memory mapped to some file, because writing to the page with btrfs_page_mkwrite() will wait on any ordered extent for the page's range and the ordered extent needs to lock the range and may need to modify the same leaf, therefore leading to a deadlock on the leaf; 4) While iterating the file extent items in the cloned leaf before finding the hole in the range [64M, 65M[, the delalloc in that range is flushed and its ordered extent completes - meaning the corresponding file extent item is in the inode's subvolume tree, but not present in the cloned leaf that fiemap is iterating over; 5) When fiemap finds the hole in the [64M, 65M[ range by seeing the gap in the cloned leaf (or a file extent item with disk_bytenr == 0 in case the NO_HOLES feature is not enabled), it will lock that file range in the inode's io tree and then search for delalloc by checking for the EXTENT_DELALLOC bit in the io tree for that range and ordered extents (with btrfs_find_delalloc_in_range()). But it finds nothing since the delalloc in that range was already flushed and the ordered extent completed and is gone - as a result fiemap will not report that there's delalloc or an extent for the range [64M, 65M[, so user space will be mislead into thinking that there's a hole in that range. This could actually be sporadically triggered with test case generic/094 from fstests, which reports a missing extent/delalloc range like this: generic/094 2s ... - output mismatch (see /home/fdmanana/git/hub/xfstests/results//generic/094.out.bad) --- tests/generic/094.out 2020-06-10 19:29:03.830519425 +0100 +++ /home/fdmanana/git/hub/xfstests/results//generic/094.out.bad 2024-02-28 11:00:00.381071525 +0000 @@ -1,3 +1,9 @@ QA output created by 094 fiemap run with sync fiemap run without sync +ERROR: couldn't find extent at 7 +map is 'HHDDHPPDPHPH' +logical: [ 5.. 6] phys: ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the corresponding paths.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: pstore: inode: Only d_invalidate() is needed Unloading a modular pstore backend with records in pstorefs would trigger the dput() double-drop warning: WARNING: CPU: 0 PID: 2569 at fs/dcache.c:762 dput.part.0+0x3f3/0x410 Using the combo of d_drop()/dput() (as mentioned in Documentation/filesystems/vfs.rst) isn't the right approach here, and leads to the reference counting problem seen above. Use d_invalidate() and update the code to not bother checking for error codes that can never happen. ---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Add missing skb_mark_for_recycle Notice that skb_mark_for_recycle() is introduced later than fixes tag in commit 6a5bcd84e886 ("page_pool: Allow drivers to hint on SKB recycling"). It is believed that fixes tag were missing a call to page_pool_release_page() between v5.9 to v5.14, after which is should have used skb_mark_for_recycle(). Since v6.6 the call page_pool_release_page() were removed (in commit 535b9c61bdef ("net: page_pool: hide page_pool_release_page()") and remaining callers converted (in commit 6bfef2ec0172 ("Merge branch 'net-page_pool-remove-page_pool_release_page'")). This leak became visible in v6.8 via commit dba1b8a7ab68 ("mm/page_pool: catch page_pool memory leaks").


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix Use-After-Free in ovs_ct_exit Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal of ovs_ct_limit_exit, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: gtp: Fix Use-After-Free in gtp_dellink Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal of gtp_dellink, is not part of the RCU read critical section, it is possible that the RCU grace period will pass during the traversal and the key will be free. To prevent this, it should be changed to hlist_for_each_entry_safe.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout When the sco connection is established and then, the sco socket is releasing, timeout_work will be scheduled to judge whether the sco disconnection is timeout. The sock will be deallocated later, but it is dereferenced again in sco_sock_timeout. As a result, the use-after-free bugs will happen. The root cause is shown below: Cleanup Thread | Worker Thread sco_sock_release | sco_sock_close | __sco_sock_close | sco_sock_set_timer | schedule_delayed_work | sco_sock_kill | (wait a time) sock_put(sk) //FREE | sco_sock_timeout | sock_hold(sk) //USE The KASAN report triggered by POC is shown below: [ 95.890016] ================================================================== [ 95.890496] BUG: KASAN: slab-use-after-free in sco_sock_timeout+0x5e/0x1c0 [ 95.890755] Write of size 4 at addr ffff88800c388080 by task kworker/0:0/7 ... [ 95.890755] Workqueue: events sco_sock_timeout [ 95.890755] Call Trace: [ 95.890755] <TASK> [ 95.890755] dump_stack_lvl+0x45/0x110 [ 95.890755] print_address_description+0x78/0x390 [ 95.890755] print_report+0x11b/0x250 [ 95.890755] ? __virt_addr_valid+0xbe/0xf0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_report+0x139/0x170 [ 95.890755] ? update_load_avg+0xe5/0x9f0 [ 95.890755] ? sco_sock_timeout+0x5e/0x1c0 [ 95.890755] kasan_check_range+0x2c3/0x2e0 [ 95.890755] sco_sock_timeout+0x5e/0x1c0 [ 95.890755] process_one_work+0x561/0xc50 [ 95.890755] worker_thread+0xab2/0x13c0 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] kthread+0x279/0x300 [ 95.890755] ? pr_cont_work+0x490/0x490 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork+0x34/0x60 [ 95.890755] ? kthread_blkcg+0xa0/0xa0 [ 95.890755] ret_from_fork_asm+0x11/0x20 [ 95.890755] </TASK> [ 95.890755] [ 95.890755] Allocated by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] __kasan_kmalloc+0x86/0x90 [ 95.890755] __kmalloc+0x17f/0x360 [ 95.890755] sk_prot_alloc+0xe1/0x1a0 [ 95.890755] sk_alloc+0x31/0x4e0 [ 95.890755] bt_sock_alloc+0x2b/0x2a0 [ 95.890755] sco_sock_create+0xad/0x320 [ 95.890755] bt_sock_create+0x145/0x320 [ 95.890755] __sock_create+0x2e1/0x650 [ 95.890755] __sys_socket+0xd0/0x280 [ 95.890755] __x64_sys_socket+0x75/0x80 [ 95.890755] do_syscall_64+0xc4/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] Freed by task 506: [ 95.890755] kasan_save_track+0x3f/0x70 [ 95.890755] kasan_save_free_info+0x40/0x50 [ 95.890755] poison_slab_object+0x118/0x180 [ 95.890755] __kasan_slab_free+0x12/0x30 [ 95.890755] kfree+0xb2/0x240 [ 95.890755] __sk_destruct+0x317/0x410 [ 95.890755] sco_sock_release+0x232/0x280 [ 95.890755] sock_close+0xb2/0x210 [ 95.890755] __fput+0x37f/0x770 [ 95.890755] task_work_run+0x1ae/0x210 [ 95.890755] get_signal+0xe17/0xf70 [ 95.890755] arch_do_signal_or_restart+0x3f/0x520 [ 95.890755] syscall_exit_to_user_mode+0x55/0x120 [ 95.890755] do_syscall_64+0xd1/0x1b0 [ 95.890755] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 95.890755] [ 95.890755] The buggy address belongs to the object at ffff88800c388000 [ 95.890755] which belongs to the cache kmalloc-1k of size 1024 [ 95.890755] The buggy address is located 128 bytes inside of [ 95.890755] freed 1024-byte region [ffff88800c388000, ffff88800c388400) [ 95.890755] [ 95.890755] The buggy address belongs to the physical page: [ 95.890755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800c38a800 pfn:0xc388 [ 95.890755] head: order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 95.890755] ano ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout There is a race condition between l2cap_chan_timeout() and l2cap_chan_del(). When we use l2cap_chan_del() to delete the channel, the chan->conn will be set to null. But the conn could be dereferenced again in the mutex_lock() of l2cap_chan_timeout(). As a result the null pointer dereference bug will happen. The KASAN report triggered by POC is shown below: [ 472.074580] ================================================================== [ 472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0 [ 472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7 [ 472.075308] [ 472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.075308] Workqueue: events l2cap_chan_timeout [ 472.075308] Call Trace: [ 472.075308] <TASK> [ 472.075308] dump_stack_lvl+0x137/0x1a0 [ 472.075308] print_report+0x101/0x250 [ 472.075308] ? __virt_addr_valid+0x77/0x160 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_report+0x139/0x170 [ 472.075308] ? mutex_lock+0x68/0xc0 [ 472.075308] kasan_check_range+0x2c3/0x2e0 [ 472.075308] mutex_lock+0x68/0xc0 [ 472.075308] l2cap_chan_timeout+0x181/0x300 [ 472.075308] process_one_work+0x5d2/0xe00 [ 472.075308] worker_thread+0xe1d/0x1660 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] kthread+0x2b7/0x350 [ 472.075308] ? pr_cont_work+0x5e0/0x5e0 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork+0x4d/0x80 [ 472.075308] ? kthread_blkcg+0xd0/0xd0 [ 472.075308] ret_from_fork_asm+0x11/0x20 [ 472.075308] </TASK> [ 472.075308] ================================================================== [ 472.094860] Disabling lock debugging due to kernel taint [ 472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158 [ 472.096136] #PF: supervisor write access in kernel mode [ 472.096136] #PF: error_code(0x0002) - not-present page [ 472.096136] PGD 0 P4D 0 [ 472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G B 6.9.0-rc5-00356-g78c0094a146b #36 [ 472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4 [ 472.096136] Workqueue: events l2cap_chan_timeout [ 472.096136] RIP: 0010:mutex_lock+0x88/0xc0 [ 472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88 [ 472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246 [ 472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865 [ 472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78 [ 472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f [ 472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000 [ 472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00 [ 472.096136] FS: 0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000 [ 472.096136] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0 [ 472.096136] Call Trace: [ 472.096136] <TASK> [ 472.096136] ? __die_body+0x8d/0xe0 [ 472.096136] ? page_fault_oops+0x6b8/0x9a0 [ 472.096136] ? kernelmode_fixup_or_oops+0x20c/0x2a0 [ 472.096136] ? do_user_addr_fault+0x1027/0x1340 [ 472.096136] ? _printk+0x7a/0xa0 [ 472.096136] ? mutex_lock+0x68/0xc0 [ 472.096136] ? add_taint+0x42/0xd0 [ 472.096136] ? exc_page_fault+0x6a/0x1b0 [ 472.096136] ? asm_exc_page_fault+0x26/0x30 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] ? mutex_lock+0x88/0xc0 [ 472.096136] ? mutex_lock+0x75/0xc0 [ 472.096136] l2cap_chan_timeo ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 This reverts drm/amdgpu: fix ftrace event amdgpu_bo_move always move on same heap. The basic problem here is that after the move the old location is simply not available any more. Some fixes were suggested, but essentially we should call the move notification before actually moving things because only this way we have the correct order for DMA-buf and VM move notifications as well. Also rework the statistic handling so that we don't update the eviction counter before the move. v2: add missing NULL check


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: firewire: nosy: ensure user_length is taken into account when fetching packet contents Ensure that packet_buffer_get respects the user_length provided. If the length of the head packet exceeds the user_length, packet_buffer_get will now return 0 to signify to the user that no data were read and a larger buffer size is required. Helps prevent user space overflows.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some instances, the gadget_giveback has one byte appended at the end of a proper NTB. When the NTB is parsed, unwrap call looks for any leftover bytes in SKB provided by u_ether and if there are any pending bytes, it treats them as a separate NTB and parses it. But in case the second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that were parsed properly in the first NTB and saved in rx_list are dropped. Adding a few custom traces showed the following: [002] d..1 7828.532866: dwc3_gadget_giveback: ep1out: req 000000003868811a length 1025/16384 zsI ==> 0 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10 [002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames In this case, the giveback is of 1025 bytes and block length is 1024. The rest 1 byte (which is 0x00) won't be parsed resulting in drop of all datagrams in rx_list. Same is case with packets of size 2048: [002] d..1 7828.557948: dwc3_gadget_giveback: ep1out: req 0000000011dfd96e length 2049/16384 zsI ==> 0 [002] d..1 7828.557949: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.557950: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x800 Lecroy shows one byte coming in extra confirming that the byte is coming in from PC: Transfer 2959 - Bytes Transferred(1025) Timestamp((18.524 843 590) - Transaction 8391 - Data(1025 bytes) Timestamp(18.524 843 590) --- Packet 4063861 Data(1024 bytes) Duration(2.117us) Idle(14.700ns) Timestamp(18.524 843 590) --- Packet 4063863 Data(1 byte) Duration(66.160ns) Time(282.000ns) Timestamp(18.524 845 722) According to Windows driver, no ZLP is needed if wBlockLength is non-zero, because the non-zero wBlockLength has already told the function side the size of transfer to be expected. However, there are in-market NCM devices that rely on ZLP as long as the wBlockLength is multiple of wMaxPacketSize. To deal with such devices, it pads an extra 0 at end so the transfer is no longer multiple of wMaxPacketSize.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup The Linked list element and pointer are not stored in the same memory as the eDMA controller register. If the doorbell register is toggled before the full write of the linked list a race condition error will occur. In remote setup we can only use a readl to the memory to assure the full write has occurred.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype change with mesh ID change It's currently possible to change the mesh ID when the interface isn't yet in mesh mode, at the same time as changing it into mesh mode. This leads to an overwrite of data in the wdev->u union for the interface type it currently has, causing cfg80211_change_iface() to do wrong things when switching. We could probably allow setting an interface to mesh while setting the mesh ID at the same time by doing a different order of operations here, but realistically there's no userspace that's going to do this, so just disallow changes in iftype when setting mesh ID.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: keep DMA buffers required for suspend/resume Nouveau deallocates a few buffers post GPU init which are required for GPU suspend/resume to function correctly. This is likely not as big an issue on systems where the NVGPU is the only GPU, but on multi-GPU set ups it leads to a regression where the kernel module errors and results in a system-wide rendering freeze. This commit addresses that regression by moving the two buffers required for suspend and resume to be deallocated at driver unload instead of post init.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do not free non existing IRQ The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxx_battery_i2c_probe() already has an if (client->irq) check wrapping the request_threaded_irq(). But bq27xxx_battery_i2c_remove() unconditionally calls free_irq(client->irq) leading to: [ 190.310742] ------------[ cut here ]------------ [ 190.310843] Trying to free already-free IRQ 0 [ 190.310861] WARNING: CPU: 2 PID: 1304 at kernel/irq/manage.c:1893 free_irq+0x1b8/0x310 Followed by a backtrace when unbinding the driver. Add an if (client->irq) to bq27xxx_battery_i2c_remove() mirroring probe() to fix this.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/capsule-loader.c: In function 'efi_capsule_open': drivers/firmware/efi/capsule-loader.c:295:24: error: allocation of insufficient size '4' for type 'phys_addr_t' {aka 'long long unsigned int'} with size '8' [-Werror=alloc-size] 295 | cap_info->phys = kzalloc(sizeof(void *), GFP_KERNEL); | ^ Use the correct type instead here.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST If we received HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote does support SSP since otherwise this event shouldn't be generated.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_getaddr() returns -EINVAL with an elevated "struct net" refcount.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: mctp: take ownership of skb in mctp_local_output Currently, mctp_local_output only takes ownership of skb on success, and we may leak an skb if mctp_local_output fails in specific states; the skb ownership isn't transferred until the actual output routing occurs. Instead, make mctp_local_output free the skb on all error paths up to the route action, so it always consumes the passed skb.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure being used in the xdp_buff that backs the XDP program invocation. Tobias noticed that this leads to random values being returned as the xdp_md->rx_queue_index value for XDP programs running in a cpumap. This means we're basically returning the contents of the uninitialised memory, which is bad. Fix this by zero-initialising the rxq data structure before running the XDP program.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix PPE hanging issue A patch to resolve an issue was found in MediaTek's GPL-licensed SDK: In the mtk_ppe_stop() function, the PPE scan mode is not disabled before disabling the PPE. This can potentially lead to a hang during the process of disabling the PPE. Without this patch, the PPE may experience a hang during the reboot test.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't set the MFP flag for the GTK The firmware doesn't need the MFP flag for the GTK, it can even make the firmware crash. in case the AP is configured with: group cipher TKIP and MFPC. We would send the GTK with cipher = TKIP and MFP which is of course not possible.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nvme: fix reconnection fail due to reserved tag allocation We found a issue on production environment while using NVMe over RDMA, admin_q reconnect failed forever while remote target and network is ok. After dig into it, we found it may caused by a ABBA deadlock due to tag allocation. In my case, the tag was hold by a keep alive request waiting inside admin_q, as we quiesced admin_q while reset ctrl, so the request maked as idle and will not process before reset success. As fabric_q shares tagset with admin_q, while reconnect remote target, we need a tag for connect command, but the only one reserved tag was held by keep alive command which waiting inside admin_q. As a result, we failed to reconnect admin_q forever. In order to fix this issue, I think we should keep two reserved tags for admin queue.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channels bits when all channels are found. If a usb audio device sets more bits than the amount of channels it could write outside of the map array.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock with fiemap and extent locking While working on the patchset to remove extent locking I got a lockdep splat with fiemap and pagefaulting with my new extent lock replacement lock. This deadlock exists with our normal code, we just don't have lockdep annotations with the extent locking so we've never noticed it. Since we're copying the fiemap extent to user space on every iteration we have the chance of pagefaulting. Because we hold the extent lock for the entire range we could mkwrite into a range in the file that we have mmap'ed. This would deadlock with the following stack trace [<0>] lock_extent+0x28d/0x2f0 [<0>] btrfs_page_mkwrite+0x273/0x8a0 [<0>] do_page_mkwrite+0x50/0xb0 [<0>] do_fault+0xc1/0x7b0 [<0>] __handle_mm_fault+0x2fa/0x460 [<0>] handle_mm_fault+0xa4/0x330 [<0>] do_user_addr_fault+0x1f4/0x800 [<0>] exc_page_fault+0x7c/0x1e0 [<0>] asm_exc_page_fault+0x26/0x30 [<0>] rep_movs_alternative+0x33/0x70 [<0>] _copy_to_user+0x49/0x70 [<0>] fiemap_fill_next_extent+0xc8/0x120 [<0>] emit_fiemap_extent+0x4d/0xa0 [<0>] extent_fiemap+0x7f8/0xad0 [<0>] btrfs_fiemap+0x49/0x80 [<0>] __x64_sys_ioctl+0x3e1/0xb50 [<0>] do_syscall_64+0x94/0x1a0 [<0>] entry_SYSCALL_64_after_hwframe+0x6e/0x76 I wrote an fstest to reproduce this deadlock without my replacement lock and verified that the deadlock exists with our existing locking. To fix this simply don't take the extent lock for the entire duration of the fiemap. This is safe in general because we keep track of where we are when we're searching the tree, so if an ordered extent updates in the middle of our fiemap call we'll still emit the correct extents because we know what offset we were on before. The only place we maintain the lock is searching delalloc. Since the delalloc stuff can change during writeback we want to lock the extent range so we have a consistent view of delalloc at the time we're checking to see if we need to set the delalloc flag. With this patch applied we no longer deadlock with my testcase.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix stale locked mutex in nouveau_gem_ioctl_pushbuf If VM_BIND is enabled on the client the legacy submission ioctl can't be used, however if a client tries to do so regardless it will return an error. In this case the clients mutex remained unlocked leading to a deadlock inside nouveau_drm_postclose or any other nouveau ioctl call.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix bounds check for dcn35 DcfClocks [Why] NumFclkLevelsEnabled is used for DcfClocks bounds check instead of designated NumDcfClkLevelsEnabled. That can cause array index out-of-bounds access. [How] Use designated variable for dcn35 DcfClocks bounds check.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes When moving a station out of a VLAN and deleting the VLAN afterwards, the fast_rx entry still holds a pointer to the VLAN's netdev, which can cause use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx after the VLAN change.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group The DisplayPort driver's sysfs nodes may be present to the userspace before typec_altmode_set_drvdata() completes in dp_altmode_probe. This means that a sysfs read can trigger a NULL pointer error by deferencing dp->hpd in hpd_show or dp->lock in pin_assignment_show, as dev_get_drvdata() returns NULL in those cases. Remove manual sysfs node creation in favor of adding attribute group as default for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is not used here otherwise the path to the sysfs nodes is no longer compliant with the ABI.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() Do the cache flush of converted pages in svm_register_enc_region() before dropping kvm->lock to fix use-after-free issues where region and/or its array of pages could be freed by a different task, e.g. if userspace has __unregister_enc_region_locked() already queued up for the region. Note, the "obvious" alternative of using local variables doesn't fully resolve the bug, as region->pages is also dynamically allocated. I.e. the region structure itself would be fine, but region->pages could be freed. Flushing multiple pages under kvm->lock is unfortunate, but the entire flow is a rare slow path, and the manual flush is only needed on CPUs that lack coherency for encrypted memory.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dm-raid: really frozen sync_thread during suspend 1) commit f52f5c71f3d4 ("md: fix stopping sync thread") remove MD_RECOVERY_FROZEN from __md_stop_writes() and doesn't realize that dm-raid relies on __md_stop_writes() to frozen sync_thread indirectly. Fix this problem by adding MD_RECOVERY_FROZEN in md_stop_writes(), and since stop_sync_thread() is only used for dm-raid in this case, also move stop_sync_thread() to md_stop_writes(). 2) The flag MD_RECOVERY_FROZEN doesn't mean that sync thread is frozen, it only prevent new sync_thread to start, and it can't stop the running sync thread; In order to frozen sync_thread, after seting the flag, stop_sync_thread() should be used. 3) The flag MD_RECOVERY_FROZEN doesn't mean that writes are stopped, use it as condition for md_stop_writes() in raid_postsuspend() doesn't look correct. Consider that reentrant stop_sync_thread() do nothing, always call md_stop_writes() in raid_postsuspend(). 4) raid_message can set/clear the flag MD_RECOVERY_FROZEN at anytime, and if MD_RECOVERY_FROZEN is cleared while the array is suspended, new sync_thread can start unexpected. Fix this by disallow raid_message() to change sync_thread status during suspend. Note that after commit f52f5c71f3d4 ("md: fix stopping sync thread"), the test shell/lvconvert-raid-reshape.sh start to hang in stop_sync_thread(), and with previous fixes, the test won't hang there anymore, however, the test will still fail and complain that ext4 is corrupted. And with this patch, the test won't hang due to stop_sync_thread() or fail due to ext4 is corrupted anymore. However, there is still a deadlock related to dm-raid456 that will be fixed in following patches.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix deadlock while reading mqd from debugfs An errant disk backup on my desktop got into debugfs and triggered the following deadlock scenario in the amdgpu debugfs files. The machine also hard-resets immediately after those lines are printed (although I wasn't able to reproduce that part when reading by hand): [ 1318.016074][ T1082] ====================================================== [ 1318.016607][ T1082] WARNING: possible circular locking dependency detected [ 1318.017107][ T1082] 6.8.0-rc7-00015-ge0c8221b72c0 #17 Not tainted [ 1318.017598][ T1082] ------------------------------------------------------ [ 1318.018096][ T1082] tar/1082 is trying to acquire lock: [ 1318.018585][ T1082] ffff98c44175d6a0 (&mm->mmap_lock){++++}-{3:3}, at: __might_fault+0x40/0x80 [ 1318.019084][ T1082] [ 1318.019084][ T1082] but task is already holding lock: [ 1318.020052][ T1082] ffff98c4c13f55f8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: amdgpu_debugfs_mqd_read+0x6a/0x250 [amdgpu] [ 1318.020607][ T1082] [ 1318.020607][ T1082] which lock already depends on the new lock. [ 1318.020607][ T1082] [ 1318.022081][ T1082] [ 1318.022081][ T1082] the existing dependency chain (in reverse order) is: [ 1318.023083][ T1082] [ 1318.023083][ T1082] -> #2 (reservation_ww_class_mutex){+.+.}-{3:3}: [ 1318.024114][ T1082] __ww_mutex_lock.constprop.0+0xe0/0x12f0 [ 1318.024639][ T1082] ww_mutex_lock+0x32/0x90 [ 1318.025161][ T1082] dma_resv_lockdep+0x18a/0x330 [ 1318.025683][ T1082] do_one_initcall+0x6a/0x350 [ 1318.026210][ T1082] kernel_init_freeable+0x1a3/0x310 [ 1318.026728][ T1082] kernel_init+0x15/0x1a0 [ 1318.027242][ T1082] ret_from_fork+0x2c/0x40 [ 1318.027759][ T1082] ret_from_fork_asm+0x11/0x20 [ 1318.028281][ T1082] [ 1318.028281][ T1082] -> #1 (reservation_ww_class_acquire){+.+.}-{0:0}: [ 1318.029297][ T1082] dma_resv_lockdep+0x16c/0x330 [ 1318.029790][ T1082] do_one_initcall+0x6a/0x350 [ 1318.030263][ T1082] kernel_init_freeable+0x1a3/0x310 [ 1318.030722][ T1082] kernel_init+0x15/0x1a0 [ 1318.031168][ T1082] ret_from_fork+0x2c/0x40 [ 1318.031598][ T1082] ret_from_fork_asm+0x11/0x20 [ 1318.032011][ T1082] [ 1318.032011][ T1082] -> #0 (&mm->mmap_lock){++++}-{3:3}: [ 1318.032778][ T1082] __lock_acquire+0x14bf/0x2680 [ 1318.033141][ T1082] lock_acquire+0xcd/0x2c0 [ 1318.033487][ T1082] __might_fault+0x58/0x80 [ 1318.033814][ T1082] amdgpu_debugfs_mqd_read+0x103/0x250 [amdgpu] [ 1318.034181][ T1082] full_proxy_read+0x55/0x80 [ 1318.034487][ T1082] vfs_read+0xa7/0x360 [ 1318.034788][ T1082] ksys_read+0x70/0xf0 [ 1318.035085][ T1082] do_syscall_64+0x94/0x180 [ 1318.035375][ T1082] entry_SYSCALL_64_after_hwframe+0x46/0x4e [ 1318.035664][ T1082] [ 1318.035664][ T1082] other info that might help us debug this: [ 1318.035664][ T1082] [ 1318.036487][ T1082] Chain exists of: [ 1318.036487][ T1082] &mm->mmap_lock --> reservation_ww_class_acquire --> reservation_ww_class_mutex [ 1318.036487][ T1082] [ 1318.037310][ T1082] Possible unsafe locking scenario: [ 1318.037310][ T1082] [ 1318.037838][ T1082] CPU0 CPU1 [ 1318.038101][ T1082] ---- ---- [ 1318.038350][ T1082] lock(reservation_ww_class_mutex); [ 1318.038590][ T1082] lock(reservation_ww_class_acquire); [ 1318.038839][ T1082] lock(reservation_ww_class_mutex); [ 1318.039083][ T1082] rlock(&mm->mmap_lock); [ 1318.039328][ T1082] [ 1318.039328][ T1082] *** DEADLOCK *** [ 1318.039328][ T1082] [ 1318.040029][ T1082] 1 lock held by tar/1082: [ 1318.040259][ T1082] #0: ffff98c4c13f55f8 (reservation_ww_class_mutex){+.+.}-{3:3}, at: amdgpu_debugfs_mqd_read+0x6a/0x250 [amdgpu] [ 1318.040560][ T1082] [ 1318.040560][ T1082] stack backtrace: [ ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_resource replaced by wrong function The function platform_get_resource was replaced with devm_platform_ioremap_resource_byname and is called using 0 as name. This eventually ends up in platform_get_resource_byname in the call stack, where it causes a null pointer in strcmp. if (type == resource_type(r) && !strcmp(r->name, name)) It should have been replaced with devm_platform_ioremap_resource.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Prevent crash when disable stream [Why] Disabling stream encoder invokes a function that no longer exists. [How] Check if the function declaration is NULL in disable stream encoder.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: efi: fix panic in kdump kernel Check if get_next_variable() is actually valid pointer before calling it. In kdump kernel this method is set to NULL that causes panic during the kexec-ed kernel boot. Tested with QEMU and OVMF firmware.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD Commit 672365477ae8 ("x86/fpu: Update XFD state where required") and commit 8bf26758ca96 ("x86/fpu: Add XFD state to fpstate") introduced a per CPU variable xfd_state to keep the MSR_IA32_XFD value cached, in order to avoid unnecessary writes to the MSR. On CPU hotplug MSR_IA32_XFD is reset to the init_fpstate.xfd, which wipes out any stale state. But the per CPU cached xfd value is not reset, which brings them out of sync. As a consequence a subsequent xfd_update_state() might fail to update the MSR which in turn can result in XRSTOR raising a #NM in kernel space, which crashes the kernel. To fix this, introduce xfd_set_state() to write xfd_state together with MSR_IA32_XFD, and use it in all places that set MSR_IA32_XFD.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Call mixed mode boot services on the firmware's stack Normally, the EFI stub calls into the EFI boot services using the stack that was live when the stub was entered. According to the UEFI spec, this stack needs to be at least 128k in size - this might seem large but all asynchronous processing and event handling in EFI runs from the same stack and so quite a lot of space may be used in practice. In mixed mode, the situation is a bit different: the bootloader calls the 32-bit EFI stub entry point, which calls the decompressor's 32-bit entry point, where the boot stack is set up, using a fixed allocation of 16k. This stack is still in use when the EFI stub is started in 64-bit mode, and so all calls back into the EFI firmware will be using the decompressor's limited boot stack. Due to the placement of the boot stack right after the boot heap, any stack overruns have gone unnoticed. However, commit 5c4feadb0011983b ("x86/decompressor: Move global symbol references to C code") moved the definition of the boot heap into C code, and now the boot stack is placed right at the base of BSS, where any overruns will corrupt the end of the .data section. While it would be possible to work around this by increasing the size of the boot stack, doing so would affect all x86 systems, and mixed mode systems are a tiny (and shrinking) fraction of the x86 installed base. So instead, record the firmware stack pointer value when entering from the 32-bit firmware, and switch to this stack every time a EFI boot service call is made.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Mark target gfn of emulated atomic instruction as dirty When emulating an atomic access on behalf of the guest, mark the target gfn dirty if the CMPXCHG by KVM is attempted and doesn't fault. This fixes a bug where KVM effectively corrupts guest memory during live migration by writing to guest memory without informing userspace that the page is dirty. Marking the page dirty got unintentionally dropped when KVM's emulated CMPXCHG was converted to do a user access. Before that, KVM explicitly mapped the guest page into kernel memory, and marked the page dirty during the unmap phase. Mark the page dirty even if the CMPXCHG fails, as the old data is written back on failure, i.e. the page is still written. The value written is guaranteed to be the same because the operation is atomic, but KVM's ABI is that all writes are dirty logged regardless of the value written. And more importantly, that's what KVM did before the buggy commit. Huge kudos to the folks on the Cc list (and many others), who did all the actual work of triaging and debugging. base-commit: 6769ea8da8a93ed4630f1ce64df6aafcaabfce64


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Always disable interrupts when taking cgr_lock smp_call_function_single disables IRQs when executing the callback. To prevent deadlocks, we must disable IRQs when taking cgr_lock elsewhere. This is already done by qman_update_cgr and qman_delete_cgr; fix the other lockers.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: md/dm-raid: don't call md_reap_sync_thread() directly Currently md_reap_sync_thread() is called from raid_message() directly without holding 'reconfig_mutex', this is definitely unsafe because md_reap_sync_thread() can change many fields that is protected by 'reconfig_mutex'. However, hold 'reconfig_mutex' here is still problematic because this will cause deadlock, for example, commit 130443d60b1b ("md: refactor idle/frozen_sync_thread() to fix deadlock"). Fix this problem by using stop_sync_thread() to unregister sync_thread, like md/raid did.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: PCI/PM: Drain runtime-idle callbacks before driver removal A race condition between the .runtime_idle() callback and the .remove() callback in the rtsx_pcr PCI driver leads to a kernel crash due to an unhandled page fault [1]. The problem is that rtsx_pci_runtime_idle() is not expected to be running after pm_runtime_get_sync() has been called, but the latter doesn't really guarantee that. It only guarantees that the suspend and resume callbacks will not be running when it returns. However, if a .runtime_idle() callback is already running when pm_runtime_get_sync() is called, the latter will notice that the runtime PM status of the device is RPM_ACTIVE and it will return right away without waiting for the former to complete. In fact, it cannot wait for .runtime_idle() to complete because it may be called from that callback (it arguably does not make much sense to do that, but it is not strictly prohibited). Thus in general, whoever is providing a .runtime_idle() callback needs to protect it from running in parallel with whatever code runs after pm_runtime_get_sync(). [Note that .runtime_idle() will not start after pm_runtime_get_sync() has returned, but it may continue running then if it has started earlier.] One way to address that race condition is to call pm_runtime_barrier() after pm_runtime_get_sync() (not before it, because a nonzero value of the runtime PM usage counter is necessary to prevent runtime PM callbacks from being invoked) to wait for the .runtime_idle() callback to complete should it be running at that point. A suitable place for doing that is in pci_device_remove() which calls pm_runtime_get_sync() before removing the driver, so it may as well call pm_runtime_barrier() subsequently, which will prevent the race in question from occurring, not just in the rtsx_pcr driver, but in any PCI drivers providing .runtime_idle() callbacks.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix the lifetime of the bo cursor memory The cleanup can be dispatched while the atomic update is still active, which means that the memory acquired in the atomic update needs to not be invalidated by the cleanup. The buffer objects in vmw_plane_state instead of using the builtin map_and_cache were trying to handle the lifetime of the mapped memory themselves, leading to crashes. Use the map_and_cache instead of trying to manage the lifetime of the buffer objects held by the vmw_plane_state. Fixes kernel oops'es in IGT's kms_cursor_legacy forked-bo.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts with the following invoking chain to start init a timeout worker: ->brcmf_usb_probe ->brcmf_usb_probe_cb ->brcmf_attach ->brcmf_bus_started ->brcmf_cfg80211_attach ->wl_init_priv ->brcmf_init_escan ->INIT_WORK(&cfg->escan_timeout_work, brcmf_cfg80211_escan_timeout_worker); If we disconnect the USB by hotplug, it will call brcmf_usb_disconnect to make cleanup. The invoking chain is : brcmf_usb_disconnect ->brcmf_usb_disconnect_cb ->brcmf_detach ->brcmf_cfg80211_detach ->kfree(cfg); While the timeout woker may still be running. This will cause a use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker. Fix it by deleting the timer and canceling the worker in brcmf_cfg80211_detach. [arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Avoid negative index with array access Commit 4d0c8d0aef63 ("mmc: core: Use mrq.sbc in close-ended ffu") assigns prev_idata = idatas[i - 1], but doesn't check that the iterator i is greater than zero. Let's fix this by adding a check.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: swiotlb: Fix double-allocation of slots due to broken alignment handling Commit bbb73a103fbb ("swiotlb: fix a braino in the alignment check fix"), which was a fix for commit 0eee5ae10256 ("swiotlb: fix slot alignment checks"), causes a functional regression with vsock in a virtual machine using bouncing via a restricted DMA SWIOTLB pool. When virtio allocates the virtqueues for the vsock device using dma_alloc_coherent(), the SWIOTLB search can return page-unaligned allocations if 'area->index' was left unaligned by a previous allocation from the buffer: # Final address in brackets is the SWIOTLB address returned to the caller | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1645-1649/7168 (0x98326800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1649-1653/7168 (0x98328800) | virtio-pci 0000:00:07.0: orig_addr 0x0 alloc_size 0x2000, iotlb_align_mask 0x800 stride 0x2: got slot 1653-1657/7168 (0x9832a800) This ends badly (typically buffer corruption and/or a hang) because swiotlb_alloc() is expecting a page-aligned allocation and so blindly returns a pointer to the 'struct page' corresponding to the allocation, therefore double-allocating the first half (2KiB slot) of the 4KiB page. Fix the problem by treating the allocation alignment separately to any additional alignment requirements from the device, using the maximum of the two as the stride to search the buffer slots and taking care to ensure a minimum of page-alignment for buffers larger than a page. This also resolves swiotlb allocation failures occuring due to the inclusion of ~PAGE_MASK in 'iotlb_align_mask' for large allocations and resulting in alignment requirements exceeding swiotlb_max_mapping_size().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion The first kiocb_set_cancel_fn() argument may point at a struct kiocb that is not embedded inside struct aio_kiocb. With the current code, depending on the compiler, the req->ki_ctx read happens either before the IOCB_AIO_RW test or after that test. Move the req->ki_ctx read such that it is guaranteed that the IOCB_AIO_RW test happens first.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag Otherwise after the GTT bo is released, the GTT and gart space is freed but amdgpu_ttm_backend_unbind will not clear the gart page table entry and leave valid mapping entry pointing to the stale system page. Then if GPU access the gart address mistakely, it will read undefined value instead page fault, harder to debug and reproduce the real issue.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Use raw spinlock for cgr_lock smp_call_function always runs its callback in hard IRQ context, even on PREEMPT_RT, where spinlocks can sleep. So we need to use a raw spinlock for cgr_lock to ensure we aren't waiting on a sleeping task. Although this bug has existed for a while, it was not apparent until commit ef2a8d5478b9 ("net: dpaa: Adjust queue depth on rate change") which invokes smp_call_function_single via qman_update_cgr_safe every time a link goes up or down.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ubifs: Set page uptodate in the correct place Page cache reads are lockless, so setting the freshly allocated page uptodate before we've overwritten it with the data it's supposed to have in it will allow a simultaneous reader to see old data. Move the call to SetPageUptodate into ubifs_write_end(), which is after we copied the new data into the page.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: udc: remove warning when queue disabled ep It is possible trigger below warning message from mass storage function, WARNING: CPU: 6 PID: 3839 at drivers/usb/gadget/udc/core.c:294 usb_ep_queue+0x7c/0x104 pc : usb_ep_queue+0x7c/0x104 lr : fsg_main_thread+0x494/0x1b3c Root cause is mass storage function try to queue request from main thread, but other thread may already disable ep when function disable. As there is no function failure in the driver, in order to avoid effort to fix warning, change WARN_ON_ONCE() in usb_ep_queue() to pr_debug().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: vt: fix unicode buffer corruption when deleting characters This is the same issue that was fixed for the VGA text buffer in commit 39cdb68c64d8 ("vt: fix memory overlapping when deleting chars in the buffer"). The cure is also the same i.e. replace memcpy() with memmove() due to the overlaping buffers.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume When not configured for wakeup lis3lv02d_i2c_suspend() will call lis3lv02d_poweroff() even if the device has already been turned off by the runtime-suspend handler and if configured for wakeup and the device is runtime-suspended at this point then it is not turned back on to serve as a wakeup source. Before commit b1b9f7a49440 ("misc: lis3lv02d_i2c: Add missing setting of the reg_ctrl callback"), lis3lv02d_poweroff() failed to disable the regulators which as a side effect made calling poweroff() twice ok. Now that poweroff() correctly disables the regulators, doing this twice triggers a WARN() in the regulator core: unbalanced disables for regulator-dummy WARNING: CPU: 1 PID: 92 at drivers/regulator/core.c:2999 _regulator_disable ... Fix lis3lv02d_i2c_suspend() to not call poweroff() a second time if already runtime-suspended and add a poweron() call when necessary to make wakeup work. lis3lv02d_i2c_resume() has similar issues, with an added weirness that it always powers on the device if it is runtime suspended, after which the first runtime-resume will call poweron() again, causing the enabled count for the regulator to increase by 1 every suspend/resume. These unbalanced regulator_enable() calls cause the regulator to never be turned off and trigger the following WARN() on driver unbind: WARNING: CPU: 1 PID: 1724 at drivers/regulator/core.c:2396 _regulator_put Fix this by making lis3lv02d_i2c_resume() mirror the new suspend().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Fix handling of zero block length packets While connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX set to 65536, it has been observed that we receive short packets, which come at interval of 5-10 seconds sometimes and have block length zero but still contain 1-2 valid datagrams present. According to the NCM spec: "If wBlockLength = 0x0000, the block is terminated by a short packet. In this case, the USB transfer must still be shorter than dwNtbInMaxSize or dwNtbOutMaxSize. If exactly dwNtbInMaxSize or dwNtbOutMaxSize bytes are sent, and the size is a multiple of wMaxPacketSize for the given pipe, then no ZLP shall be sent. wBlockLength= 0x0000 must be used with extreme care, because of the possibility that the host and device may get out of sync, and because of test issues. wBlockLength = 0x0000 allows the sender to reduce latency by starting to send a very large NTB, and then shortening it when the sender discovers that there's not sufficient data to justify sending a large NTB" However, there is a potential issue with the current implementation, as it checks for the occurrence of multiple NTBs in a single giveback by verifying if the leftover bytes to be processed is zero or not. If the block length reads zero, we would process the same NTB infintely because the leftover bytes is never zero and it leads to a crash. Fix this by bailing out if block length reads zero.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].cmdbuf needs to be freed. Otherwise, there will be memleaks in lbs_allocate_cmd_buffer().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/lima: fix a memleak in lima_heap_alloc When lima_vm_map_bo fails, the resources need to be deallocated, or there will be memleaks.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setup Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA This dma_alloc_coherent() is undone neither in the remove function, nor in the error handling path of fsl_qdma_probe(). Switch to the managed version to fix both issues.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: xsk: recycle buffer in case Rx queue was full Add missing xsk_buff_free() call when __xsk_rcv_zc() failed to produce descriptor to XSK Rx queue.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix a double-free in arfs_create_groups When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dpll: fix pin dump crash for rebound module When a kernel module is unbound but the pin resources were not entirely freed (other kernel module instance of the same PCI device have had kept the reference to that pin), and kernel module is again bound, the pin properties would not be updated (the properties are only assigned when memory for the pin is allocated), prop pointer still points to the kernel module memory of the kernel module which was deallocated on the unbind. If the pin dump is invoked in this state, the result is a kernel crash. Prevent the crash by storing persistent pin properties in dpll subsystem, copy the content from the kernel module when pin is allocated, instead of using memory of the kernel module.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: clear BM pool before initialization Register value persist after booting the kernel using kexec which results in kernel panic. Thus clear the BM pool registers before initialisation to fix the issue.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential sta-link leak When a station is allocated, links are added but not set to valid yet (e.g. during connection to an AP MLD), we might remove the station without ever marking links valid, and leak them. Fix that.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: tls, fix WARNIING in __sk_msg_free A splice with MSG_SPLICE_PAGES will cause tls code to use the tls_sw_sendmsg_splice path in the TLS sendmsg code to move the user provided pages from the msg into the msg_pl. This will loop over the msg until msg_pl is full, checked by sk_msg_full(msg_pl). The user can also set the MORE flag to hint stack to delay sending until receiving more pages and ideally a full buffer. If the user adds more pages to the msg than can fit in the msg_pl scatterlist (MAX_MSG_FRAGS) we should ignore the MORE flag and send the buffer anyways. What actually happens though is we abort the msg to msg_pl scatterlist setup and then because we forget to set 'full record' indicating we can no longer consume data without a send we fallthrough to the 'continue' path which will check if msg_data_left(msg) has more bytes to send and then attempts to fit them in the already full msg_pl. Then next iteration of sender doing send will encounter a full msg_pl and throw the warning in the syzbot report. To fix simply check if we have a full_record in splice code path and if not send the msg regardless of MORE flag.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: sof-common: Add NULL check for normal_link string It's not granted that all entries of struct sof_conn_stream declare a `normal_link` (a non-SOF, direct link) string, and this is the case for SoCs that support only SOF paths (hence do not support both direct and SOF usecases). For example, in the case of MT8188 there is no normal_link string in any of the sof_conn_stream entries and there will be more drivers doing that in the future. To avoid possible NULL pointer KPs, add a NULL check for `normal_link`.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Prevent double free on error The error handling path in its_vpe_irq_domain_alloc() causes a double free when its_vpe_init() fails after successfully allocating at least one interrupt. This happens because its_vpe_irq_domain_free() frees the interrupts along with the area bitmap and the vprop_page and its_vpe_irq_domain_alloc() subsequently frees the area bitmap and the vprop_page again. Fix this by unconditionally invoking its_vpe_irq_domain_free() which handles all cases correctly and by removing the bitmap/vprop_page freeing from its_vpe_irq_domain_alloc(). [ tglx: Massaged change log ]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix information leak in btrfs_ioctl_logical_to_ino() Syzbot reported the following information leak for in btrfs_ioctl_logical_to_ino(): BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x110 lib/usercopy.c:40 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _copy_to_user+0xbc/0x110 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline] btrfs_ioctl_logical_to_ino+0x440/0x750 fs/btrfs/ioctl.c:3499 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: __kmalloc_large_node+0x231/0x370 mm/slub.c:3921 __do_kmalloc_node mm/slub.c:3954 [inline] __kmalloc_node+0xb07/0x1060 mm/slub.c:3973 kmalloc_node include/linux/slab.h:648 [inline] kvmalloc_node+0xc0/0x2d0 mm/util.c:634 kvmalloc include/linux/slab.h:766 [inline] init_data_container+0x49/0x1e0 fs/btrfs/backref.c:2779 btrfs_ioctl_logical_to_ino+0x17c/0x750 fs/btrfs/ioctl.c:3480 btrfs_ioctl+0x714/0x1260 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:904 [inline] __se_sys_ioctl+0x261/0x450 fs/ioctl.c:890 __x64_sys_ioctl+0x96/0xe0 fs/ioctl.c:890 x64_sys_call+0x1883/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Bytes 40-65535 of 65536 are uninitialized Memory access of size 65536 starts at ffff888045a40000 This happens, because we're copying a 'struct btrfs_data_container' back to user-space. This btrfs_data_container is allocated in 'init_data_container()' via kvmalloc(), which does not zero-fill the memory. Fix this by using kvzalloc() which zeroes out the memory on allocation.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev setup Qualcomm ROME controllers can be registered from the Bluetooth line discipline and in this case the HCI UART serdev pointer is NULL. Add the missing sanity check to prevent a NULL-pointer dereference when setup() is called for a non-serdev controller.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NULL-deref on non-serdev suspend Qualcomm ROME controllers can be registered from the Bluetooth line discipline and in this case the HCI UART serdev pointer is NULL. Add the missing sanity check to prevent a NULL-pointer dereference when wakeup() is called for a non-serdev controller during suspend. Just return true for now to restore the original behaviour and address the crash with pre-6.2 kernels, which do not have commit e9b3e5b8c657 ("Bluetooth: hci_qca: only assign wakeup with serial port support") that causes the crash to happen already at setup() time.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work The rehash delayed work is rescheduled with a delay if the number of credits at end of the work is not negative as supposedly it means that the migration ended. Otherwise, it is rescheduled immediately. After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash" the above is no longer accurate as a non-negative number of credits is no longer indicative of the migration being done. It can also happen if the work encountered an error in which case the migration will resume the next time the work is scheduled. The significance of the above is that it is possible for the work to be pending and associated with hints that were allocated when the migration started. This leads to the hints being leaked [1] when the work is canceled while pending as part of ACL region dismantle. Fix by freeing the hints if hints are associated with a work that was canceled while pending. Blame the original commit since the reliance on not having a pending work associated with hints is fragile. [1] unreferenced object 0xffff88810e7c3000 (size 256): comm "kworker/0:16", pid 176, jiffies 4295460353 hex dump (first 32 bytes): 00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a....... 00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@........... backtrace (crc 2544ddb9): [<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0 [<000000004d9a1ad9>] objagg_hints_get+0x42/0x390 [<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400 [<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160 [<00000000e81fd734>] process_one_work+0x59c/0xf20 [<00000000ceee9e81>] worker_thread+0x799/0x12c0 [<00000000bda6fe39>] kthread+0x246/0x300 [<0000000070056d23>] ret_from_fork+0x34/0x70 [<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash The rehash delayed work migrates filters from one region to another according to the number of available credits. The migrated from region is destroyed at the end of the work if the number of credits is non-negative as the assumption is that this is indicative of migration being complete. This assumption is incorrect as a non-negative number of credits can also be the result of a failed migration. The destruction of a region that still has filters referencing it can result in a use-after-free [1]. Fix by not destroying the region if migration failed. [1] BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858 CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work Call Trace: <TASK> dump_stack_lvl+0xc6/0x120 print_report+0xce/0x670 kasan_report+0xd7/0x110 mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 mlxsw_sp_acl_atcam_entry_del+0x81/0x210 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 174: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc+0x19c/0x360 mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30 Freed by task 7: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 poison_slab_object+0x102/0x170 __kasan_slab_free+0x14/0x30 kfree+0xc1/0x290 mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 process_one_work+0x8eb/0x19b0 worker_thread+0x6c9/0xf70 kthread+0x2c9/0x3b0 ret_from_fork+0x4d/0x80 ret_from_fork_asm+0x1a/0x30


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf: support deferring bpf_link dealloc to after RCU grace period BPF link for some program types is passed as a "context" which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and multi-uprobes, link is used to fetch BPF cookie values. Because of this runtime dependency, when bpf_link refcnt drops to zero there could still be active BPF programs running accessing link data. This patch adds generic support to defer bpf_link dealloc callback to after RCU GP, if requested. This is done by exposing two different deallocation callbacks, one synchronous and one deferred. If deferred one is provided, bpf_link_free() will schedule dealloc_deferred() callback to happen after RCU GP. BPF is using two flavors of RCU: "classic" non-sleepable one and RCU tasks trace one. The latter is used when sleepable BPF programs are used. bpf_link_free() accommodates that by checking underlying BPF program's sleepable flag, and goes either through normal RCU GP only for non-sleepable, or through RCU tasks trace GP *and* then normal RCU GP (taking into account rcu_trace_implies_rcu_gp() optimization), if BPF program is sleepable. We use this for multi-kprobe and multi-uprobe links, which dereference link during program run. We also preventively switch raw_tp link to use deferred dealloc callback, as upcoming changes in bpf-next tree expose raw_tp link data (specifically, cookie value) to BPF program at runtime as well.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_network_name_deleted() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_lease_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_oplock_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_dump_full_key() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_stats_proc_write() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: guarantee refcounted children from parent session Avoid potential use-after-free bugs when walking DFS referrals, mounting and performing DFS failover by ensuring that all children from parent @tcon->ses are also refcounted. They're all needed across the entire DFS mount. Get rid of @tcon->dfs_ses_list while we're at it, too.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in smb2_reconnect_server() The UAF bug is due to smb2_reconnect_server() accessing a session that is already being teared down by another thread that is executing __cifs_put_smb_ses(). This can happen when (a) the client has connection to the server but no session or (b) another thread ends up setting @ses->ses_status again to something different than SES_EXITING. To fix this, we need to make sure to unconditionally set @ses->ses_status to SES_EXITING and prevent any other threads from setting a new status while we're still tearing it down. The following can be reproduced by adding some delay to right after the ipc is freed in __cifs_put_smb_ses() - which will give smb2_reconnect_server() worker a chance to run and then accessing @ses->ipc: kinit ... mount.cifs //srv/share /mnt/1 -o sec=krb5,nohandlecache,echo_interval=10 [disconnect srv] ls /mnt/1 &>/dev/null sleep 30 kdestroy [reconnect srv] sleep 10 umount /mnt/1 ... CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 CIFS: VFS: Verify user has a krb5 ticket and keyutils is installed CIFS: VFS: \\srv Send error in SessSetup = -126 general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 50 Comm: kworker/3:1 Not tainted 6.9.0-rc2 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-1.fc39 04/01/2014 Workqueue: cifsiod smb2_reconnect_server [cifs] RIP: 0010:__list_del_entry_valid_or_report+0x33/0xf0 Code: 4f 08 48 85 d2 74 42 48 85 c9 74 59 48 b8 00 01 00 00 00 00 ad de 48 39 c2 74 61 48 b8 22 01 00 00 00 00 74 69 <48> 8b 01 48 39 f8 75 7b 48 8b 72 08 48 39 c6 0f 85 88 00 00 00 b8 RSP: 0018:ffffc900001bfd70 EFLAGS: 00010a83 RAX: dead000000000122 RBX: ffff88810da53838 RCX: 6b6b6b6b6b6b6b6b RDX: 6b6b6b6b6b6b6b6b RSI: ffffffffc02f6878 RDI: ffff88810da53800 RBP: ffff88810da53800 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88810c064000 R13: 0000000000000001 R14: ffff88810c064000 R15: ffff8881039cc000 FS: 0000000000000000(0000) GS:ffff888157c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe3728b1000 CR3: 000000010caa4000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? die_addr+0x36/0x90 ? exc_general_protection+0x1c1/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? __list_del_entry_valid_or_report+0x33/0xf0 __cifs_put_smb_ses+0x1ae/0x500 [cifs] smb2_reconnect_server+0x4ed/0x710 [cifs] process_one_work+0x205/0x6b0 worker_thread+0x191/0x360 ? __pfx_worker_thread+0x10/0x10 kthread+0xe2/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mm/secretmem: fix GUP-fast succeeding on secretmem folios folio_is_secretmem() currently relies on secretmem folios being LRU folios, to save some cycles. However, folios might reside in a folio batch without the LRU flag set, or temporarily have their LRU flag cleared. Consequently, the LRU flag is unreliable for this purpose. In particular, this is the case when secretmem_fault() allocates a fresh page and calls filemap_add_folio()->folio_add_lru(). The folio might be added to the per-cpu folio batch and won't get the LRU flag set until the batch was drained using e.g., lru_add_drain(). Consequently, folio_is_secretmem() might not detect secretmem folios and GUP-fast can succeed in grabbing a secretmem folio, crashing the kernel when we would later try reading/writing to the folio, because the folio has been unmapped from the directmap. Fix it by removing that unreliable check.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: x86/coco: Require seeding RNG with RDRAND on CoCo systems There are few uses of CoCo that don't rely on working cryptography and hence a working RNG. Unfortunately, the CoCo threat model means that the VM host cannot be trusted and may actively work against guests to extract secrets or manipulate computation. Since a malicious host can modify or observe nearly all inputs to guests, the only remaining source of entropy for CoCo guests is RDRAND. If RDRAND is broken -- due to CPU hardware fault -- the RNG as a whole is meant to gracefully continue on gathering entropy from other sources, but since there aren't other sources on CoCo, this is catastrophic. This is mostly a concern at boot time when initially seeding the RNG, as after that the consequences of a broken RDRAND are much more theoretical. So, try at boot to seed the RNG using 256 bits of RDRAND output. If this fails, panic(). This will also trigger if the system is booted without RDRAND, as RDRAND is essential for a safe CoCo boot. Add this deliberately to be "just a CoCo x86 driver feature" and not part of the RNG itself. Many device drivers and platforms have some desire to contribute something to the RNG, and add_device_randomness() is specifically meant for this purpose. Any driver can call it with seed data of any quality, or even garbage quality, and it can only possibly make the quality of the RNG better or have no effect, but can never make it worse. Rather than trying to build something into the core of the RNG, consider the particular CoCo issue just a CoCo issue, and therefore separate it all out into driver (well, arch/platform) code. [ bp: Massage commit message. ]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: fix VM_PAT handling in COW mappings PAT handling won't do the right thing in COW mappings: the first PTE (or, in fact, all PTEs) can be replaced during write faults to point at anon folios. Reliably recovering the correct PFN and cachemode using follow_phys() from PTEs will not work in COW mappings. Using follow_phys(), we might just get the address+protection of the anon folio (which is very wrong), or fail on swap/nonswap entries, failing follow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and track_pfn_copy(), not properly calling free_pfn_range(). In free_pfn_range(), we either wouldn't call memtype_free() or would call it with the wrong range, possibly leaking memory. To fix that, let's update follow_phys() to refuse returning anon folios, and fallback to using the stored PFN inside vma->vm_pgoff for COW mappings if we run into that. We will now properly handle untrack_pfn() with COW mappings, where we don't need the cachemode. We'll have to fail fork()->track_pfn_copy() if the first page was replaced by an anon folio, though: we'd have to store the cachemode in the VMA to make this work, likely growing the VMA size. For now, lets keep it simple and let track_pfn_copy() just fail in that case: it would have failed in the past with swap/nonswap entries already, and it would have done the wrong thing with anon folios. Simple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn(): <--- C reproducer ---> #include <stdio.h> #include <sys/mman.h> #include <unistd.h> #include <liburing.h> int main(void) { struct io_uring_params p = {}; int ring_fd; size_t size; char *map; ring_fd = io_uring_setup(1, &p); if (ring_fd < 0) { perror("io_uring_setup"); return 1; } size = p.sq_off.array + p.sq_entries * sizeof(unsigned); /* Map the submission queue ring MAP_PRIVATE */ map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE, ring_fd, IORING_OFF_SQ_RING); if (map == MAP_FAILED) { perror("mmap"); return 1; } /* We have at least one page. Let's COW it. */ *map = 0; pause(); return 0; } <--- C reproducer ---> On a system with 16 GiB RAM and swap configured: # ./iouring & # memhog 16G # killall iouring [ 301.552930] ------------[ cut here ]------------ [ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100 [ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g [ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1 [ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4 [ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100 [ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000 [ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282 [ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047 [ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200 [ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000 [ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000 [ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000 [ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000 [ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0 [ 301.565725] PKRU: 55555554 [ 301.565944] Call Trace: [ 301.566148] <TASK> [ 301.566325] ? untrack_pfn+0xf4/0x100 [ 301.566618] ? __warn+0x81/0x130 [ 301.566876] ? untrack_pfn+0xf4/0x100 [ 3 ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: of: module: prevent NULL pointer dereference in vsnprintf() In of_modalias(), we can get passed the str and len parameters which would cause a kernel oops in vsnprintf() since it only allows passing a NULL ptr when the length is also 0. Also, we need to filter out the negative values of the len parameter as these will result in a really huge buffer since snprintf() takes size_t parameter while ours is ssize_t... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals In the following sequence: 1) of_platform_depopulate() 2) of_overlay_remove() During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF nodes are destroyed but __of_changeset_entry_destroy() can raise warnings related to missing of_node_put(): ERROR: memory leak, expected refcount 1 instead of 2 ... Indeed, during the devlink removals performed at step 1, the removal itself releasing the device (and the attached of_node) is done by a job queued in a workqueue and so, it is done asynchronously with respect to function calls. When the warning is present, of_node_put() will be called but wrongly too late from the workqueue job. In order to be sure that any ongoing devlink removals are done before the of_node destruction, synchronize the of_changeset_destroy() with the devlink removals.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: spi: mchp-pci1xxx: Fix a possible null pointer dereference in pci1xxx_spi_probe In function pci1xxxx_spi_probe, there is a potential null pointer that may be caused by a failed memory allocation by the function devm_kzalloc. Hence, a null pointer check needs to be added to prevent null pointer dereferencing later in the code. To fix this issue, spi_bus->spi_int[iter] should be checked. The memory allocated by devm_kzalloc will be automatically released, so just directly return -ENOMEM without worrying about memory leaks.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: stop interface during shutdown The mlxbf_gige driver intermittantly encounters a NULL pointer exception while the system is shutting down via "reboot" command. The mlxbf_driver will experience an exception right after executing its shutdown() method. One example of this exception is: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000070 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000011d373000 [0000000000000070] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] SMP CPU: 0 PID: 13 Comm: ksoftirqd/0 Tainted: G S OE 5.15.0-bf.6.gef6992a #1 Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS 4.0.2.12669 Apr 21 2023 pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : mlxbf_gige_handle_tx_complete+0xc8/0x170 [mlxbf_gige] lr : mlxbf_gige_poll+0x54/0x160 [mlxbf_gige] sp : ffff8000080d3c10 x29: ffff8000080d3c10 x28: ffffcce72cbb7000 x27: ffff8000080d3d58 x26: ffff0000814e7340 x25: ffff331cd1a05000 x24: ffffcce72c4ea008 x23: ffff0000814e4b40 x22: ffff0000814e4d10 x21: ffff0000814e4128 x20: 0000000000000000 x19: ffff0000814e4a80 x18: ffffffffffffffff x17: 000000000000001c x16: ffffcce72b4553f4 x15: ffff80008805b8a7 x14: 0000000000000000 x13: 0000000000000030 x12: 0101010101010101 x11: 7f7f7f7f7f7f7f7f x10: c2ac898b17576267 x9 : ffffcce720fa5404 x8 : ffff000080812138 x7 : 0000000000002e9a x6 : 0000000000000080 x5 : ffff00008de3b000 x4 : 0000000000000000 x3 : 0000000000000001 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: mlxbf_gige_handle_tx_complete+0xc8/0x170 [mlxbf_gige] mlxbf_gige_poll+0x54/0x160 [mlxbf_gige] __napi_poll+0x40/0x1c8 net_rx_action+0x314/0x3a0 __do_softirq+0x128/0x334 run_ksoftirqd+0x54/0x6c smpboot_thread_fn+0x14c/0x190 kthread+0x10c/0x110 ret_from_fork+0x10/0x20 Code: 8b070000 f9000ea0 f95056c0 f86178a1 (b9407002) ---[ end trace 7cc3941aa0d8e6a4 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt Kernel Offset: 0x4ce722520000 from 0xffff800008000000 PHYS_OFFSET: 0x80000000 CPU features: 0x000005c1,a3330e5a Memory Limit: none ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- During system shutdown, the mlxbf_gige driver's shutdown() is always executed. However, the driver's stop() method will only execute if networking interface configuration logic within the Linux distribution has been setup to do so. If shutdown() executes but stop() does not execute, NAPI remains enabled and this can lead to an exception if NAPI is scheduled while the hardware interface has only been partially deinitialized. The networking interface managed by the mlxbf_gige driver must be properly stopped during system shutdown so that IFF_UP is cleared, the hardware interface is put into a clean state, and NAPI is fully deinitialized.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25_ds_del_timer When the ax25 device is detaching, the ax25_dev_device_down() calls ax25_ds_del_timer() to cleanup the slave_timer. When the timer handler is running, the ax25_ds_del_timer() that calls del_timer() in it will return directly. As a result, the use-after-free bugs could happen, one of the scenarios is shown below: (Thread 1) | (Thread 2) | ax25_ds_timeout() ax25_dev_device_down() | ax25_ds_del_timer() | del_timer() | ax25_dev_put() //FREE | | ax25_dev-> //USE In order to mitigate bugs, when the device is detaching, use timer_shutdown_sync() to stop the timer.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: idpf: fix kernel panic on unknown packet types In the very rare case where a packet type is unknown to the driver, idpf_rx_process_skb_fields would return early without calling eth_type_trans to set the skb protocol / the network layer handler. This is especially problematic if tcpdump is running when such a packet is received, i.e. it would cause a kernel panic. Instead, call eth_type_trans for every single packet, even when the packet type is unknown.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: Fix potential null pointer dereference In lan8814_get_sig_rx() and lan8814_get_sig_tx() ptp_parse_header() may return NULL as ptp_header due to abnormal packet type or corrupted packet. Fix this bug by adding ptp_header check. Found by Linux Verification Center (linuxtesting.org) with SVACE.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any interrupt context, locks taken during a map_delete_elem operation must be hardirq-safe. Otherwise a deadlock due to lock inversion is possible, as reported by lockdep: CPU0 CPU1 ---- ---- lock(&htab->buckets[i].lock); local_irq_disable(); lock(&host->lock); lock(&htab->buckets[i].lock); <Interrupt> lock(&host->lock); Locks in sockmap are hardirq-unsafe by design. We expects elements to be deleted from sockmap/sockhash only in task (normal) context with interrupts enabled, or in softirq context. Detect when map_delete_elem operation is invoked from a context which is _not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an error. Note that map updates are not affected by this issue. BPF verifier does not allow updating sockmap/sockhash from a BPF tracing program today.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix Rx DMA datasize and skb_over_panic mana_get_rxbuf_cfg() aligns the RX buffer's DMA datasize to be multiple of 64. So a packet slightly bigger than mtu+14, say 1536, can be received and cause skb_over_panic. Sample dmesg: [ 5325.237162] skbuff: skb_over_panic: text:ffffffffc043277a len:1536 put:1536 head:ff1100018b517000 data:ff1100018b517100 tail:0x700 end:0x6ea dev:<NULL> [ 5325.243689] ------------[ cut here ]------------ [ 5325.245748] kernel BUG at net/core/skbuff.c:192! [ 5325.247838] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 5325.258374] RIP: 0010:skb_panic+0x4f/0x60 [ 5325.302941] Call Trace: [ 5325.304389] <IRQ> [ 5325.315794] ? skb_panic+0x4f/0x60 [ 5325.317457] ? asm_exc_invalid_op+0x1f/0x30 [ 5325.319490] ? skb_panic+0x4f/0x60 [ 5325.321161] skb_put+0x4e/0x50 [ 5325.322670] mana_poll+0x6fa/0xb50 [mana] [ 5325.324578] __napi_poll+0x33/0x1e0 [ 5325.326328] net_rx_action+0x12e/0x280 As discussed internally, this alignment is not necessary. To fix this bug, remove it from the code. So oversized packets will be marked as CQE_RX_TRUNCATED by NIC, and dropped.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: x86/bpf: Fix IP after emitting call depth accounting Adjust the IP passed to `emit_patch` so it calculates the correct offset for the CALL instruction if `x86_call_depth_emit_accounting` emits code. Otherwise we will skip some instructions and most likely crash.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: selinux: avoid dereference of garbage after mount failure In case kern_mount() fails and returns an error pointer return in the error branch instead of continuing and dereferencing the error pointer. While on it drop the never read static variable selinuxfs_mount.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf: Protect against int overflow for stack access size This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. This should not actually happen, as there are other protections along the way, but we should protect against it anyway. One code path was missing such protections (fixed in the previous patch in the series), causing out-of-bounds array accesses in check_stack_range_initialized(). This patch causes the verification of a program with such a non-sensical access size to fail. This check used to exist in a more indirect way, but was inadvertendly removed in a833a17aeac7.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mlxbf_gige: call request_irq() after NAPI initialized The mlxbf_gige driver encounters a NULL pointer exception in mlxbf_gige_open() when kdump is enabled. The sequence to reproduce the exception is as follows: a) enable kdump b) trigger kdump via "echo c > /proc/sysrq-trigger" c) kdump kernel executes d) kdump kernel loads mlxbf_gige module e) the mlxbf_gige module runs its open() as the the "oob_net0" interface is brought up f) mlxbf_gige module will experience an exception during its open(), something like: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Mem abort info: ESR = 0x0000000086000004 EC = 0x21: IABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault user pgtable: 4k pages, 48-bit VAs, pgdp=00000000e29a4000 [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000086000004 [#1] SMP CPU: 0 PID: 812 Comm: NetworkManager Tainted: G OE 5.15.0-1035-bluefield #37-Ubuntu Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.6.0.13024 Jan 19 2024 pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : 0x0 lr : __napi_poll+0x40/0x230 sp : ffff800008003e00 x29: ffff800008003e00 x28: 0000000000000000 x27: 00000000ffffffff x26: ffff000066027238 x25: ffff00007cedec00 x24: ffff800008003ec8 x23: 000000000000012c x22: ffff800008003eb7 x21: 0000000000000000 x20: 0000000000000001 x19: ffff000066027238 x18: 0000000000000000 x17: ffff578fcb450000 x16: ffffa870b083c7c0 x15: 0000aaab010441d0 x14: 0000000000000001 x13: 00726f7272655f65 x12: 6769675f6662786c x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa870b0842398 x8 : 0000000000000004 x7 : fe5a48b9069706ea x6 : 17fdb11fc84ae0d2 x5 : d94a82549d594f35 x4 : 0000000000000000 x3 : 0000000000400100 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000066027238 Call trace: 0x0 net_rx_action+0x178/0x360 __do_softirq+0x15c/0x428 __irq_exit_rcu+0xac/0xec irq_exit+0x18/0x2c handle_domain_irq+0x6c/0xa0 gic_handle_irq+0xec/0x1b0 call_on_irq_stack+0x20/0x2c do_interrupt_handler+0x5c/0x70 el1_interrupt+0x30/0x50 el1h_64_irq_handler+0x18/0x2c el1h_64_irq+0x7c/0x80 __setup_irq+0x4c0/0x950 request_threaded_irq+0xf4/0x1bc mlxbf_gige_request_irqs+0x68/0x110 [mlxbf_gige] mlxbf_gige_open+0x5c/0x170 [mlxbf_gige] __dev_open+0x100/0x220 __dev_change_flags+0x16c/0x1f0 dev_change_flags+0x2c/0x70 do_setlink+0x220/0xa40 __rtnl_newlink+0x56c/0x8a0 rtnl_newlink+0x58/0x84 rtnetlink_rcv_msg+0x138/0x3c4 netlink_rcv_skb+0x64/0x130 rtnetlink_rcv+0x20/0x30 netlink_unicast+0x2ec/0x360 netlink_sendmsg+0x278/0x490 __sock_sendmsg+0x5c/0x6c ____sys_sendmsg+0x290/0x2d4 ___sys_sendmsg+0x84/0xd0 __sys_sendmsg+0x70/0xd0 __arm64_sys_sendmsg+0x2c/0x40 invoke_syscall+0x78/0x100 el0_svc_common.constprop.0+0x54/0x184 do_el0_svc+0x30/0xac el0_svc+0x48/0x160 el0t_64_sync_handler+0xa4/0x12c el0t_64_sync+0x1a4/0x1a8 Code: bad PC value ---[ end trace 7d1c3f3bf9d81885 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt Kernel Offset: 0x2870a7a00000 from 0xffff800008000000 PHYS_OFFSET: 0x80000000 CPU features: 0x0,000005c1,a3332a5a Memory Limit: none ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]--- The exception happens because there is a pending RX interrupt before the call to request_irq(RX IRQ) executes. Then, the RX IRQ handler fires immediately after this request_irq() completes. The ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Split 64bit accesses to fix alignment issues Some of the registers are aligned on a 32bit boundary, causing alignment faults on 64bit platforms. Unable to handle kernel paging request at virtual address ffffffc084a1d004 Mem abort info: ESR = 0x0000000096000061 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault Data abort info: ISV = 0, ISS = 0x00000061, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000046ad6000 [ffffffc084a1d004] pgd=100000013ffff003, p4d=100000013ffff003, pud=100000013ffff003, pmd=0068000020a00711 Internal error: Oops: 0000000096000061 [#1] SMP Modules linked in: mtk_t7xx(+) qcserial pppoe ppp_async option nft_fib_inet nf_flow_table_inet mt7921u(O) mt7921s(O) mt7921e(O) mt7921_common(O) iwlmvm(O) iwldvm(O) usb_wwan rndis_host qmi_wwan pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mt7996e(O) mt792x_usb(O) mt792x_lib(O) mt7915e(O) mt76_usb(O) mt76_sdio(O) mt76_connac_lib(O) mt76(O) mac80211(O) iwlwifi(O) huawei_cdc_ncm cfg80211(O) cdc_ncm cdc_ether wwan usbserial usbnet slhc sfp rtc_pcf8563 nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 mt6577_auxadc mdio_i2c libcrc32c compat(O) cdc_wdm cdc_acm at24 crypto_safexcel pwm_fan i2c_gpio i2c_smbus industrialio i2c_algo_bit i2c_mux_reg i2c_mux_pca954x i2c_mux_pca9541 i2c_mux_gpio i2c_mux dummy oid_registry tun sha512_arm64 sha1_ce sha1_generic seqiv md5 geniv des_generic libdes cbc authencesn authenc leds_gpio xhci_plat_hcd xhci_pci xhci_mtk_hcd xhci_hcd nvme nvme_core gpio_button_hotplug(O) dm_mirror dm_region_hash dm_log dm_crypt dm_mod dax usbcore usb_common ptp aquantia pps_core mii tpm encrypted_keys trusted CPU: 3 PID: 5266 Comm: kworker/u9:1 Tainted: G O 6.6.22 #0 Hardware name: Bananapi BPI-R4 (DT) Workqueue: md_hk_wq t7xx_fsm_uninit [mtk_t7xx] pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : t7xx_cldma_hw_set_start_addr+0x1c/0x3c [mtk_t7xx] lr : t7xx_cldma_start+0xac/0x13c [mtk_t7xx] sp : ffffffc085d63d30 x29: ffffffc085d63d30 x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000000 x25: ffffff80c804f2c0 x24: ffffff80ca196c05 x23: 0000000000000000 x22: ffffff80c814b9b8 x21: ffffff80c814b128 x20: 0000000000000001 x19: ffffff80c814b080 x18: 0000000000000014 x17: 0000000055c9806b x16: 000000007c5296d0 x15: 000000000f6bca68 x14: 00000000dbdbdce4 x13: 000000001aeaf72a x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffffff80ca1ef6b4 x7 : ffffff80c814b818 x6 : 0000000000000018 x5 : 0000000000000870 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000010a947000 x1 : ffffffc084a1d004 x0 : ffffffc084a1d004 Call trace: t7xx_cldma_hw_set_start_addr+0x1c/0x3c [mtk_t7xx] t7xx_fsm_uninit+0x578/0x5ec [mtk_t7xx] process_one_work+0x154/0x2a0 worker_thread+0x2ac/0x488 kthread+0xe0/0xec ret_from_fork+0x10/0x20 Code: f9400800 91001000 8b214001 d50332bf (f9000022) ---[ end trace 0000000000000000 ]--- The inclusion of io-64-nonatomic-lo-hi.h indicates that all 64bit accesses can be replaced by pairs of nonatomic 32bit access. Fix alignment by forcing all accesses to be 32bit on 64bit platforms.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ice: fix memory corruption bug with suspend and rebuild The ice driver would previously panic after suspend. This is caused from the driver *only* calling the ice_vsi_free_q_vectors() function by itself, when it is suspending. Since commit b3e7b3a6ee92 ("ice: prevent NULL pointer deref during reload") the driver has zeroed out num_q_vectors, and only restored it in ice_vsi_cfg_def(). This further causes the ice_rebuild() function to allocate a zero length buffer, after which num_q_vectors is updated, and then the new value of num_q_vectors is used to index into the zero length buffer, which corrupts memory. The fix entails making sure all the code referencing num_q_vectors only does so after it has been reset via ice_vsi_cfg_def(). I didn't perform a full bisect, but I was able to test against 6.1.77 kernel and that ice driver works fine for suspend/resume with no panic, so sometime since then, this problem was introduced. Also clean up an un-needed init of a local variable in the function being modified. PANIC from 6.8.0-rc1: [1026674.915596] PM: suspend exit [1026675.664697] ice 0000:17:00.1: PTP reset successful [1026675.664707] ice 0000:17:00.1: 2755 msecs passed between update to cached PHC time [1026675.667660] ice 0000:b1:00.0: PTP reset successful [1026675.675944] ice 0000:b1:00.0: 2832 msecs passed between update to cached PHC time [1026677.137733] ixgbe 0000:31:00.0 ens787: NIC Link is Up 1 Gbps, Flow Control: None [1026677.190201] BUG: kernel NULL pointer dereference, address: 0000000000000010 [1026677.192753] ice 0000:17:00.0: PTP reset successful [1026677.192764] ice 0000:17:00.0: 4548 msecs passed between update to cached PHC time [1026677.197928] #PF: supervisor read access in kernel mode [1026677.197933] #PF: error_code(0x0000) - not-present page [1026677.197937] PGD 1557a7067 P4D 0 [1026677.212133] ice 0000:b1:00.1: PTP reset successful [1026677.212143] ice 0000:b1:00.1: 4344 msecs passed between update to cached PHC time [1026677.212575] [1026677.243142] Oops: 0000 [#1] PREEMPT SMP NOPTI [1026677.247918] CPU: 23 PID: 42790 Comm: kworker/23:0 Kdump: loaded Tainted: G W 6.8.0-rc1+ #1 [1026677.257989] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022 [1026677.269367] Workqueue: ice ice_service_task [ice] [1026677.274592] RIP: 0010:ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.281421] Code: 0f 84 3a ff ff ff 41 0f b7 74 ec 02 66 89 b0 22 02 00 00 81 e6 ff 1f 00 00 e8 ec fd ff ff e9 35 ff ff ff 48 8b 43 30 49 63 ed <41> 0f b7 34 24 41 83 c5 01 48 8b 3c e8 66 89 b7 aa 02 00 00 81 e6 [1026677.300877] RSP: 0018:ff3be62a6399bcc0 EFLAGS: 00010202 [1026677.306556] RAX: ff28691e28980828 RBX: ff28691e41099828 RCX: 0000000000188000 [1026677.314148] RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff28691e41099828 [1026677.321730] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [1026677.329311] R10: 0000000000000007 R11: ffffffffffffffc0 R12: 0000000000000010 [1026677.336896] R13: 0000000000000000 R14: 0000000000000000 R15: ff28691e0eaa81a0 [1026677.344472] FS: 0000000000000000(0000) GS:ff28693cbffc0000(0000) knlGS:0000000000000000 [1026677.353000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1026677.359195] CR2: 0000000000000010 CR3: 0000000128df4001 CR4: 0000000000771ef0 [1026677.366779] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1026677.374369] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1026677.381952] PKRU: 55555554 [1026677.385116] Call Trace: [1026677.388023] <TASK> [1026677.390589] ? __die+0x20/0x70 [1026677.394105] ? page_fault_oops+0x82/0x160 [1026677.398576] ? do_user_addr_fault+0x65/0x6a0 [1026677.403307] ? exc_page_fault+0x6a/0x150 [1026677.407694] ? asm_exc_page_fault+0x22/0x30 [1026677.412349] ? ice_vsi_rebuild_set_coalesce+0x130/0x1e0 [ice] [1026677.4186 ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: rfi: fix potential response leaks If the rx payload length check fails, or if kmemdup() fails, we still need to free the command response. Fix that.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix error cleanup path in nfsd_rename() Commit a8b0026847b8 ("rename(): avoid a deadlock in the case of parents having no common ancestor") added an error bail out path. However this path does not drop the remount protection that has been acquired. Fix the cleanup path to properly drop the remount protection.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet syzbot reported the following uninit-value access issue [1][2]: nci_rx_work() parses and processes received packet. When the payload length is zero, each message type handler reads uninitialized payload and KMSAN detects this issue. The receipt of a packet with a zero-size payload is considered unexpected, and therefore, such packets should be silently discarded. This patch resolved this issue by checking payload size before calling each message type handler codes.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix NULL pointer dereference in sanitycheck() If due to a memory allocation failure mock_chain() returns NULL, it is passed to dma_fence_enable_sw_signaling() resulting in NULL pointer dereference there. Call dma_fence_enable_sw_signaling() only if mock_chain() succeeds. Found by Linux Verification Center (linuxtesting.org) with SVACE.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Fix bpf_plt pointer arithmetic Kui-Feng Lee reported a crash on s390x triggered by the dummy_st_ops/dummy_init_ptr_arg test [1]: [<0000000000000002>] 0x2 [<00000000009d5cde>] bpf_struct_ops_test_run+0x156/0x250 [<000000000033145a>] __sys_bpf+0xa1a/0xd00 [<00000000003319dc>] __s390x_sys_bpf+0x44/0x50 [<0000000000c4382c>] __do_syscall+0x244/0x300 [<0000000000c59a40>] system_call+0x70/0x98 This is caused by GCC moving memcpy() after assignments in bpf_jit_plt(), resulting in NULL pointers being written instead of the return and the target addresses. Looking at the GCC internals, the reordering is allowed because the alias analysis thinks that the memcpy() destination and the assignments' left-hand-sides are based on different objects: new_plt and bpf_plt_ret/bpf_plt_target respectively, and therefore they cannot alias. This is in turn due to a violation of the C standard: When two pointers are subtracted, both shall point to elements of the same array object, or one past the last element of the array object ... From the C's perspective, bpf_plt_ret and bpf_plt are distinct objects and cannot be subtracted. In the practical terms, doing so confuses the GCC's alias analysis. The code was written this way in order to let the C side know a few offsets defined in the assembly. While nice, this is by no means necessary. Fix the noncompliance by hardcoding these offsets. [1] https://lore.kernel.org/bpf/c9923c1d-971d-4022-8dc8-1364e929d34c@gmail.com/


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix oops when HEVC init fails The stateless HEVC decoder saves the instance pointer in the context regardless if the initialization worked or not. This caused a use after free, when the pointer is freed in case of a failure in the deinit function. Only store the instance pointer when the initialization was successful, to solve this issue. Hardware name: Acer Tomato (rev3 - 4) board (DT) pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] lr : vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] sp : ffff80008750bc20 x29: ffff80008750bc20 x28: ffff1299f6d70000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 x23: ffff80008750bc98 x22: 000000000000a003 x21: ffffd45c4cfae000 x20: 0000000000000010 x19: ffff1299fd668310 x18: 000000000000001a x17: 000000040044ffff x16: ffffd45cb15dc648 x15: 0000000000000000 x14: ffff1299c08da1c0 x13: ffffd45cb1f87a10 x12: ffffd45cb2f5fe80 x11: 0000000000000001 x10: 0000000000001b30 x9 : ffffd45c4d12b488 x8 : 1fffe25339380d81 x7 : 0000000000000001 x6 : ffff1299c9c06c00 x5 : 0000000000000132 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000010 x1 : ffff80008750bc98 x0 : 0000000000000000 Call trace: vcodec_vpu_send_msg+0x4c/0x190 [mtk_vcodec_dec] vcodec_send_ap_ipi+0x78/0x170 [mtk_vcodec_dec] vpu_dec_deinit+0x1c/0x30 [mtk_vcodec_dec] vdec_hevc_slice_deinit+0x30/0x98 [mtk_vcodec_dec] vdec_if_deinit+0x38/0x68 [mtk_vcodec_dec] mtk_vcodec_dec_release+0x20/0x40 [mtk_vcodec_dec] fops_vcodec_release+0x64/0x118 [mtk_vcodec_dec] v4l2_release+0x7c/0x100 __fput+0x80/0x2d8 __fput_sync+0x58/0x70 __arm64_sys_close+0x40/0x90 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0xd8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x1a8/0x1b0 Code: d503201f f9401660 b900127f b900227f (f9400400)


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: fbmon: prevent division by zero in fb_videomode_from_videomode() The expression htotal * vtotal can have a zero value on overflow. It is necessary to prevent division by zero like in fb_var_to_videomode(). Found by Linux Verification Center (linuxtesting.org) with Svace.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Limit read size on v1.2 Between UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was increased from 16 to 256. In order to avoid overflowing reads for older systems, add a mechanism to use the read UCSI version to truncate read sizes on UCSI v1.2.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm: Check output polling initialized before disabling In drm_kms_helper_poll_disable() check if output polling support is initialized before disabling polling. If not flag this as a warning. Additionally in drm_mode_config_helper_suspend() and drm_mode_config_helper_resume() calls, that re the callers of these functions, avoid invoking them if polling is not initialized. For drivers like hyperv-drm, that do not initialize connector polling, if suspend is called without this check, it leads to suspend failure with following stack [ 770.719392] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done. [ 770.720592] printk: Suspending console(s) (use no_console_suspend to debug) [ 770.948823] ------------[ cut here ]------------ [ 770.948824] WARNING: CPU: 1 PID: 17197 at kernel/workqueue.c:3162 __flush_work.isra.0+0x212/0x230 [ 770.948831] Modules linked in: rfkill nft_counter xt_conntrack xt_owner udf nft_compat crc_itu_t nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink vfat fat mlx5_ib ib_uverbs ib_core mlx5_core intel_rapl_msr intel_rapl_common kvm_amd ccp mlxfw kvm psample hyperv_drm tls drm_shmem_helper drm_kms_helper irqbypass pcspkr syscopyarea sysfillrect sysimgblt hv_balloon hv_utils joydev drm fuse xfs libcrc32c pci_hyperv pci_hyperv_intf sr_mod sd_mod cdrom t10_pi sg hv_storvsc scsi_transport_fc hv_netvsc serio_raw hyperv_keyboard hid_hyperv crct10dif_pclmul crc32_pclmul crc32c_intel hv_vmbus ghash_clmulni_intel dm_mirror dm_region_hash dm_log dm_mod [ 770.948863] CPU: 1 PID: 17197 Comm: systemd-sleep Not tainted 5.14.0-362.2.1.el9_3.x86_64 #1 [ 770.948865] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 770.948866] RIP: 0010:__flush_work.isra.0+0x212/0x230 [ 770.948869] Code: 8b 4d 00 4c 8b 45 08 89 ca 48 c1 e9 04 83 e2 08 83 e1 0f 83 ca 02 89 c8 48 0f ba 6d 00 03 e9 25 ff ff ff 0f 0b e9 4e ff ff ff <0f> 0b 45 31 ed e9 44 ff ff ff e8 8f 89 b2 00 66 66 2e 0f 1f 84 00 [ 770.948870] RSP: 0018:ffffaf4ac213fb10 EFLAGS: 00010246 [ 770.948871] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8c992857 [ 770.948872] RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff9aad82b00330 [ 770.948873] RBP: ffff9aad82b00330 R08: 0000000000000000 R09: ffff9aad87ee3d10 [ 770.948874] R10: 0000000000000200 R11: 0000000000000000 R12: ffff9aad82b00330 [ 770.948874] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 770.948875] FS: 00007ff1b2f6bb40(0000) GS:ffff9aaf37d00000(0000) knlGS:0000000000000000 [ 770.948878] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 770.948878] CR2: 0000555f345cb666 CR3: 00000001462dc005 CR4: 0000000000370ee0 [ 770.948879] Call Trace: [ 770.948880] <TASK> [ 770.948881] ? show_trace_log_lvl+0x1c4/0x2df [ 770.948884] ? show_trace_log_lvl+0x1c4/0x2df [ 770.948886] ? __cancel_work_timer+0x103/0x190 [ 770.948887] ? __flush_work.isra.0+0x212/0x230 [ 770.948889] ? __warn+0x81/0x110 [ 770.948891] ? __flush_work.isra.0+0x212/0x230 [ 770.948892] ? report_bug+0x10a/0x140 [ 770.948895] ? handle_bug+0x3c/0x70 [ 770.948898] ? exc_invalid_op+0x14/0x70 [ 770.948899] ? asm_exc_invalid_op+0x16/0x20 [ 770.948903] ? __flush_work.isra.0+0x212/0x230 [ 770.948905] __cancel_work_timer+0x103/0x190 [ 770.948907] ? _raw_spin_unlock_irqrestore+0xa/0x30 [ 770.948910] drm_kms_helper_poll_disable+0x1e/0x40 [drm_kms_helper] [ 770.948923] drm_mode_config_helper_suspend+0x1c/0x80 [drm_kms_helper] [ 770.948933] ? __pfx_vmbus_suspend+0x10/0x10 [hv_vmbus] [ 770.948942] hyperv_vmbus_suspend+0x17/0x40 [hyperv_drm] [ 770.948944] ? __pfx_vmbus_suspend+0x10/0x10 [hv_vmbus] [ 770.948951] dpm_run_callback+0x4c/0x140 [ 770.948954] __device_suspend_noir ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() The call to lpfc_sli4_resume_rpi() in lpfc_rcv_padisc() may return an unsuccessful status. In such cases, the elsiocb is not issued, the completion is not called, and thus the elsiocb resource is leaked. Check return value after calling lpfc_sli4_resume_rpi() and conditionally release the elsiocb resource.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip do PCI error slot reset during RAS recovery Why: The PCI error slot reset maybe triggered after inject ue to UMC multi times, this caused system hang. [ 557.371857] amdgpu 0000:af:00.0: amdgpu: GPU reset succeeded, trying to resume [ 557.373718] [drm] PCIE GART of 512M enabled. [ 557.373722] [drm] PTB located at 0x0000031FED700000 [ 557.373788] [drm] VRAM is lost due to GPU reset! [ 557.373789] [drm] PSP is resuming... [ 557.547012] mlx5_core 0000:55:00.0: mlx5_pci_err_detected Device state = 1 pci_status: 0. Exit, result = 3, need reset [ 557.547067] [drm] PCI error: detected callback, state(1)!! [ 557.547069] [drm] No support for XGMI hive yet... [ 557.548125] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 0. Enter [ 557.607763] mlx5_core 0000:55:00.0: wait vital counter value 0x16b5b after 1 iterations [ 557.607777] mlx5_core 0000:55:00.0: mlx5_pci_slot_reset Device state = 1 pci_status: 1. Exit, err = 0, result = 5, recovered [ 557.610492] [drm] PCI error: slot reset callback!! ... [ 560.689382] amdgpu 0000:3f:00.0: amdgpu: GPU reset(2) succeeded! [ 560.689546] amdgpu 0000:5a:00.0: amdgpu: GPU reset(2) succeeded! [ 560.689562] general protection fault, probably for non-canonical address 0x5f080b54534f611f: 0000 [#1] SMP NOPTI [ 560.701008] CPU: 16 PID: 2361 Comm: kworker/u448:9 Tainted: G OE 5.15.0-91-generic #101-Ubuntu [ 560.712057] Hardware name: Microsoft C278A/C278A, BIOS C2789.5.BS.1C11.AG.1 11/08/2023 [ 560.720959] Workqueue: amdgpu-reset-hive amdgpu_ras_do_recovery [amdgpu] [ 560.728887] RIP: 0010:amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.736891] Code: ff 41 89 c6 e9 1b ff ff ff 44 0f b6 45 b0 e9 4f ff ff ff be 01 00 00 00 4c 89 e7 e8 76 c9 8b ff 44 0f b6 45 b0 e9 3c fd ff ff <48> 83 ba 18 02 00 00 00 0f 84 6a f8 ff ff 48 8d 7a 78 be 01 00 00 [ 560.757967] RSP: 0018:ffa0000032e53d80 EFLAGS: 00010202 [ 560.763848] RAX: ffa00000001dfd10 RBX: ffa0000000197090 RCX: ffa0000032e53db0 [ 560.771856] RDX: 5f080b54534f5f07 RSI: 0000000000000000 RDI: ff11000128100010 [ 560.779867] RBP: ffa0000032e53df0 R08: 0000000000000000 R09: ffffffffffe77f08 [ 560.787879] R10: 0000000000ffff0a R11: 0000000000000001 R12: 0000000000000000 [ 560.795889] R13: ffa0000032e53e00 R14: 0000000000000000 R15: 0000000000000000 [ 560.803889] FS: 0000000000000000(0000) GS:ff11007e7e800000(0000) knlGS:0000000000000000 [ 560.812973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 560.819422] CR2: 000055a04c118e68 CR3: 0000000007410005 CR4: 0000000000771ee0 [ 560.827433] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 560.835433] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 560.843444] PKRU: 55555554 [ 560.846480] Call Trace: [ 560.849225] <TASK> [ 560.851580] ? show_trace_log_lvl+0x1d6/0x2ea [ 560.856488] ? show_trace_log_lvl+0x1d6/0x2ea [ 560.861379] ? amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.867778] ? show_regs.part.0+0x23/0x29 [ 560.872293] ? __die_body.cold+0x8/0xd [ 560.876502] ? die_addr+0x3e/0x60 [ 560.880238] ? exc_general_protection+0x1c5/0x410 [ 560.885532] ? asm_exc_general_protection+0x27/0x30 [ 560.891025] ? amdgpu_device_gpu_recover.cold+0xbf1/0xcf5 [amdgpu] [ 560.898323] amdgpu_ras_do_recovery+0x1b2/0x210 [amdgpu] [ 560.904520] process_one_work+0x228/0x3d0 How: In RAS recovery, mode-1 reset is issued from RAS fatal error handling and expected all the nodes in a hive to be reset. no need to issue another mode-1 during this procedure.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: don't check if plane->state->fb == state->fb Currently, when using non-blocking commits, we can see the following kernel warning: [ 110.908514] ------------[ cut here ]------------ [ 110.908529] refcount_t: underflow; use-after-free. [ 110.908620] WARNING: CPU: 0 PID: 1866 at lib/refcount.c:87 refcount_dec_not_one+0xb8/0xc0 [ 110.908664] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device cmac algif_hash aes_arm64 aes_generic algif_skcipher af_alg bnep hid_logitech_hidpp vc4 brcmfmac hci_uart btbcm brcmutil bluetooth snd_soc_hdmi_codec cfg80211 cec drm_display_helper drm_dma_helper drm_kms_helper snd_soc_core snd_compress snd_pcm_dmaengine fb_sys_fops sysimgblt syscopyarea sysfillrect raspberrypi_hwmon ecdh_generic ecc rfkill libaes i2c_bcm2835 binfmt_misc joydev snd_bcm2835(C) bcm2835_codec(C) bcm2835_isp(C) v4l2_mem2mem videobuf2_dma_contig snd_pcm bcm2835_v4l2(C) raspberrypi_gpiomem bcm2835_mmal_vchiq(C) videobuf2_v4l2 snd_timer videobuf2_vmalloc videobuf2_memops videobuf2_common snd videodev vc_sm_cma(C) mc hid_logitech_dj uio_pdrv_genirq uio i2c_dev drm fuse dm_mod drm_panel_orientation_quirks backlight ip_tables x_tables ipv6 [ 110.909086] CPU: 0 PID: 1866 Comm: kodi.bin Tainted: G C 6.1.66-v8+ #32 [ 110.909104] Hardware name: Raspberry Pi 3 Model B Rev 1.2 (DT) [ 110.909114] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 110.909132] pc : refcount_dec_not_one+0xb8/0xc0 [ 110.909152] lr : refcount_dec_not_one+0xb4/0xc0 [ 110.909170] sp : ffffffc00913b9c0 [ 110.909177] x29: ffffffc00913b9c0 x28: 000000556969bbb0 x27: 000000556990df60 [ 110.909205] x26: 0000000000000002 x25: 0000000000000004 x24: ffffff8004448480 [ 110.909230] x23: ffffff800570b500 x22: ffffff802e03a7bc x21: ffffffecfca68c78 [ 110.909257] x20: ffffff8002b42000 x19: ffffff802e03a600 x18: 0000000000000000 [ 110.909283] x17: 0000000000000011 x16: ffffffffffffffff x15: 0000000000000004 [ 110.909308] x14: 0000000000000fff x13: ffffffed577e47e0 x12: 0000000000000003 [ 110.909333] x11: 0000000000000000 x10: 0000000000000027 x9 : c912d0d083728c00 [ 110.909359] x8 : c912d0d083728c00 x7 : 65646e75203a745f x6 : 746e756f63666572 [ 110.909384] x5 : ffffffed579f62ee x4 : ffffffed579eb01e x3 : 0000000000000000 [ 110.909409] x2 : 0000000000000000 x1 : ffffffc00913b750 x0 : 0000000000000001 [ 110.909434] Call trace: [ 110.909441] refcount_dec_not_one+0xb8/0xc0 [ 110.909461] vc4_bo_dec_usecnt+0x4c/0x1b0 [vc4] [ 110.909903] vc4_cleanup_fb+0x44/0x50 [vc4] [ 110.910315] drm_atomic_helper_cleanup_planes+0x88/0xa4 [drm_kms_helper] [ 110.910669] vc4_atomic_commit_tail+0x390/0x9dc [vc4] [ 110.911079] commit_tail+0xb0/0x164 [drm_kms_helper] [ 110.911397] drm_atomic_helper_commit+0x1d0/0x1f0 [drm_kms_helper] [ 110.911716] drm_atomic_commit+0xb0/0xdc [drm] [ 110.912569] drm_mode_atomic_ioctl+0x348/0x4b8 [drm] [ 110.913330] drm_ioctl_kernel+0xec/0x15c [drm] [ 110.914091] drm_ioctl+0x24c/0x3b0 [drm] [ 110.914850] __arm64_sys_ioctl+0x9c/0xd4 [ 110.914873] invoke_syscall+0x4c/0x114 [ 110.914897] el0_svc_common+0xd0/0x118 [ 110.914917] do_el0_svc+0x38/0xd0 [ 110.914936] el0_svc+0x30/0x8c [ 110.914958] el0t_64_sync_handler+0x84/0xf0 [ 110.914979] el0t_64_sync+0x18c/0x190 [ 110.914996] ---[ end trace 0000000000000000 ]--- This happens because, although `prepare_fb` and `cleanup_fb` are perfectly balanced, we cannot guarantee consistency in the check plane->state->fb == state->fb. This means that sometimes we can increase the refcount in `prepare_fb` and don't decrease it in `cleanup_fb`. The opposite can also be true. In fact, the struct drm_plane .state shouldn't be accessed directly but instead, the `drm_atomic_get_new_plane_state()` helper function should be used. So, we could stick to this check, but using `drm_atomic_get_new_plane_state()`. But actually, this check is not re ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: Fix null ptr deref in btintel_read_version If hci_cmd_sync_complete() is triggered and skb is NULL, then hdev->req_skb is NULL, which will cause this issue.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: btrfs: send: handle path ref underflow in header iterate_inode_ref() Change BUG_ON to proper error handling if building the path buffer fails. The pointers are not printed so we don't accidentally leak kernel addresses.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions: - at first the search key is set up to look for a chunk tree item, with offset -1, this is an inexact search and the key->offset will contain the correct offset upon a successful search, a valid chunk tree item cannot have an offset -1 - after first successful search, the found_key corresponds to a chunk item, the offset is decremented by 1 before the next loop, it's impossible to find a chunk item there due to alignment and size constraints


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check A-MSDU format more carefully If it looks like there's another subframe in the A-MSDU but the header isn't fully there, we can end up reading data out of bounds, only to discard later. Make this a bit more careful and check if the subframe header can even be present.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: decrease MHI channel buffer length to 8KB Currently buf_len field of ath11k_mhi_config_qca6390 is assigned with 0, making MHI use a default size, 64KB, to allocate channel buffers. This is likely to fail in some scenarios where system memory is highly fragmented and memory compaction or reclaim is not allowed. There is a fail report which is caused by it: kworker/u32:45: page allocation failure: order:4, mode:0x40c00(GFP_NOIO|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0 CPU: 0 PID: 19318 Comm: kworker/u32:45 Not tainted 6.8.0-rc3-1.gae4495f-default #1 openSUSE Tumbleweed (unreleased) 493b6d5b382c603654d7a81fc3c144d59a1dfceb Workqueue: events_unbound async_run_entry_fn Call Trace: <TASK> dump_stack_lvl+0x47/0x60 warn_alloc+0x13a/0x1b0 ? srso_alias_return_thunk+0x5/0xfbef5 ? __alloc_pages_direct_compact+0xab/0x210 __alloc_pages_slowpath.constprop.0+0xd3e/0xda0 __alloc_pages+0x32d/0x350 ? mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] __kmalloc_large_node+0x72/0x110 __kmalloc+0x37c/0x480 ? mhi_map_single_no_bb+0x77/0xf0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] ? mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] mhi_prepare_channel+0x127/0x2d0 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] __mhi_prepare_for_transfer+0x44/0x80 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] ? __pfx_____mhi_prepare_for_transfer+0x10/0x10 [mhi 40df44e07c05479f7a6e7b90fba9f0e0031a7814] device_for_each_child+0x5c/0xa0 ? __pfx_pci_pm_resume+0x10/0x10 ath11k_core_resume+0x65/0x100 [ath11k a5094e22d7223135c40d93c8f5321cf09fd85e4e] ? srso_alias_return_thunk+0x5/0xfbef5 ath11k_pci_pm_resume+0x32/0x60 [ath11k_pci 830b7bfc3ea80ebef32e563cafe2cb55e9cc73ec] ? srso_alias_return_thunk+0x5/0xfbef5 dpm_run_callback+0x8c/0x1e0 device_resume+0x104/0x340 ? __pfx_dpm_watchdog_handler+0x10/0x10 async_resume+0x1d/0x30 async_run_entry_fn+0x32/0x120 process_one_work+0x168/0x330 worker_thread+0x2f5/0x410 ? __pfx_worker_thread+0x10/0x10 kthread+0xe8/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> Actually those buffers are used only by QMI target -> host communication. And for WCN6855 and QCA6390, the largest packet size for that is less than 6KB. So change buf_len field to 8KB, which results in order 1 allocation if page size is 4KB. In this way, we can at least save some memory, and as well as decrease the possibility of allocation failure in those scenarios. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: pstore/zone: Add a null pointer check to the psz_kmsg_read kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: pmdomain: ti: Add a null pointer check to the omap_prm_domain_init devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() Syzkaller hit 'WARNING in dg_dispatch_as_host' bug. memcpy: detected field-spanning write (size 56) of single field "&dg_info->msg" at drivers/misc/vmw_vmci/vmci_datagram.c:237 (size 24) WARNING: CPU: 0 PID: 1555 at drivers/misc/vmw_vmci/vmci_datagram.c:237 dg_dispatch_as_host+0x88e/0xa60 drivers/misc/vmw_vmci/vmci_datagram.c:237 Some code commentry, based on my understanding: 544 #define VMCI_DG_SIZE(_dg) (VMCI_DG_HEADERSIZE + (size_t)(_dg)->payload_size) /// This is 24 + payload_size memcpy(&dg_info->msg, dg, dg_size); Destination = dg_info->msg ---> this is a 24 byte structure(struct vmci_datagram) Source = dg --> this is a 24 byte structure (struct vmci_datagram) Size = dg_size = 24 + payload_size {payload_size = 56-24 =32} -- Syzkaller managed to set payload_size to 32. 35 struct delayed_datagram_info { 36 struct datagram_entry *entry; 37 struct work_struct work; 38 bool in_dg_host_queue; 39 /* msg and msg_payload must be together. */ 40 struct vmci_datagram msg; 41 u8 msg_payload[]; 42 }; So those extra bytes of payload are copied into msg_payload[], a run time warning is seen while fuzzing with Syzkaller. One possible way to fix the warning is to split the memcpy() into two parts -- one -- direct assignment of msg and second taking care of payload. Gustavo quoted: "Under FORTIFY_SOURCE we should not copy data across multiple members in a structure."


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: phy: phy_device: Prevent nullptr exceptions on ISR If phydev->irq is set unconditionally, check for valid interrupt handler or fall back to polling mode to prevent nullptr exceptions in interrupt service routine.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix null pointer access when abort scan During cancel scan we might use vif that weren't scanning. Fix this by using the actual scanning vif.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dyndbg: fix old BUG_ON in >control parser Fix a BUG_ON from 2009. Even if it looks "unreachable" (I didn't really look), lets make sure by removing it, doing pr_err and return -EINVAL instead.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/client: Fully protect modes[] with dev->mode_config.mutex The modes[] array contains pointers to modes on the connectors' mode lists, which are protected by dev->mode_config.mutex. Thus we need to extend modes[] the same protection or by the time we use it the elements may already be pointing to freed/reused memory.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() Subject: [PATCH] drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() If some the pages or sgt allocation failed, we shouldn't release the pages ref we got earlier, otherwise we will end up with unbalanced get/put_pages() calls. We should instead leave everything in place and let the BO release function deal with extra cleanup when the object is destroyed, or let the fault handler try again next time it's called.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/ast: Fix soft lockup There is a while-loop in ast_dp_set_on_off() that could lead to infinite-loop. This is because the register, VGACRI-Dx, checked in this API is a scratch register actually controlled by a MCU, named DPMCU, in BMC. These scratch registers are protected by scu-lock. If suc-lock is not off, DPMCU can not update these registers and then host will have soft lockup due to never updated status. DPMCU is used to control DP and relative registers to handshake with host's VGA driver. Even the most time-consuming task, DP's link training, is less than 100ms. 200ms should be enough.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix deadlock in context_xa ivpu_device->context_xa is locked both in kernel thread and IRQ context. It requires XA_FLAGS_LOCK_IRQ flag to be passed during initialization otherwise the lock could be acquired from a thread and interrupted by an IRQ that locks it for the second time causing the deadlock. This deadlock was reported by lockdep and observed in internal tests.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Avoid sg device teardown race sg_remove_sfp_usercontext() must not use sg_device_destroy() after calling scsi_device_put(). sg_device_destroy() is accessing the parent scsi_device request_queue which will already be set to NULL when the preceding call to scsi_device_put() removed the last reference to the parent scsi_device. The resulting NULL pointer exception will then crash the kernel.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix possible use-after-free issue on kprobe registration When unloading a module, its state is changing MODULE_STATE_LIVE -> MODULE_STATE_GOING -> MODULE_STATE_UNFORMED. Each change will take a time. `is_module_text_address()` and `__module_text_address()` works with MODULE_STATE_LIVE and MODULE_STATE_GOING. If we use `is_module_text_address()` and `__module_text_address()` separately, there is a chance that the first one is succeeded but the next one is failed because module->state becomes MODULE_STATE_UNFORMED between those operations. In `check_kprobe_address_safe()`, if the second `__module_text_address()` is failed, that is ignored because it expected a kernel_text address. But it may have failed simply because module->state has been changed to MODULE_STATE_UNFORMED. In this case, arm_kprobe() will try to modify non-exist module text address (use-after-free). To fix this problem, we should not use separated `is_module_text_address()` and `__module_text_address()`, but use only `__module_text_address()` once and do `try_module_get(module)` which is only available with MODULE_STATE_LIVE.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations Create subvolume, create snapshot and delete subvolume all use btrfs_subvolume_reserve_metadata() to reserve metadata for the changes done to the parent subvolume's fs tree, which cannot be mediated in the normal way via start_transaction. When quota groups (squota or qgroups) are enabled, this reserves qgroup metadata of type PREALLOC. Once the operation is associated to a transaction, we convert PREALLOC to PERTRANS, which gets cleared in bulk at the end of the transaction. However, the error paths of these three operations were not implementing this lifecycle correctly. They unconditionally converted the PREALLOC to PERTRANS in a generic cleanup step regardless of errors or whether the operation was fully associated to a transaction or not. This resulted in error paths occasionally converting this rsv to PERTRANS without calling record_root_in_trans successfully, which meant that unless that root got recorded in the transaction by some other thread, the end of the transaction would not free that root's PERTRANS, leaking it. Ultimately, this resulted in hitting a WARN in CONFIG_BTRFS_DEBUG builds at unmount for the leaked reservation. The fix is to ensure that every qgroup PREALLOC reservation observes the following properties: 1. any failure before record_root_in_trans is called successfully results in freeing the PREALLOC reservation. 2. after record_root_in_trans, we convert to PERTRANS, and now the transaction owns freeing the reservation. This patch enforces those properties on the three operations. Without it, generic/269 with squotas enabled at mkfs time would fail in ~5-10 runs on my system. With this patch, it ran successfully 1000 times in a row.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: ena: Fix incorrect descriptor free behavior ENA has two types of TX queues: - queues which only process TX packets arriving from the network stack - queues which only process TX packets forwarded to it by XDP_REDIRECT or XDP_TX instructions The ena_free_tx_bufs() cycles through all descriptors in a TX queue and unmaps + frees every descriptor that hasn't been acknowledged yet by the device (uncompleted TX transactions). The function assumes that the processed TX queue is necessarily from the first category listed above and ends up using napi_consume_skb() for descriptors belonging to an XDP specific queue. This patch solves a bug in which, in case of a VF reset, the descriptors aren't freed correctly, leading to crashes.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix mlx5e_priv_init() cleanup flow When mlx5e_priv_init() fails, the cleanup flow calls mlx5e_selq_cleanup which calls mlx5e_selq_apply() that assures that the `priv->state_lock` is held using lockdep_is_held(). Acquire the state_lock in mlx5e_selq_cleanup(). Kernel log: ============================= WARNING: suspicious RCU usage 6.8.0-rc3_net_next_841a9b5 #1 Not tainted ----------------------------- drivers/net/ethernet/mellanox/mlx5/core/en/selq.c:124 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 2 locks held by systemd-modules/293: #0: ffffffffa05067b0 (devices_rwsem){++++}-{3:3}, at: ib_register_client+0x109/0x1b0 [ib_core] #1: ffff8881096c65c0 (&device->client_data_rwsem){++++}-{3:3}, at: add_client_context+0x104/0x1c0 [ib_core] stack backtrace: CPU: 4 PID: 293 Comm: systemd-modules Not tainted 6.8.0-rc3_net_next_841a9b5 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x8a/0xa0 lockdep_rcu_suspicious+0x154/0x1a0 mlx5e_selq_apply+0x94/0xa0 [mlx5_core] mlx5e_selq_cleanup+0x3a/0x60 [mlx5_core] mlx5e_priv_init+0x2be/0x2f0 [mlx5_core] mlx5_rdma_setup_rn+0x7c/0x1a0 [mlx5_core] rdma_init_netdev+0x4e/0x80 [ib_core] ? mlx5_rdma_netdev_free+0x70/0x70 [mlx5_core] ipoib_intf_init+0x64/0x550 [ib_ipoib] ipoib_intf_alloc+0x4e/0xc0 [ib_ipoib] ipoib_add_one+0xb0/0x360 [ib_ipoib] add_client_context+0x112/0x1c0 [ib_core] ib_register_client+0x166/0x1b0 [ib_core] ? 0xffffffffa0573000 ipoib_init_module+0xeb/0x1a0 [ib_ipoib] do_one_initcall+0x61/0x250 do_init_module+0x8a/0x270 init_module_from_file+0x8b/0xd0 idempotent_init_module+0x17d/0x230 __x64_sys_finit_module+0x61/0xb0 do_syscall_64+0x71/0x140 entry_SYSCALL_64_after_hwframe+0x46/0x4e </TASK>


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Properly link new fs rules into the tree Previously, add_rule_fg would only add newly created rules from the handle into the tree when they had a refcount of 1. On the other hand, create_flow_handle tries hard to find and reference already existing identical rules instead of creating new ones. These two behaviors can result in a situation where create_flow_handle 1) creates a new rule and references it, then 2) in a subsequent step during the same handle creation references it again, resulting in a rule with a refcount of 2 that is not linked into the tree, will have a NULL parent and root and will result in a crash when the flow group is deleted because del_sw_hw_rule, invoked on rule deletion, assumes node->parent is != NULL. This happened in the wild, due to another bug related to incorrect handling of duplicate pkt_reformat ids, which lead to the code in create_flow_handle incorrectly referencing a just-added rule in the same flow handle, resulting in the problem described above. Full details are at [1]. This patch changes add_rule_fg to add new rules without parents into the tree, properly initializing them and avoiding the crash. This makes it more consistent with how rules are added to an FTE in create_flow_handle.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Register devlink first under devlink lock In case device is having a non fatal FW error during probe, the driver will report the error to user via devlink. This will trigger a WARN_ON, since mlx5 is calling devlink_register() last. In order to avoid the WARN_ON[1], change mlx5 to invoke devl_register() first under devlink lock. [1] WARNING: CPU: 5 PID: 227 at net/devlink/health.c:483 devlink_recover_notify.constprop.0+0xb8/0xc0 CPU: 5 PID: 227 Comm: kworker/u16:3 Not tainted 6.4.0-rc5_for_upstream_min_debug_2023_06_12_12_38 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_health0000:08:00.0 mlx5_fw_reporter_err_work [mlx5_core] RIP: 0010:devlink_recover_notify.constprop.0+0xb8/0xc0 Call Trace: <TASK> ? __warn+0x79/0x120 ? devlink_recover_notify.constprop.0+0xb8/0xc0 ? report_bug+0x17c/0x190 ? handle_bug+0x3c/0x60 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? devlink_recover_notify.constprop.0+0xb8/0xc0 devlink_health_report+0x4a/0x1c0 mlx5_fw_reporter_err_work+0xa4/0xd0 [mlx5_core] process_one_work+0x1bb/0x3c0 ? process_one_work+0x3c0/0x3c0 worker_thread+0x4d/0x3c0 ? process_one_work+0x3c0/0x3c0 kthread+0xc6/0xf0 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK>


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Fix not validating setsockopt user input Check user input length before copying data.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix not validating setsockopt user input Check user input length before copying data.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix not validating setsockopt user input Check user input length before copying data.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix not validating setsockopt user input syzbot reported rfcomm_sock_setsockopt_old() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt_old net/bluetooth/rfcomm/sock.c:632 [inline] BUG: KASAN: slab-out-of-bounds in rfcomm_sock_setsockopt+0x893/0xa70 net/bluetooth/rfcomm/sock.c:673 Read of size 4 at addr ffff8880209a8bc3 by task syz-executor632/5064


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix not validating setsockopt user input syzbot reported sco_sock_setsockopt() is copying data without checking user input length. BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline] BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline] BUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90 net/bluetooth/sco.c:893 Read of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->addr_lst)) and drops all references (__in6_ifa_put(ifp) + in6_ifa_put(ifp)). With bad enough timing, this can happen: 1. In ipv6_get_ifaddr, hlist_for_each_entry_rcu returns an entry. 2. Then, the whole ipv6_del_addr is executed for the given entry. The reference count drops to zero and kfree_rcu is scheduled. 3. ipv6_get_ifaddr continues and tries to increments the reference count (in6_ifa_hold). 4. The rcu is unlocked and the entry is freed. 5. The freed entry is returned. Prevent increasing of the reference count in such case. The name in6_ifa_hold_safe is chosen to mimic the existing fib6_info_hold_safe. [ 41.506330] refcount_t: addition on 0; use-after-free. [ 41.506760] WARNING: CPU: 0 PID: 595 at lib/refcount.c:25 refcount_warn_saturate+0xa5/0x130 [ 41.507413] Modules linked in: veth bridge stp llc [ 41.507821] CPU: 0 PID: 595 Comm: python3 Not tainted 6.9.0-rc2.main-00208-g49563be82afa #14 [ 41.508479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) [ 41.509163] RIP: 0010:refcount_warn_saturate+0xa5/0x130 [ 41.509586] Code: ad ff 90 0f 0b 90 90 c3 cc cc cc cc 80 3d c0 30 ad 01 00 75 a0 c6 05 b7 30 ad 01 01 90 48 c7 c7 38 cc 7a 8c e8 cc 18 ad ff 90 <0f> 0b 90 90 c3 cc cc cc cc 80 3d 98 30 ad 01 00 0f 85 75 ff ff ff [ 41.510956] RSP: 0018:ffffbda3c026baf0 EFLAGS: 00010282 [ 41.511368] RAX: 0000000000000000 RBX: ffff9e9c46914800 RCX: 0000000000000000 [ 41.511910] RDX: ffff9e9c7ec29c00 RSI: ffff9e9c7ec1c900 RDI: ffff9e9c7ec1c900 [ 41.512445] RBP: ffff9e9c43660c9c R08: 0000000000009ffb R09: 00000000ffffdfff [ 41.512998] R10: 00000000ffffdfff R11: ffffffff8ca58a40 R12: ffff9e9c4339a000 [ 41.513534] R13: 0000000000000001 R14: ffff9e9c438a0000 R15: ffffbda3c026bb48 [ 41.514086] FS: 00007fbc4cda1740(0000) GS:ffff9e9c7ec00000(0000) knlGS:0000000000000000 [ 41.514726] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.515176] CR2: 000056233b337d88 CR3: 000000000376e006 CR4: 0000000000370ef0 [ 41.515713] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 41.516252] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 41.516799] Call Trace: [ 41.517037] <TASK> [ 41.517249] ? __warn+0x7b/0x120 [ 41.517535] ? refcount_warn_saturate+0xa5/0x130 [ 41.517923] ? report_bug+0x164/0x190 [ 41.518240] ? handle_bug+0x3d/0x70 [ 41.518541] ? exc_invalid_op+0x17/0x70 [ 41.520972] ? asm_exc_invalid_op+0x1a/0x20 [ 41.521325] ? refcount_warn_saturate+0xa5/0x130 [ 41.521708] ipv6_get_ifaddr+0xda/0xe0 [ 41.522035] inet6_rtm_getaddr+0x342/0x3f0 [ 41.522376] ? __pfx_inet6_rtm_getaddr+0x10/0x10 [ 41.522758] rtnetlink_rcv_msg+0x334/0x3d0 [ 41.523102] ? netlink_unicast+0x30f/0x390 [ 41.523445] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 41.523832] netlink_rcv_skb+0x53/0x100 [ 41.524157] netlink_unicast+0x23b/0x390 [ 41.524484] netlink_sendmsg+0x1f2/0x440 [ 41.524826] __sys_sendto+0x1d8/0x1f0 [ 41.525145] __x64_sys_sendto+0x1f/0x30 [ 41.525467] do_syscall_64+0xa5/0x1b0 [ 41.525794] entry_SYSCALL_64_after_hwframe+0x72/0x7a [ 41.526213] RIP: 0033:0x7fbc4cfcea9a [ 41.526528] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 [ 41.527942] RSP: 002b:00007f ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Handle softirqs at the end of IRQ thread to fix hang The ks8851_irq() thread may call ks8851_rx_pkts() in case there are any packets in the MAC FIFO, which calls netif_rx(). This netif_rx() implementation is guarded by local_bh_disable() and local_bh_enable(). The local_bh_enable() may call do_softirq() to run softirqs in case any are pending. One of the softirqs is net_rx_action, which ultimately reaches the driver .start_xmit callback. If that happens, the system hangs. The entire call chain is below: ks8851_start_xmit_par from netdev_start_xmit netdev_start_xmit from dev_hard_start_xmit dev_hard_start_xmit from sch_direct_xmit sch_direct_xmit from __dev_queue_xmit __dev_queue_xmit from __neigh_update __neigh_update from neigh_update neigh_update from arp_process.constprop.0 arp_process.constprop.0 from __netif_receive_skb_one_core __netif_receive_skb_one_core from process_backlog process_backlog from __napi_poll.constprop.0 __napi_poll.constprop.0 from net_rx_action net_rx_action from __do_softirq __do_softirq from call_with_stack call_with_stack from do_softirq do_softirq from __local_bh_enable_ip __local_bh_enable_ip from netif_rx netif_rx from ks8851_irq ks8851_irq from irq_thread_fn irq_thread_fn from irq_thread irq_thread from kthread kthread from ret_from_fork The hang happens because ks8851_irq() first locks a spinlock in ks8851_par.c ks8851_lock_par() spin_lock_irqsave(&ksp->lock, ...) and with that spinlock locked, calls netif_rx(). Once the execution reaches ks8851_start_xmit_par(), it calls ks8851_lock_par() again which attempts to claim the already locked spinlock again, and the hang happens. Move the do_softirq() call outside of the spinlock protected section of ks8851_irq() by disabling BHs around the entire spinlock protected section of ks8851_irq() handler. Place local_bh_enable() outside of the spinlock protected section, so that it can trigger do_softirq() without the ks8851_par.c ks8851_lock_par() spinlock being held, and safely call ks8851_start_xmit_par() without attempting to lock the already locked spinlock. Since ks8851_irq() is protected by local_bh_disable()/local_bh_enable() now, replace netif_rx() with __netif_rx() which is not duplicating the local_bh_disable()/local_bh_enable() calls.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix possible memory leak in bnxt_rdma_aux_device_init() If ulp = kzalloc() fails, the allocated edev will leak because it is not properly assigned and the cleanup path will not be able to free it. Fix it by assigning it properly immediately after allocation.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: geneve: fix header validation in geneve[6]_xmit_skb syzbot is able to trigger an uninit-value in geneve_xmit() [1] Problem : While most ip tunnel helpers (like ip_tunnel_get_dsfield()) uses skb_protocol(skb, true), pskb_inet_may_pull() is only using skb->protocol. If anything else than ETH_P_IPV6 or ETH_P_IP is found in skb->protocol, pskb_inet_may_pull() does nothing at all. If a vlan tag was provided by the caller (af_packet in the syzbot case), the network header might not point to the correct location, and skb linear part could be smaller than expected. Add skb_vlan_inet_prepare() to perform a complete mac validation. Use this in geneve for the moment, I suspect we need to adopt this more broadly. v4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest - Only call __vlan_get_protocol() for vlan types. v2,v3 - Addressed Sabrina comments on v1 and v2 [1] BUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline] BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 geneve_xmit_skb drivers/net/geneve.c:910 [inline] geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030 __netdev_start_xmit include/linux/netdevice.h:4903 [inline] netdev_start_xmit include/linux/netdevice.h:4917 [inline] xmit_one net/core/dev.c:3531 [inline] dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547 __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335 dev_queue_xmit include/linux/netdevice.h:3091 [inline] packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3081 [inline] packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Uninit was created at: slab_post_alloc_hook mm/slub.c:3804 [inline] slab_alloc_node mm/slub.c:3845 [inline] kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577 __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504 sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795 packet_alloc_skb net/packet/af_packet.c:2930 [inline] packet_snd net/packet/af_packet.c:3024 [inline] packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x30f/0x380 net/socket.c:745 __sys_sendto+0x685/0x830 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199 do_syscall_64+0xd5/0x1f0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 CPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: block: fix q->blkg_list corruption during disk rebind Multiple gendisk instances can allocated/added for single request queue in case of disk rebind. blkg may still stay in q->blkg_list when calling blkcg_init_disk() for rebind, then q->blkg_list becomes corrupted. Fix the list corruption issue by: - add blkg_init_queue() to initialize q->blkg_list & q->blkcg_mutex only - move calling blkg_init_queue() into blk_alloc_queue() The list corruption should be started since commit f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()") which delays removing blkg from q->blkg_list into blkg_free_workfn().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix transmit scheduler resource leak Inorder to support shaping and scheduling, Upon class creation Netdev driver allocates trasmit schedulers. The previous patch which added support for Round robin scheduling has a bug due to which driver is not freeing transmit schedulers post class deletion. This patch fixes the same.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_uart: properly fix race condition The cros_ec_uart_probe() function calls devm_serdev_device_open() before it calls serdev_device_set_client_ops(). This can trigger a NULL pointer dereference: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> ... ? ttyport_receive_buf A simplified version of crashing code is as follows: static inline size_t serdev_controller_receive_buf(struct serdev_controller *ctrl, const u8 *data, size_t count) { struct serdev_device *serdev = ctrl->serdev; if (!serdev || !serdev->ops->receive_buf) // CRASH! return 0; return serdev->ops->receive_buf(serdev, data, count); } It assumes that if SERPORT_ACTIVE is set and serdev exists, serdev->ops will also exist. This conflicts with the existing cros_ec_uart_probe() logic, as it first calls devm_serdev_device_open() (which sets SERPORT_ACTIVE), and only later sets serdev->ops via serdev_device_set_client_ops(). Commit 01f95d42b8f4 ("platform/chrome: cros_ec_uart: fix race condition") attempted to fix a similar race condition, but while doing so, made the window of error for this race condition to happen much wider. Attempt to fix the race condition again, making sure we fully setup before calling devm_serdev_device_open().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix memory leak in hci_req_sync_complete() In 'hci_req_sync_complete()', always free the previous sync request state before assigning reference to a new one.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: virtio_net: Do not send RSS key if it is not supported There is a bug when setting the RSS options in virtio_net that can break the whole machine, getting the kernel into an infinite loop. Running the following command in any QEMU virtual machine with virtionet will reproduce this problem: # ethtool -X eth0 hfunc toeplitz This is how the problem happens: 1) ethtool_set_rxfh() calls virtnet_set_rxfh() 2) virtnet_set_rxfh() calls virtnet_commit_rss_command() 3) virtnet_commit_rss_command() populates 4 entries for the rss scatter-gather 4) Since the command above does not have a key, then the last scatter-gatter entry will be zeroed, since rss_key_size == 0. sg_buf_size = vi->rss_key_size; 5) This buffer is passed to qemu, but qemu is not happy with a buffer with zero length, and do the following in virtqueue_map_desc() (QEMU function): if (!sz) { virtio_error(vdev, "virtio: zero sized buffers are not allowed"); 6) virtio_error() (also QEMU function) set the device as broken vdev->broken = true; 7) Qemu bails out, and do not repond this crazy kernel. 8) The kernel is waiting for the response to come back (function virtnet_send_command()) 9) The kernel is waiting doing the following : while (!virtqueue_get_buf(vi->cvq, &tmp) && !virtqueue_is_broken(vi->cvq)) cpu_relax(); 10) None of the following functions above is true, thus, the kernel loops here forever. Keeping in mind that virtqueue_is_broken() does not look at the qemu `vdev->broken`, so, it never realizes that the vitio is broken at QEMU side. Fix it by not sending RSS commands if the feature is not available in the device.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: batman-adv: Avoid infinite loop trying to resize local TT If the MTU of one of an attached interface becomes too small to transmit the local translation table then it must be resized to fit inside all fragments (when enabled) or a single packet. But if the MTU becomes too low to transmit even the header + the VLAN specific part then the resizing of the local TT will never succeed. This can for example happen when the usable space is 110 bytes and 11 VLANs are on top of batman-adv. In this case, at least 116 byte would be needed. There will just be an endless spam of batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110) in the log but the function will never finish. Problem here is that the timeout will be halved all the time and will then stagnate at 0 and therefore never be able to reduce the table even more. There are other scenarios possible with a similar result. The number of BATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too high to fit inside a packet. Such a scenario can therefore happen also with only a single VLAN + 7 non-purgable addresses - requiring at least 120 bytes. While this should be handled proactively when: * interface with too low MTU is added * VLAN is added * non-purgeable local mac is added * MTU of an attached interface is reduced * fragmentation setting gets disabled (which most likely requires dropping attached interfaces) not all of these scenarios can be prevented because batman-adv is only consuming events without the the possibility to prevent these actions (non-purgable MAC address added, MTU of an attached interface is reduced). It is therefore necessary to also make sure that the code is able to handle also the situations when there were already incompatible system configuration are present.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: fix NULL function pointer dereference Baruch reported an OOPS when using the designware controller as target only. Target-only modes break the assumption of one transfer function always being available. Fix this by always checking the pointer in __i2c_transfer. [wsa: dropped the simplification in core-smbus to avoid theoretical regressions]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered The power_supply frame-work is not really designed for there to be long living in kernel references to power_supply devices. Specifically unregistering a power_supply while some other code has a reference to it triggers a WARN in power_supply_unregister(): WARN_ON(atomic_dec_return(&psy->use_cnt)); Folllowed by the power_supply still getting removed and the backing data freed anyway, leaving the tusb1210 charger-detect code with a dangling reference, resulting in a crash the next time tusb1210_get_online() is called. Fix this by only holding the reference in tusb1210_get_online() freeing it at the end of the function. Note this still leaves a theoretical race window, but it avoids the issue when manually rmmod-ing the charger chip driver during development.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms During the removal of the idxd driver, registered offline callback is invoked as part of the clean up process. However, on systems with only one CPU online, no valid target is available to migrate the perf context, resulting in a kernel oops: BUG: unable to handle page fault for address: 000000000002a2b8 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 1470e1067 P4D 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 20 Comm: cpuhp/0 Not tainted 6.8.0-rc6-dsa+ #57 Hardware name: Intel Corporation AvenueCity/AvenueCity, BIOS BHSDCRB1.86B.2492.D03.2307181620 07/18/2023 RIP: 0010:mutex_lock+0x2e/0x50 ... Call Trace: <TASK> __die+0x24/0x70 page_fault_oops+0x82/0x160 do_user_addr_fault+0x65/0x6b0 __pfx___rdmsr_safe_on_cpu+0x10/0x10 exc_page_fault+0x7d/0x170 asm_exc_page_fault+0x26/0x30 mutex_lock+0x2e/0x50 mutex_lock+0x1e/0x50 perf_pmu_migrate_context+0x87/0x1f0 perf_event_cpu_offline+0x76/0x90 [idxd] cpuhp_invoke_callback+0xa2/0x4f0 __pfx_perf_event_cpu_offline+0x10/0x10 [idxd] cpuhp_thread_fun+0x98/0x150 smpboot_thread_fn+0x27/0x260 smpboot_thread_fn+0x1af/0x260 __pfx_smpboot_thread_fn+0x10/0x10 kthread+0x103/0x140 __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x50 __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 <TASK> Fix the issue by preventing the migration of the perf context to an invalid target.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dma: xilinx_dpdma: Fix locking There are several places where either chan->lock or chan->vchan.lock was not held. Add appropriate locking. This fixes lockdep warnings like [ 31.077578] ------------[ cut here ]------------ [ 31.077831] WARNING: CPU: 2 PID: 40 at drivers/dma/xilinx/xilinx_dpdma.c:834 xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.077953] Modules linked in: [ 31.078019] CPU: 2 PID: 40 Comm: kworker/u12:1 Not tainted 6.6.20+ #98 [ 31.078102] Hardware name: xlnx,zynqmp (DT) [ 31.078169] Workqueue: events_unbound deferred_probe_work_func [ 31.078272] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 31.078377] pc : xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.078473] lr : xilinx_dpdma_chan_queue_transfer+0x270/0x5e0 [ 31.078550] sp : ffffffc083bb2e10 [ 31.078590] x29: ffffffc083bb2e10 x28: 0000000000000000 x27: ffffff880165a168 [ 31.078754] x26: ffffff880164e920 x25: ffffff880164eab8 x24: ffffff880164d480 [ 31.078920] x23: ffffff880165a148 x22: ffffff880164e988 x21: 0000000000000000 [ 31.079132] x20: ffffffc082aa3000 x19: ffffff880164e880 x18: 0000000000000000 [ 31.079295] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 31.079453] x14: 0000000000000000 x13: ffffff8802263dc0 x12: 0000000000000001 [ 31.079613] x11: 0001ffc083bb2e34 x10: 0001ff880164e98f x9 : 0001ffc082aa3def [ 31.079824] x8 : 0001ffc082aa3dec x7 : 0000000000000000 x6 : 0000000000000516 [ 31.079982] x5 : ffffffc7f8d43000 x4 : ffffff88003c9c40 x3 : ffffffffffffffff [ 31.080147] x2 : ffffffc7f8d43000 x1 : 00000000000000c0 x0 : 0000000000000000 [ 31.080307] Call trace: [ 31.080340] xilinx_dpdma_chan_queue_transfer+0x274/0x5e0 [ 31.080518] xilinx_dpdma_issue_pending+0x11c/0x120 [ 31.080595] zynqmp_disp_layer_update+0x180/0x3ac [ 31.080712] zynqmp_dpsub_plane_atomic_update+0x11c/0x21c [ 31.080825] drm_atomic_helper_commit_planes+0x20c/0x684 [ 31.080951] drm_atomic_helper_commit_tail+0x5c/0xb0 [ 31.081139] commit_tail+0x234/0x294 [ 31.081246] drm_atomic_helper_commit+0x1f8/0x210 [ 31.081363] drm_atomic_commit+0x100/0x140 [ 31.081477] drm_client_modeset_commit_atomic+0x318/0x384 [ 31.081634] drm_client_modeset_commit_locked+0x8c/0x24c [ 31.081725] drm_client_modeset_commit+0x34/0x5c [ 31.081812] __drm_fb_helper_restore_fbdev_mode_unlocked+0x104/0x168 [ 31.081899] drm_fb_helper_set_par+0x50/0x70 [ 31.081971] fbcon_init+0x538/0xc48 [ 31.082047] visual_init+0x16c/0x23c [ 31.082207] do_bind_con_driver.isra.0+0x2d0/0x634 [ 31.082320] do_take_over_console+0x24c/0x33c [ 31.082429] do_fbcon_takeover+0xbc/0x1b0 [ 31.082503] fbcon_fb_registered+0x2d0/0x34c [ 31.082663] register_framebuffer+0x27c/0x38c [ 31.082767] __drm_fb_helper_initial_config_and_unlock+0x5c0/0x91c [ 31.082939] drm_fb_helper_initial_config+0x50/0x74 [ 31.083012] drm_fbdev_dma_client_hotplug+0xb8/0x108 [ 31.083115] drm_client_register+0xa0/0xf4 [ 31.083195] drm_fbdev_dma_setup+0xb0/0x1cc [ 31.083293] zynqmp_dpsub_drm_init+0x45c/0x4e0 [ 31.083431] zynqmp_dpsub_probe+0x444/0x5e0 [ 31.083616] platform_probe+0x8c/0x13c [ 31.083713] really_probe+0x258/0x59c [ 31.083793] __driver_probe_device+0xc4/0x224 [ 31.083878] driver_probe_device+0x70/0x1c0 [ 31.083961] __device_attach_driver+0x108/0x1e0 [ 31.084052] bus_for_each_drv+0x9c/0x100 [ 31.084125] __device_attach+0x100/0x298 [ 31.084207] device_initial_probe+0x14/0x20 [ 31.084292] bus_probe_device+0xd8/0xdc [ 31.084368] deferred_probe_work_func+0x11c/0x180 [ 31.084451] process_one_work+0x3ac/0x988 [ 31.084643] worker_thread+0x398/0x694 [ 31.084752] kthread+0x1bc/0x1c0 [ 31.084848] ret_from_fork+0x10/0x20 [ 31.084932] irq event stamp: 64549 [ 31.084970] hardirqs last enabled at (64548): [<ffffffc081adf35c>] _raw_spin_unlock_irqrestore+0x80/0x90 [ 31.085157] ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue drain_workqueue() cannot be called safely in a spinlocked context due to possible task rescheduling. In the multi-task scenario, calling queue_work() while drain_workqueue() will lead to a Call Trace as pushing a work on a draining workqueue is not permitted in spinlocked context. Call Trace: <TASK> ? __warn+0x7d/0x140 ? __queue_work+0x2b2/0x440 ? report_bug+0x1f8/0x200 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x18/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? __queue_work+0x2b2/0x440 queue_work_on+0x28/0x30 idxd_misc_thread+0x303/0x5a0 [idxd] ? __schedule+0x369/0xb40 ? __pfx_irq_thread_fn+0x10/0x10 ? irq_thread+0xbc/0x1b0 irq_thread_fn+0x21/0x70 irq_thread+0x102/0x1b0 ? preempt_count_add+0x74/0xa0 ? __pfx_irq_thread_dtor+0x10/0x10 ? __pfx_irq_thread+0x10/0x10 kthread+0x103/0x140 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 </TASK> The current implementation uses a spinlock to protect event log workqueue and will lead to the Call Trace due to potential task rescheduling. To address the locking issue, convert the spinlock to mutex, allowing the drain_workqueue() to be called in a safe mutex-locked context. This change ensures proper synchronization when accessing the event log workqueue, preventing potential Call Trace and improving the overall robustness of the code.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: phy: marvell: a3700-comphy: Fix out of bounds read There is an out of bounds read access of 'gbe_phy_init_fix[fix_idx].addr' every iteration after 'fix_idx' reaches 'ARRAY_SIZE(gbe_phy_init_fix)'. Make sure 'gbe_phy_init[addr]' is used when all elements of 'gbe_phy_init_fix' array are handled. Found by Linux Verification Center (linuxtesting.org) with SVACE.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Use access_width over bit_width for system memory accesses To align with ACPI 6.3+, since bit_width can be any 8-bit value, it cannot be depended on to be always on a clean 8b boundary. This was uncovered on the Cobalt 100 platform. SError Interrupt on CPU26, code 0xbe000011 -- SError CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted 5.15.2.1-13 #1 Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION pstate: 62400009 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : cppc_get_perf_caps+0xec/0x410 lr : cppc_get_perf_caps+0xe8/0x410 sp : ffff8000155ab730 x29: ffff8000155ab730 x28: ffff0080139d0038 x27: ffff0080139d0078 x26: 0000000000000000 x25: ffff0080139d0058 x24: 00000000ffffffff x23: ffff0080139d0298 x22: ffff0080139d0278 x21: 0000000000000000 x20: ffff00802b251910 x19: ffff0080139d0000 x18: ffffffffffffffff x17: 0000000000000000 x16: ffffdc7e111bad04 x15: ffff00802b251008 x14: ffffffffffffffff x13: ffff013f1fd63300 x12: 0000000000000006 x11: ffffdc7e128f4420 x10: 0000000000000000 x9 : ffffdc7e111badec x8 : ffff00802b251980 x7 : 0000000000000000 x6 : ffff0080139d0028 x5 : 0000000000000000 x4 : ffff0080139d0018 x3 : 00000000ffffffff x2 : 0000000000000008 x1 : ffff8000155ab7a0 x0 : 0000000000000000 Kernel panic - not syncing: Asynchronous SError Interrupt CPU: 26 PID: 1510 Comm: systemd-udevd Not tainted 5.15.2.1-13 #1 Hardware name: MICROSOFT CORPORATION, BIOS MICROSOFT CORPORATION Call trace: dump_backtrace+0x0/0x1e0 show_stack+0x24/0x30 dump_stack_lvl+0x8c/0xb8 dump_stack+0x18/0x34 panic+0x16c/0x384 add_taint+0x0/0xc0 arm64_serror_panic+0x7c/0x90 arm64_is_fatal_ras_serror+0x34/0xa4 do_serror+0x50/0x6c el1h_64_error_handler+0x40/0x74 el1h_64_error+0x7c/0x80 cppc_get_perf_caps+0xec/0x410 cppc_cpufreq_cpu_init+0x74/0x400 [cppc_cpufreq] cpufreq_online+0x2dc/0xa30 cpufreq_add_dev+0xc0/0xd4 subsys_interface_register+0x134/0x14c cpufreq_register_driver+0x1b0/0x354 cppc_cpufreq_init+0x1a8/0x1000 [cppc_cpufreq] do_one_initcall+0x50/0x250 do_init_module+0x60/0x27c load_module+0x2300/0x2570 __do_sys_finit_module+0xa8/0x114 __arm64_sys_finit_module+0x2c/0x3c invoke_syscall+0x78/0x100 el0_svc_common.constprop.0+0x180/0x1a0 do_el0_svc+0x84/0xa0 el0_svc+0x2c/0xc0 el0t_64_sync_handler+0xa4/0x12c el0t_64_sync+0x1a4/0x1a8 Instead, use access_width to determine the size and use the offset and width to shift and mask the bits to read/write out. Make sure to add a check for system memory since pcc redefines the access_width to subspace id. If access_width is not set, then fall back to using bit_width. [ rjw: Subject and changelog edits, comment adjustments ]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up The flag I2C_HID_READ_PENDING is used to serialize I2C operations. However, this is not necessary, because I2C core already has its own locking for that. More importantly, this flag can cause a lock-up: if the flag is set in i2c_hid_xfer() and an interrupt happens, the interrupt handler (i2c_hid_irq) will check this flag and return immediately without doing anything, then the interrupt handler will be invoked again in an infinite loop. Since interrupt handler is an RT task, it takes over the CPU and the flag-clearing task never gets scheduled, thus we have a lock-up. Delete this unnecessary flag.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: smb3: missing lock when picking channel Coverity spotted a place where we should have been holding the channel lock when accessing the ses channel index. Addresses-Coverity: 1582039 ("Data race condition (MISSING_LOCK)")


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpll_pin_on_pin_register() for multiple parent pins In scenario where pin is registered with multiple parent pins via dpll_pin_on_pin_register(..), all belonging to the same dpll device. A second call to dpll_pin_on_pin_unregister(..) would cause a call trace, as it tries to use already released registration resources (due to fix introduced in b446631f355e). In this scenario pin was registered twice, so resources are not yet expected to be release until each registered pin/pin pair is unregistered. Currently, the following crash/call trace is produced when ice driver is removed on the system with installed E810T NIC which includes dpll device: WARNING: CPU: 51 PID: 9155 at drivers/dpll/dpll_core.c:809 dpll_pin_ops+0x20/0x30 RIP: 0010:dpll_pin_ops+0x20/0x30 Call Trace: ? __warn+0x7f/0x130 ? dpll_pin_ops+0x20/0x30 dpll_msg_add_pin_freq+0x37/0x1d0 dpll_cmd_pin_get_one+0x1c0/0x400 ? __nlmsg_put+0x63/0x80 dpll_pin_event_send+0x93/0x140 dpll_pin_on_pin_unregister+0x3f/0x100 ice_dpll_deinit_pins+0xa1/0x230 [ice] ice_remove+0xf1/0x210 [ice] Fix by adding a parent pointer as a cookie when creating a registration, also when searching for it. For the regular pins pass NULL, this allows to create separated registration for each parent the pin is registered with.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage Both the function that migrates all the chunks within a region and the function that migrates all the entries within a chunk call list_first_entry() on the respective lists without checking that the lists are not empty. This is incorrect usage of the API, which leads to the following warning [1]. Fix by returning if the lists are empty as there is nothing to migrate in this case. [1] WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0> Modules linked in: CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 [...] Call Trace: <TASK> mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 ret_from_fork_asm+0x1a/0x30 </TASK>


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix warning during rehash As previously explained, the rehash delayed work migrates filters from one region to another. This is done by iterating over all chunks (all the filters with the same priority) in the region and in each chunk iterating over all the filters. When the work runs out of credits it stores the current chunk and entry as markers in the per-work context so that it would know where to resume the migration from the next time the work is scheduled. Upon error, the chunk marker is reset to NULL, but without resetting the entry markers despite being relative to it. This can result in migration being resumed from an entry that does not belong to the chunk being migrated. In turn, this will eventually lead to a chunk being iterated over as if it is an entry. Because of how the two structures happen to be defined, this does not lead to KASAN splats, but to warnings such as [1]. Fix by creating a helper that resets all the markers and call it from all the places the currently only reset the chunk marker. For good measures also call it when starting a completely new rehash. Add a warning to avoid future cases. [1] WARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0 Modules linked in: CPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G W 6.9.0-rc3-custom-00880-g29e61d91b77b #29 Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work RIP: 0010:mlxsw_afk_encode+0x242/0x2f0 [...] Call Trace: <TASK> mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0 mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290 mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470 process_one_work+0x151/0x370 worker_thread+0x2cb/0x3e0 kthread+0xd0/0x100 ret_from_fork+0x34/0x50 </TASK>


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ax25: Fix netdev refcount issue The dev_tracker is added to ax25_cb in ax25_bind(). When the ax25 device is detaching, the dev_tracker of ax25_cb should be deallocated in ax25_kill_by_device() instead of the dev_tracker of ax25_dev. The log reported by ref_tracker is shown below: [ 80.884935] ref_tracker: reference already released. [ 80.885150] ref_tracker: allocated in: [ 80.885349] ax25_dev_device_up+0x105/0x540 [ 80.885730] ax25_device_event+0xa4/0x420 [ 80.885730] notifier_call_chain+0xc9/0x1e0 [ 80.885730] __dev_notify_flags+0x138/0x280 [ 80.885730] dev_change_flags+0xd7/0x180 [ 80.885730] dev_ifsioc+0x6a9/0xa30 [ 80.885730] dev_ioctl+0x4d8/0xd90 [ 80.885730] sock_do_ioctl+0x1c2/0x2d0 [ 80.885730] sock_ioctl+0x38b/0x4f0 [ 80.885730] __se_sys_ioctl+0xad/0xf0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 80.885730] ref_tracker: freed in: [ 80.885730] ax25_device_event+0x272/0x420 [ 80.885730] notifier_call_chain+0xc9/0x1e0 [ 80.885730] dev_close_many+0x272/0x370 [ 80.885730] unregister_netdevice_many_notify+0x3b5/0x1180 [ 80.885730] unregister_netdev+0xcf/0x120 [ 80.885730] sixpack_close+0x11f/0x1b0 [ 80.885730] tty_ldisc_kill+0xcb/0x190 [ 80.885730] tty_ldisc_hangup+0x338/0x3d0 [ 80.885730] __tty_hangup+0x504/0x740 [ 80.885730] tty_release+0x46e/0xd80 [ 80.885730] __fput+0x37f/0x770 [ 80.885730] __x64_sys_close+0x7b/0xb0 [ 80.885730] do_syscall_64+0xc4/0x1b0 [ 80.885730] entry_SYSCALL_64_after_hwframe+0x67/0x6f [ 80.893739] ------------[ cut here ]------------ [ 80.894030] WARNING: CPU: 2 PID: 140 at lib/ref_tracker.c:255 ref_tracker_free+0x47b/0x6b0 [ 80.894297] Modules linked in: [ 80.894929] CPU: 2 PID: 140 Comm: ax25_conn_rel_6 Not tainted 6.9.0-rc4-g8cd26fd90c1a #11 [ 80.895190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qem4 [ 80.895514] RIP: 0010:ref_tracker_free+0x47b/0x6b0 [ 80.895808] Code: 83 c5 18 4c 89 eb 48 c1 eb 03 8a 04 13 84 c0 0f 85 df 01 00 00 41 83 7d 00 00 75 4b 4c 89 ff 9 [ 80.896171] RSP: 0018:ffff888009edf8c0 EFLAGS: 00000286 [ 80.896339] RAX: 1ffff1100141ac00 RBX: 1ffff1100149463b RCX: dffffc0000000000 [ 80.896502] RDX: 0000000000000001 RSI: 0000000000000246 RDI: ffff88800a0d6518 [ 80.896925] RBP: ffff888009edf9b0 R08: ffff88806d3288d3 R09: 1ffff1100da6511a [ 80.897212] R10: dffffc0000000000 R11: ffffed100da6511b R12: ffff88800a4a31d4 [ 80.897859] R13: ffff88800a4a31d8 R14: dffffc0000000000 R15: ffff88800a0d6518 [ 80.898279] FS: 00007fd88b7fe700(0000) GS:ffff88806d300000(0000) knlGS:0000000000000000 [ 80.899436] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.900181] CR2: 00007fd88c001d48 CR3: 000000000993e000 CR4: 00000000000006f0 ... [ 80.935774] ref_tracker: sp%d@000000000bb9df3d has 1/1 users at [ 80.935774] ax25_bind+0x424/0x4e0 [ 80.935774] __sys_bind+0x1d9/0x270 [ 80.935774] __x64_sys_bind+0x75/0x80 [ 80.935774] do_syscall_64+0xc4/0x1b0 [ 80.935774] entry_SYSCALL_64_after_hwframe+0x67/0x6f Change ax25_dev->dev_tracker to the dev_tracker of ax25_cb in order to mitigate the bug.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Fix potential null-ptr-deref Fix potential null-ptr-deref in hci_le_big_sync_established_evt().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: fix slab-use-after-free in msft_do_close() Tying the msft->data lifetime to hdev by freeing it in hci_release_dev() to fix the following case: [use] msft_do_close() msft = hdev->msft_data; if (!msft) ...(1) <- passed. return; mutex_lock(&msft->filter_lock); ...(4) <- used after freed. [free] msft_unregister() msft = hdev->msft_data; hdev->msft_data = NULL; ...(2) kfree(msft); ...(3) <- msft is freed. ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() Extend a critical section to prevent chan from early freeing. Also make the l2cap_connect() return type void. Nothing is using the returned value but it is ugly to return a potentially freed pointer. Making it void will help with backports because earlier kernels did use the return value. Now the compile will break for kernels where this patch is not a complete fix. Call stack summary: [use] l2cap_bredr_sig_cmd l2cap_connect mutex_lock(&conn->chan_lock); | chan = pchan->ops->new_connection(pchan); <- alloc chan | __l2cap_chan_add(conn, chan); | l2cap_chan_hold(chan); | list_add(&chan->list, &conn->chan_l); ... (1) mutex_unlock(&conn->chan_lock); chan->conf_state ... (4) <- use after free [free] l2cap_conn_del mutex_lock(&conn->chan_lock); | foreach chan in conn->chan_l: ... (2) | l2cap_chan_put(chan); | l2cap_chan_destroy | kfree(chan) ... (3) <- chan freed mutex_unlock(&conn->chan_lock); ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: slab-use-after-free in l2cap_connect+0xa67/0x11a0 net/bluetooth/l2cap_core.c:4260 Read of size 8 at addr ffff88810bf040a0 by task kworker/u3:1/311


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/arm/malidp: fix a possible null pointer dereference In malidp_mw_connector_reset, new memory is allocated with kzalloc, but no check is performed. In order to prevent null pointer dereferencing, ensure that mw_state is checked before calling __drm_atomic_helper_connector_reset.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in register_device In register_device, the return value of ida_simple_get is unchecked, in witch ida_simple_get will use an invalid index value. To address this issue, index should be checked after ida_simple_get. When the index value is abnormal, a warning message should be printed, the port should be dropped, and the value should be recorded.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() Assuming the following: - side A configures the n_gsm in basic option mode - side B sends the header of a basic option mode frame with data length 1 - side A switches to advanced option mode - side B sends 2 data bytes which exceeds gsm->len Reason: gsm->len is not used in advanced option mode. - side A switches to basic option mode - side B keeps sending until gsm0_receive() writes past gsm->buf Reason: Neither gsm->state nor gsm->len have been reset after reconfiguration. Fix this by changing gsm->count to gsm->len comparison from equal to less than. Also add upper limit checks against the constant MAX_MRU in gsm0_receive() and gsm1_receive() to harden against memory corruption of gsm->len and gsm->mru. All other checks remain as we still need to limit the data according to the user configuration and actual payload size.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: nouveau/uvmm: fix addr/range calcs for remap operations dEQP-VK.sparse_resources.image_rebind.2d_array.r64i.128_128_8 was causing a remap operation like the below. op_remap: prev: 0000003fffed0000 00000000000f0000 00000000a5abd18a 0000000000000000 op_remap: next: op_remap: unmap: 0000003fffed0000 0000000000100000 0 op_map: map: 0000003ffffc0000 0000000000010000 000000005b1ba33c 00000000000e0000 This was resulting in an unmap operation from 0x3fffed0000+0xf0000, 0x100000 which was corrupting the pagetables and oopsing the kernel. Fixes the prev + unmap range calcs to use start/end and map back to addr/range.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: regmap: maple: Fix cache corruption in regcache_maple_drop() When keeping the upper end of a cache block entry, the entry[] array must be indexed by the offset from the base register of the block, i.e. max - mas.index. The code was indexing entry[] by only the register address, leading to an out-of-bounds access that copied some part of the kernel memory over the cache contents. This bug was not detected by the regmap KUnit test because it only tests with a block of registers starting at 0, so mas.index == 0.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: i40e: fix vf may be used uninitialized in this function warning To fix the regression introduced by commit 52424f974bc5, which causes servers hang in very hard to reproduce conditions with resets races. Using two sources for the information is the root cause. In this function before the fix bumping v didn't mean bumping vf pointer. But the code used this variables interchangeably, so stale vf could point to different/not intended vf. Remove redundant "v" variable and iterate via single VF pointer across whole function instead to guarantee VF pointer validity.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when devlink reload during pf initialization The devlink reload process will access the hardware resources, but the register operation is done before the hardware is initialized. So, processing the devlink reload during initialization may lead to kernel crash. This patch fixes this by taking devl_lock during initialization.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() The app_reply->elem[] array is allocated earlier in this function and it has app_req.num_ports elements. Thus this > comparison needs to be >= to prevent memory corruption.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 While doing multiple S4 stress tests, GC/RLC/PMFW get into an invalid state resulting into hard hangs. Adding a GFX reset as workaround just before sending the MP1_UNLOAD message avoids this failure.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-msm: pervent access to suspended controller Generic sdhci code registers LED device and uses host->runtime_suspended flag to protect access to it. The sdhci-msm driver doesn't set this flag, which causes a crash when LED is accessed while controller is runtime suspended. Fix this by setting the flag correctly.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix the double free in rvu_npc_freemem() Clang static checker(scan-build) warning: drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c:line 2184, column 2 Attempt to free released memory. npc_mcam_rsrcs_deinit() has released 'mcam->counters.bmap'. Deleted this redundant kfree() to fix this double free problem.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix info leak when fetching fw build id Add the missing sanity checks and move the 255-byte build-id buffer off the stack to avoid leaking stack data through debugfs in case the build-info reply is malformed.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: add missing firmware sanity checks Add the missing sanity checks when parsing the firmware files before downloading them to avoid accessing and corrupting memory beyond the vmalloced buffer.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: mm/slab: make __free(kfree) accept error pointers Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831x_gpio_dbg_show(). 171 char *label __free(kfree) = gpiochip_dup_line_label(chip, i); 172 if (IS_ERR(label)) { 173 dev_err(wm831x->dev, "Failed to duplicate label\n"); 174 continue; 175 } The auto clean up function should check for error pointers as well, otherwise we're going to keep hitting issues like this.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix mas_empty_area_rev() null pointer dereference Currently the code calls mas_start() followed by mas_data_end() if the maple state is MA_START, but mas_start() may return with the maple state node == NULL. This will lead to a null pointer dereference when checking information in the NULL node, which is done in mas_data_end(). Avoid setting the offset if there is no node by waiting until after the maple state is checked for an empty or single entry state. A user could trigger the events to cause a kernel oops by unmapping all vmas to produce an empty maple tree, then mapping a vma that would cause the scenario described above.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Check for port partner validity before consuming it typec_register_partner() does not guarantee partner registration to always succeed. In the event of failure, port->partner is set to the error value or NULL. Given that port->partner validity is not checked, this results in the following crash: Unable to handle kernel NULL pointer dereference at virtual address xx pc : run_state_machine+0x1bc8/0x1c08 lr : run_state_machine+0x1b90/0x1c08 .. Call trace: run_state_machine+0x1bc8/0x1c08 tcpm_state_machine_work+0x94/0xe4 kthread_worker_fn+0x118/0x328 kthread+0x1d0/0x23c ret_from_fork+0x10/0x20 To prevent the crash, check for port->partner validity before derefencing it in all the call sites.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete FFS based applications can utilize the aio_cancel() callback to dequeue pending USB requests submitted to the UDC. There is a scenario where the FFS application issues an AIO cancel call, while the UDC is handling a soft disconnect. For a DWC3 based implementation, the callstack looks like the following: DWC3 Gadget FFS Application dwc3_gadget_soft_disconnect() ... --> dwc3_stop_active_transfers() --> dwc3_gadget_giveback(-ESHUTDOWN) --> ffs_epfile_async_io_complete() ffs_aio_cancel() --> usb_ep_free_request() --> usb_ep_dequeue() There is currently no locking implemented between the AIO completion handler and AIO cancel, so the issue occurs if the completion routine is running in parallel to an AIO cancel call coming from the FFS application. As the completion call frees the USB request (io_data->req) the FFS application is also referencing it for the usb_ep_dequeue() call. This can lead to accessing a stale/hanging pointer. commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently") relocated the usb_ep_free_request() into ffs_epfile_async_io_complete(). However, in order to properly implement locking to mitigate this issue, the spinlock can't be added to ffs_epfile_async_io_complete(), as usb_ep_dequeue() (if successfully dequeuing a USB request) will call the function driver's completion handler in the same context. Hence, leading into a deadlock. Fix this issue by moving the usb_ep_free_request() back to ffs_user_copy_worker(), and ensuring that it explicitly sets io_data->req to NULL after freeing it within the ffs->eps_lock. This resolves the race condition above, as the ffs_aio_cancel() routine will not continue attempting to dequeue a request that has already been freed, or the ffs_user_copy_work() not freeing the USB request until the AIO cancel is done referencing it. This fix depends on commit b566d38857fc ("usb: gadget: f_fs: use io_data->status consistently")


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: use correct buffer size when parsing configfs lists This commit fixes uvc gadget support on 32-bit platforms. Commit 0df28607c5cb ("usb: gadget: uvc: Generalise helper functions for reuse") introduced a helper function __uvcg_iter_item_entries() to aid with parsing lists of items on configfs attributes stores. This function is a generalization of another very similar function, which used a stack-allocated temporary buffer of fixed size for each item in the list and used the sizeof() operator to check for potential buffer overruns. The new function was changed to allocate the now variably sized temp buffer on heap, but wasn't properly updated to also check for max buffer size using the computed size instead of sizeof() operator. As a result, the maximum item size was 7 (plus null terminator) on 64-bit platforms, and 3 on 32-bit ones. While 7 is accidentally just barely enough, 3 is definitely too small for some of UVC configfs attributes. For example, dwFrameInteval, specified in 100ns units, usually has 6-digit item values, e.g. 166666 for 60fps.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in port.c:disable_store(): usb_hub_to_struct_hub() can return NULL if the hub that the port belongs to is concurrently removed, but the function does not check for this possibility before dereferencing the returned value. It turns out that the first dereference is unnecessary, since hub->intfdev is the parent of the port device, so it can be changed easily. Adding a check for hub == NULL prevents further problems. The same bug exists in the disable_show() routine, and it can be fixed the same way.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Atom Integrated System Info v2_2 for DCN35 New request from KMD/VBIOS in order to support new UMA carveout model. This fixes a null dereference from accessing Ctx->dc_bios->integrated_info while it was NULL. DAL parses through the BIOS and extracts the necessary integrated_info but was missing a case for the new BIOS version 2.3.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix uninitialised kfifo If a line is requested with debounce, and that results in debouncing in software, and the line is subsequently reconfigured to enable edge detection then the allocation of the kfifo to contain edge events is overlooked. This results in events being written to and read from an uninitialised kfifo. Read events are returned to userspace. Initialise the kfifo in the case where the software debounce is already active.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ARM: 9381/1: kasan: clear stale stack poison We found below OOB crash: [ 33.452494] ================================================================== [ 33.453513] BUG: KASAN: stack-out-of-bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.454660] Write of size 164 at addr c1d03d30 by task swapper/0/0 [ 33.455515] [ 33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.1.25-mainline #1 [ 33.456880] Hardware name: Generic DT based system [ 33.457555] unwind_backtrace from show_stack+0x18/0x1c [ 33.458326] show_stack from dump_stack_lvl+0x40/0x4c [ 33.459072] dump_stack_lvl from print_report+0x158/0x4a4 [ 33.459863] print_report from kasan_report+0x9c/0x148 [ 33.460616] kasan_report from kasan_check_range+0x94/0x1a0 [ 33.461424] kasan_check_range from memset+0x20/0x3c [ 33.462157] memset from refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec [ 33.463064] refresh_cpu_vm_stats.constprop.0 from tick_nohz_idle_stop_tick+0x180/0x53c [ 33.464181] tick_nohz_idle_stop_tick from do_idle+0x264/0x354 [ 33.465029] do_idle from cpu_startup_entry+0x20/0x24 [ 33.465769] cpu_startup_entry from rest_init+0xf0/0xf4 [ 33.466528] rest_init from arch_post_acpi_subsys_init+0x0/0x18 [ 33.467397] [ 33.467644] The buggy address belongs to stack of task swapper/0/0 [ 33.468493] and is located at offset 112 in frame: [ 33.469172] refresh_cpu_vm_stats.constprop.0+0x0/0x2ec [ 33.469917] [ 33.470165] This frame has 2 objects: [ 33.470696] [32, 76) 'global_zone_diff' [ 33.470729] [112, 276) 'global_node_diff' [ 33.471294] [ 33.472095] The buggy address belongs to the physical page: [ 33.472862] page:3cd72da8 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x41d03 [ 33.473944] flags: 0x1000(reserved|zone=0) [ 33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000 00000000 ffffffff 00000001 [ 33.475656] raw: 00000000 [ 33.476050] page dumped because: kasan: bad access detected [ 33.476816] [ 33.477061] Memory state around the buggy address: [ 33.477732] c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.478630] c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 [ 33.479526] >c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1 f1 f1 [ 33.480415] ^ [ 33.481195] c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3 [ 33.482088] c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 [ 33.482978] ================================================================== We find the root cause of this OOB is that arm does not clear stale stack poison in the case of cpuidle. This patch refer to arch/arm64/kernel/sleep.S to resolve this issue. From cited commit [1] that explain the problem Functions which the compiler has instrumented for KASAN place poison on the stack shadow upon entry and remove this poison prior to returning. In the case of cpuidle, CPUs exit the kernel a number of levels deep in C code. Any instrumented functions on this critical path will leave portions of the stack shadow poisoned. If CPUs lose context and return to the kernel via a cold path, we restore a prior context saved in __cpu_suspend_enter are forgotten, and we never remove the poison they placed in the stack shadow area by functions calls between this and the actual exit of the kernel. Thus, (depending on stackframe layout) subsequent calls to instrumented functions may hit this stale poison, resulting in (spurious) KASAN splats to the console. To avoid this, clear any stale poison from the idle thread for a CPU prior to bringing a CPU online. From cited commit [2] Extend to check for CONFIG_KASAN_STACK [1] commit 0d97e6d8024c ("arm64: kasan: clear stale stack poison") [2] commit d56a9ef84bd0 ("kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK")


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: bpf: Check bloom filter map value size This patch adds a missing check to bloom filter creating, rejecting values above KMALLOC_MAX_SIZE. This brings the bloom map in line with many other map types. The lack of this protection can cause kernel crashes for value sizes that overflow int's. Such a crash was caught by syzkaller. The next patch adds more guard-rails at a lower level.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: guard against invalid STA ID on removal Guard against invalid station IDs in iwl_mvm_mld_rm_sta_id as that would result in out-of-bounds array accesses. This prevents issues should the driver get into a bad state during error handling.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq->read_ptr under lock If we read txq->read_ptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but crucially reclaim the same entry twice, resulting in the WARN_ONCE() a little later. Fix that by reading txq->read_ptr under lock.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Fix kernel panic after setting hsuid Symptom: When the hsuid attribute is set for the first time on an IQD Layer3 device while the corresponding network interface is already UP, the kernel will try to execute a napi function pointer that is NULL. Example: --------------------------------------------------------------------------- [ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP [ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de s_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod qdio ccwgroup pkey zcrypt [ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1 [ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR) [ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2) [ 2057.572748] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000 [ 2057.572754] 00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80 [ 2057.572756] 000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8 [ 2057.572758] 00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68 [ 2057.572762] Krnl Code:#0000000000000000: 0000 illegal >0000000000000002: 0000 illegal 0000000000000004: 0000 illegal 0000000000000006: 0000 illegal 0000000000000008: 0000 illegal 000000000000000a: 0000 illegal 000000000000000c: 0000 illegal 000000000000000e: 0000 illegal [ 2057.572800] Call Trace: [ 2057.572801] ([<00000000ec639700>] 0xec639700) [ 2057.572803] [<00000000913183e2>] net_rx_action+0x2ba/0x398 [ 2057.572809] [<0000000091515f76>] __do_softirq+0x11e/0x3a0 [ 2057.572813] [<0000000090ce160c>] do_softirq_own_stack+0x3c/0x58 [ 2057.572817] ([<0000000090d2cbd6>] do_softirq.part.1+0x56/0x60) [ 2057.572822] [<0000000090d2cc60>] __local_bh_enable_ip+0x80/0x98 [ 2057.572825] [<0000000091314706>] __dev_queue_xmit+0x2be/0xd70 [ 2057.572827] [<000003ff803dd6d6>] afiucv_hs_send+0x24e/0x300 [af_iucv] [ 2057.572830] [<000003ff803dd88a>] iucv_send_ctrl+0x102/0x138 [af_iucv] [ 2057.572833] [<000003ff803de72a>] iucv_sock_connect+0x37a/0x468 [af_iucv] [ 2057.572835] [<00000000912e7e90>] __sys_connect+0xa0/0xd8 [ 2057.572839] [<00000000912e9580>] sys_socketcall+0x228/0x348 [ 2057.572841] [<0000000091514e1a>] system_call+0x2a6/0x2c8 [ 2057.572843] Last Breaking-Event-Address: [ 2057.572844] [<0000000091317e44>] __napi_poll+0x4c/0x1d8 [ 2057.572846] [ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt ------------------------------------------------------------------------------------------- Analysis: There is one napi structure per out_q: card->qdio.out_qs[i].napi The napi.poll functions are set during qeth_open(). Since commit 1cfef80d4c2b ("s390/qeth: Don't call dev_close/dev_open (DOWN/UP)") qeth_set_offline()/qeth_set_online() no longer call dev_close()/ dev_open(). So if qeth_free_qdio_queues() cleared card->qdio.out_qs[i].napi.poll while the network interface was UP and the card was offline, they are not set again. Reproduction: chzdev -e $devno layer2=0 ip link set dev $network_interface up echo 0 > /sys/bus/ccw ---truncated---


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: spi: fix null pointer dereference within spi_sync If spi_sync() is called with the non-empty queue and the same spi_message is then reused, the complete callback for the message remains set while the context is cleared, leading to a null pointer dereference when the callback is invoked from spi_finalize_current_message(). With function inlining disabled, the call stack might look like this: _raw_spin_lock_irqsave from complete_with_flags+0x18/0x58 complete_with_flags from spi_complete+0x8/0xc spi_complete from spi_finalize_current_message+0xec/0x184 spi_finalize_current_message from spi_transfer_one_message+0x2a8/0x474 spi_transfer_one_message from __spi_pump_transfer_message+0x104/0x230 __spi_pump_transfer_message from __spi_transfer_message_noqueue+0x30/0xc4 __spi_transfer_message_noqueue from __spi_sync+0x204/0x248 __spi_sync from spi_sync+0x24/0x3c spi_sync from mcp251xfd_regmap_crc_read+0x124/0x28c [mcp251xfd] mcp251xfd_regmap_crc_read [mcp251xfd] from _regmap_raw_read+0xf8/0x154 _regmap_raw_read from _regmap_bus_read+0x44/0x70 _regmap_bus_read from _regmap_read+0x60/0xd8 _regmap_read from regmap_read+0x3c/0x5c regmap_read from mcp251xfd_alloc_can_err_skb+0x1c/0x54 [mcp251xfd] mcp251xfd_alloc_can_err_skb [mcp251xfd] from mcp251xfd_irq+0x194/0xe70 [mcp251xfd] mcp251xfd_irq [mcp251xfd] from irq_thread_fn+0x1c/0x78 irq_thread_fn from irq_thread+0x118/0x1f4 irq_thread from kthread+0xd8/0xf4 kthread from ret_from_fork+0x14/0x28 Fix this by also setting message->complete to NULL when the transfer is complete.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Ensure the copied buf is NUL terminated Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from userspace to that buffer. Later, we use scanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using scanf. Fix this issue by using memdup_user_nul instead.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: efi/unaccepted: touch soft lockup during memory accept Commit 50e782a86c98 ("efi/unaccepted: Fix soft lockups caused by parallel memory acceptance") has released the spinlock so other CPUs can do memory acceptance in parallel and not triggers softlockup on other CPUs. However the softlock up was intermittent shown up if the memory of the TD guest is large, and the timeout of softlockup is set to 1 second: RIP: 0010:_raw_spin_unlock_irqrestore Call Trace: ? __hrtimer_run_queues <IRQ> ? hrtimer_interrupt ? watchdog_timer_fn ? __sysvec_apic_timer_interrupt ? __pfx_watchdog_timer_fn ? sysvec_apic_timer_interrupt </IRQ> ? __hrtimer_run_queues <TASK> ? hrtimer_interrupt ? asm_sysvec_apic_timer_interrupt ? _raw_spin_unlock_irqrestore ? __sysvec_apic_timer_interrupt ? sysvec_apic_timer_interrupt accept_memory try_to_accept_memory do_huge_pmd_anonymous_page get_page_from_freelist __handle_mm_fault __alloc_pages __folio_alloc ? __tdx_hypercall handle_mm_fault vma_alloc_folio do_user_addr_fault do_huge_pmd_anonymous_page exc_page_fault ? __do_huge_pmd_anonymous_page asm_exc_page_fault __handle_mm_fault When the local irq is enabled at the end of accept_memory(), the softlockup detects that the watchdog on single CPU has not been fed for a while. That is to say, even other CPUs will not be blocked by spinlock, the current CPU might be stunk with local irq disabled for a while, which hurts not only nmi watchdog but also softlockup. Chao Gao pointed out that the memory accept could be time costly and there was similar report before. Thus to avoid any softlocup detection during this stage, give the softlockup a flag to skip the timeout check at the end of accept_memory(), by invoking touch_softlockup_watchdog().


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL coalescing rule If the parsing fails, we can dereference a NULL pointer here.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: Reapply "drm/qxl: simplify qxl_fence_wait" This reverts commit 07ed11afb68d94eadd4ffc082b97c2331307c5ea. Stephen Rostedt reports: "I went to run my tests on my VMs and the tests hung on boot up. Unfortunately, the most I ever got out was: [ 93.607888] Testing event system initcall: OK [ 93.667730] Running tests on all trace events: [ 93.669757] Testing all events: OK [ 95.631064] ------------[ cut here ]------------ Timed out after 60 seconds" and further debugging points to a possible circular locking dependency between the console_owner locking and the worker pool locking. Reverting the commit allows Steve's VM to boot to completion again. [ This may obviously result in the "[TTM] Buffer eviction failed" messages again, which was the reason for that original revert. But at this point this seems preferable to a non-booting system... ]


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: qibfs: fix dentry leak simple_recursive_removal() drops the pinning references to all positives in subtree. For the cases when its argument has been kept alive by the pinning alone that's exactly the right thing to do, but here the argument comes from dcache lookup, that needs to be balanced by explicit dput(). Fucked-up-by: Al Viro <viro@zeniv.linux.org.uk>


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd: sync all devices to wait all processes being evicted If there are more than one device doing reset in parallel, the first device will call kfd_suspend_all_processes() to evict all processes on all devices, this call takes time to finish. other device will start reset and recover without waiting. if the process has not been evicted before doing recover, it will be restored, then caused page fault.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: firewire: ohci: mask bus reset interrupts between ISR and bottom half In the FireWire OHCI interrupt handler, if a bus reset interrupt has occurred, mask bus reset interrupts until bus_reset_work has serviced and cleared the interrupt. Normally, we always leave bus reset interrupts masked. We infer the bus reset from the self-ID interrupt that happens shortly thereafter. A scenario where we unmask bus reset interrupts was introduced in 2008 in a007bb857e0b26f5d8b73c2ff90782d9c0972620: If OHCI_PARAM_DEBUG_BUSRESETS (8) is set in the debug parameter bitmask, we will unmask bus reset interrupts so we can log them. irq_handler logs the bus reset interrupt. However, we can't clear the bus reset event flag in irq_handler, because we won't service the event until later. irq_handler exits with the event flag still set. If the corresponding interrupt is still unmasked, the first bus reset will usually freeze the system due to irq_handler being called again each time it exits. This freeze can be reproduced by loading firewire_ohci with "modprobe firewire_ohci debug=-1" (to enable all debugging output). Apparently there are also some cases where bus_reset_work will get called soon enough to clear the event, and operation will continue normally. This freeze was first reported a few months after a007bb85 was committed, but until now it was never fixed. The debug level could safely be set to -1 through sysfs after the module was loaded, but this would be ineffectual in logging bus reset interrupts since they were only unmasked during initialization. irq_handler will now leave the event flag set but mask bus reset interrupts, so irq_handler won't be called again and there will be no freeze. If OHCI_PARAM_DEBUG_BUSRESETS is enabled, bus_reset_work will unmask the interrupt after servicing the event, so future interrupts will be caught as desired. As a side effect to this change, OHCI_PARAM_DEBUG_BUSRESETS can now be enabled through sysfs in addition to during initial module loading. However, when enabled through sysfs, logging of bus reset interrupts will be effective only starting with the second bus reset, after bus_reset_work has executed.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: range check cp bad op exception interrupts Due to a CP interrupt bug, bad packet garbage exception codes are raised. Do a range check so that the debugger and runtime do not receive garbage codes. Update the user api to guard exception code type checking as well.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() The documentation for device_get_named_child_node() mentions this important point: " The caller is responsible for calling fwnode_handle_put() on the returned fwnode pointer. " Add fwnode_handle_put() to avoid a leaked reference.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки

Описание

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.


Затронутые продукты
Image SLES15-SP6-Azure-Basic:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-Azure-Standard:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC-Azure:kernel-azure-6.4.0-150600.8.5.4
Image SLES15-SP6-HPC:kernel-azure-6.4.0-150600.8.5.4

Ссылки
Уязвимость SUSE-SU-2024:2135-1