[lts8 6] Multiple VULNs #656

roxanan1996 · 2025-10-30T13:14:53Z

DESCRIPTION

Clean cherry-picks.

Note: If you check the diff between the commits with a bigger context (-W)
you may notice a few differences:

Small diff for commit

633a5c21986ad080594f937f17ca744f30a26135 RDMA/irdma: Fix a window for use-after-free

due to missing commit, but not relevant to this CVE.

81091d7696ae71627ff80bbf2c6b0986d2c1cce3 "RDMA/irdma: Add SW mechanism to generate completions on error"

A bigger one in multiple functions, caused by multiple missing commits

mptcp: do not queue data on closed subflows

in net/mptcp/protocol.c. This has suffered for multiple bug fixes and
refactors, but not relevant for this CVE fix.

COMMITS

drm/amd/display: clear optc underflow before turn off odm clock

jira VULN-69260
cve CVE-2022-49969
commit-author Fudong Wang <Fudong.Wang@amd.com>
commit b2a93490201300a749ad261b5c5d05cb50179c44

bpf: Don't use tnum_range on array range checking for poke descriptors

jira VULN-136650
cve CVE-2022-49985
commit-author Daniel Borkmann <daniel@iogearbox.net>
commit a657182a5c5150cdfacb6640aad1d2712571a409

mptcp: do not queue data on closed subflows

jira VULN-70531
cve CVE-2022-50070
commit-author Paolo Abeni <pabeni@redhat.com>
commit c886d70286bf3ad411eb3d689328a67f7102c6ae

RDMA/irdma: Fix a window for use-after-free

jira VULN-70164
cve CVE-2022-50137
commit-author Mustafa Ismail <mustafa.ismail@intel.com>
commit 8ecef7890b3aea78c8bbb501a4b5b8134367b821

md-raid10: fix KASAN warning

jira VULN-69558
cve CVE-2022-50211
commit-author Mikulas Patocka <mpatocka@redhat.com>
commit d17f744e883b2f8d13cca252d71cfe8ace346f7d

KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0

jira VULN-70723
cve CVE-2022-50228
commit-author Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
commit f17c31c48e5cde9895a491d91c424eeeada3e134

ALSA: bcd2000: Fix a UAF bug on the error path of probing

jira VULN-70295
cve CVE-2022-50229
commit-author Zheyu Ma <zheyuma97@gmail.com>
commit ffb2759df7efbc00187bfd9d1072434a13a54139

net: usb: smsc75xx: Limit packet length to skb->len

jira VULN-67484
cve CVE-2023-53125
commit-author Szymon Heidrich <szymon.heidrich@gmail.com>
commit d8b228318935044dafe3a5bc07ee71a1f1424b8d

net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull

jira VULN-67484
cve-bf CVE-2023-53125
commit-author Szymon Heidrich <szymon.heidrich@gmail.com>
commit 43ffe6caccc7a1bb9d7442fbab521efbf6c1378c

TESTING

BUILD

> grep -E -B 5 -A 5 '\[TIMER\]|^Starting Build' /home/rnicolescu/ciq/test/kernels/lts-8.6/kernel-build-after.log
  CLEAN   scripts/selinux/genheaders
  CLEAN   scripts/selinux/mdp
  CLEAN   scripts
  CLEAN   include/config usr/include include/generated arch/x86/include/generated
  CLEAN   .config .config.old .version Module.symvers
[TIMER]{MRPROPER}: 7s
x86_64 architecture detected, copying config
'configs/kernel-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-rnicolescu_ciqlts8_6-2791bc61984d"
Making olddefconfig
--
  HOSTLD  scripts/kconfig/conf
scripts/kconfig/conf  --olddefconfig Kconfig
#
# configuration written to .config
#
Starting Build
scripts/kconfig/conf  --syncconfig Kconfig
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_64_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_64.h
--
  LD [M]  sound/usb/usx2y/snd-usb-usx2y.ko
  LD [M]  sound/virtio/virtio_snd.ko
  LD [M]  sound/x86/snd-hdmi-lpe-audio.ko
  LD [M]  sound/xen/snd_xen_front.ko
  LD [M]  virt/lib/irqbypass.ko
[TIMER]{BUILD}: 1423s
Making Modules
  INSTALL arch/x86/crypto/blowfish-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL arch/x86/crypto/camellia-x86_64.ko
  INSTALL arch/x86/crypto/camellia-aesni-avx2.ko
--
  INSTALL sound/virtio/virtio_snd.ko
  INSTALL sound/x86/snd-hdmi-lpe-audio.ko
  INSTALL sound/xen/snd_xen_front.ko
  INSTALL virt/lib/irqbypass.ko
  DEPMOD  4.18.0-rnicolescu_ciqlts8_6-2791bc61984d+
[TIMER]{MODULES}: 9s
Making Install
sh ./arch/x86/boot/install.sh 4.18.0-rnicolescu_ciqlts8_6-2791bc61984d+ arch/x86/boot/bzImage \
	System.map "/boot"
[TIMER]{INSTALL}: 15s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6-2791bc61984d+ and Index to 0
The default is /boot/loader/entries/7e5cd69bee8142e1b454bdcee9748400-4.18.0-rnicolescu_ciqlts8_6-2791bc61984d+.conf with index 0 and kernel /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6-2791bc61984d+
The default is /boot/loader/entries/7e5cd69bee8142e1b454bdcee9748400-4.18.0-rnicolescu_ciqlts8_6-2791bc61984d+.conf with index 0 and kernel /boot/vmlinuz-4.18.0-rnicolescu_ciqlts8_6-2791bc61984d+
Generating grub configuration file ...
done
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 7s
[TIMER]{BUILD}: 1423s
[TIMER]{MODULES}: 9s
[TIMER]{INSTALL}: 15s
[TIMER]{TOTAL} 1460s
Rebooting in 10 seconds

kernel-build-before.log
kernel-build-after.log

Kselftests

> /home/rnicolescu/ciq/kernel-tools/kselftest-diff.sh /home/rnicolescu/ciq/test/kernels/lts-8.6
/home/rnicolescu/ciq/test/kernels/lts-8.6/kselftest-before.log
192
/home/rnicolescu/ciq/test/kernels/lts-8.6/kselftest-after.log
192
Before: /home/rnicolescu/ciq/test/kernels/lts-8.6/kselftest-before.log
After: /home/rnicolescu/ciq/test/kernels/lts-8.6/kselftest-after.log
Diff:
No differences found.

kselftest-before.log
kselftest-after.log

Check_kernel_commits including interdiff

> /home/rnicolescu/ciq/kernel-src-tree-tools/check_kernel_commits.py --repo /home/rnicolescu/ciq/test/kernels/lts-8.6/kernel-src-tree --pr_branch {rnicolescu}/ciqlts8_6 --base_branch origin/ciqlts8_6
------------------
interdiff result:
No diff between 576a86855b753adb63b172a462a88f69ddc12a86 b2a93490201300a749ad261b5c5d05cb50179c44
------------------
interdiff result:
No diff between 17d0416768d1fcc47b60a5caf6683fdcf51df185 a657182a5c5150cdfacb6640aad1d2712571a409
------------------
interdiff result:
No diff between 63b16060412e32a05645c8b8707c1ac5b76468eb c886d70286bf3ad411eb3d689328a67f7102c6ae
------------------
interdiff result:
No diff between 7723f95e7edb460aa054ebaa0003eb2a4cda9c38 8ecef7890b3aea78c8bbb501a4b5b8134367b821
------------------
interdiff result:
No diff between b5de7da8459f7568f9a7f6a549618801a2f8655d d17f744e883b2f8d13cca252d71cfe8ace346f7d
------------------
interdiff result:
No diff between 3e3f3d70903bce3ed4bcb5bccc11da5ba620a24e f17c31c48e5cde9895a491d91c424eeeada3e134
------------------
interdiff result:
No diff between fda64b37f46a9977e81c609f26841857cf0e2a76 ffb2759df7efbc00187bfd9d1072434a13a54139
------------------
interdiff result:
No diff between f35a88cdbcff1e189c181b986e7f98626a4f0598 d8b228318935044dafe3a5bc07ee71a1f1424b8d
------------------
interdiff result:
No diff between 2791bc61984d9eaac7f5b4195cac778d3266f2b3 43ffe6caccc7a1bb9d7442fbab521efbf6c1378c
All referenced commits exist upstream and have no Fixes: tags.

jira VULN-69260 cve CVE-2022-49969 commit-author Fudong Wang <Fudong.Wang@amd.com> commit b2a9349 [Why] After ODM clock off, optc underflow bit will be kept there always and clear not work. We need to clear that before clock off. [How] Clear that if have when clock off. Reviewed-by: Alvin Lee <alvin.lee2@amd.com> Acked-by: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Fudong Wang <Fudong.Wang@amd.com> Tested-by: Daniel Wheeler <daniel.wheeler@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b2a9349) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com> Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

jira VULN-136650 cve CVE-2022-49985 commit-author Daniel Borkmann <daniel@iogearbox.net> commit a657182 Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which is based on a customized syzkaller: BUG: KASAN: slab-out-of-bounds in bpf_int_jit_compile+0x1257/0x13f0 Read of size 8 at addr ffff888004e90b58 by task syz-executor.0/1489 CPU: 1 PID: 1489 Comm: syz-executor.0 Not tainted 5.19.0 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x9c/0xc9 print_address_description.constprop.0+0x1f/0x1f0 ? bpf_int_jit_compile+0x1257/0x13f0 kasan_report.cold+0xeb/0x197 ? kvmalloc_node+0x170/0x200 ? bpf_int_jit_compile+0x1257/0x13f0 bpf_int_jit_compile+0x1257/0x13f0 ? arch_prepare_bpf_dispatcher+0xd0/0xd0 ? rcu_read_lock_sched_held+0x43/0x70 bpf_prog_select_runtime+0x3e8/0x640 ? bpf_obj_name_cpy+0x149/0x1b0 bpf_prog_load+0x102f/0x2220 ? __bpf_prog_put.constprop.0+0x220/0x220 ? find_held_lock+0x2c/0x110 ? __might_fault+0xd6/0x180 ? lock_downgrade+0x6e0/0x6e0 ? lock_is_held_type+0xa6/0x120 ? __might_fault+0x147/0x180 __sys_bpf+0x137b/0x6070 ? bpf_perf_link_attach+0x530/0x530 ? new_sync_read+0x600/0x600 ? __fget_files+0x255/0x450 ? lock_downgrade+0x6e0/0x6e0 ? fput+0x30/0x1a0 ? ksys_write+0x1a8/0x260 __x64_sys_bpf+0x7a/0xc0 ? syscall_enter_from_user_mode+0x21/0x70 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f917c4e2c2d The problem here is that a range of tnum_range(0, map->max_entries - 1) has limited ability to represent the concrete tight range with the tnum as the set of resulting states from value + mask can result in a superset of the actual intended range, and as such a tnum_in(range, reg->var_off) check may yield true when it shouldn't, for example tnum_range(0, 2) would result in 00XX -> v = 0000, m = 0011 such that the intended set of {0, 1, 2} is here represented by a less precise superset of {0, 1, 2, 3}. As the register is known const scalar, really just use the concrete reg->var_off.value for the upper index check. Fixes: d2e4c1e ("bpf: Constant map key tracking for prog array pokes") Reported-by: Hsin-Wei Hung <hsinweih@uci.edu> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Cc: Shung-Hsi Yu <shung-hsi.yu@suse.com> Acked-by: John Fastabend <john.fastabend@gmail.com> Link: https://lore.kernel.org/r/984b37f9fdf7ac36831d2137415a4a915744c1b6.1661462653.git.daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast@kernel.org> (cherry picked from commit a657182) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com> Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

jira VULN-70531 cve CVE-2022-50070 commit-author Paolo Abeni <pabeni@redhat.com> commit c886d70 Dipanjan reported a syzbot splat at close time: WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153 inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153 Modules linked in: uio_ivshmem(OE) uio(E) CPU: 1 PID: 10818 Comm: kworker/1:16 Tainted: G OE 5.19.0-rc6-g2eae0556bb9d #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_inet.c:153 Code: 21 02 00 00 41 8b 9c 24 28 02 00 00 e9 07 ff ff ff e8 34 4d 91 f9 89 ee 4c 89 e7 e8 4a 47 60 ff e9 a6 fc ff ff e8 20 4d 91 f9 <0f> 0b e9 84 fe ff ff e8 14 4d 91 f9 0f 0b e9 d4 fd ff ff e8 08 4d RSP: 0018:ffffc9001b35fa78 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002879d0 RCX: ffff8881326f3b00 RDX: 0000000000000000 RSI: ffff8881326f3b00 RDI: 0000000000000002 RBP: ffff888179662674 R08: ffffffff87e983a0 R09: 0000000000000000 R10: 0000000000000005 R11: 00000000000004ea R12: ffff888179662400 R13: ffff888179662428 R14: 0000000000000001 R15: ffff88817e38e258 FS: 0000000000000000(0000) GS:ffff8881f5f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020007bc0 CR3: 0000000179592000 CR4: 0000000000150ee0 Call Trace: <TASK> __sk_destruct+0x4f/0x8e0 net/core/sock.c:2067 sk_destruct+0xbd/0xe0 net/core/sock.c:2112 __sk_free+0xef/0x3d0 net/core/sock.c:2123 sk_free+0x78/0xa0 net/core/sock.c:2134 sock_put include/net/sock.h:1927 [inline] __mptcp_close_ssk+0x50f/0x780 net/mptcp/protocol.c:2351 __mptcp_destroy_sock+0x332/0x760 net/mptcp/protocol.c:2828 mptcp_worker+0x5d2/0xc90 net/mptcp/protocol.c:2586 process_one_work+0x9cc/0x1650 kernel/workqueue.c:2289 worker_thread+0x623/0x1070 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> The root cause of the problem is that an mptcp-level (re)transmit can race with mptcp_close() and the packet scheduler checks the subflow state before acquiring the socket lock: we can try to (re)transmit on an already closed ssk. Fix the issue checking again the subflow socket status under the subflow socket lock protection. Additionally add the missing check for the fallback-to-tcp case. Fixes: d5f4919 ("mptcp: allow picking different xmit subflows") Reported-by: Dipanjan Das <mail.dipanjan.das@gmail.com> Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit c886d70) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com> Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

jira VULN-70164 cve CVE-2022-50137 commit-author Mustafa Ismail <mustafa.ismail@intel.com> commit 8ecef78 During a destroy CQ an interrupt may cause processing of a CQE after CQ resources are freed by irdma_cq_free_rsrc(). Fix this by moving the call to irdma_cq_free_rsrc() after the irdma_sc_cleanup_ceqes(), which is called under the cq_lock. Fixes: b48c24c ("RDMA/irdma: Implement device supported verb APIs") Link: https://lore.kernel.org/r/20220705230815.265-6-shiraz.saleem@intel.com Signed-off-by: Bartosz Sobczak <bartosz.sobczak@intel.com> Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com> Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com> Signed-off-by: Leon Romanovsky <leon@kernel.org> (cherry picked from commit 8ecef78) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com> Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

jira VULN-69558 cve CVE-2022-50211 commit-author Mikulas Patocka <mpatocka@redhat.com> commit d17f744 There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is valid. BUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10] Read of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682 CPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x45/0x57a ? __lock_text_start+0x18/0x18 ? raid10_remove_disk+0x61/0x2a0 [raid10] kasan_report+0xa8/0xe0 ? raid10_remove_disk+0x61/0x2a0 [raid10] raid10_remove_disk+0x61/0x2a0 [raid10] Buffer I/O error on dev dm-76, logical block 15344, async page read ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0 remove_and_add_spares+0x367/0x8a0 [md_mod] ? super_written+0x1c0/0x1c0 [md_mod] ? mutex_trylock+0xac/0x120 ? _raw_spin_lock+0x72/0xc0 ? _raw_spin_lock_bh+0xc0/0xc0 md_check_recovery+0x848/0x960 [md_mod] raid10d+0xcf/0x3360 [raid10] ? sched_clock_cpu+0x185/0x1a0 ? rb_erase+0x4d4/0x620 ? var_wake_function+0xe0/0xe0 ? psi_group_change+0x411/0x500 ? preempt_count_sub+0xf/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? raid10_sync_request+0x36c0/0x36c0 [raid10] ? preempt_count_sub+0xf/0xc0 ? _raw_spin_unlock_irqrestore+0x19/0x40 ? del_timer_sync+0xa9/0x100 ? try_to_del_timer_sync+0xc0/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? _raw_spin_unlock_irq+0x11/0x24 ? __list_del_entry_valid+0x68/0xa0 ? finish_wait+0xa3/0x100 md_thread+0x161/0x260 [md_mod] ? unregister_md_personality+0xa0/0xa0 [md_mod] ? _raw_spin_lock_irqsave+0x78/0xc0 ? prepare_to_wait_event+0x2c0/0x2c0 ? unregister_md_personality+0xa0/0xa0 [md_mod] kthread+0x148/0x180 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 124495: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x80/0xa0 setup_conf+0x140/0x5c0 [raid10] raid10_run+0x4cd/0x740 [raid10] md_run+0x6f9/0x1300 [md_mod] raid_ctr+0x2531/0x4ac0 [dm_raid] dm_table_add_target+0x2b0/0x620 [dm_mod] table_load+0x1c8/0x400 [dm_mod] ctl_ioctl+0x29e/0x560 [dm_mod] dm_compat_ctl_ioctl+0x7/0x20 [dm_mod] __do_compat_sys_ioctl+0xfa/0x160 do_syscall_64+0x90/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 L __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff889108f3d200 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff889108f3d200, ffff889108f3d300) The buggy address belongs to the physical page: page:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c head:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=2) raw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff889108f3d280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff889108f3d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff889108f3d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff889108f3d400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Song Liu <song@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> (cherry picked from commit d17f744) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com> Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

jira VULN-70723 cve CVE-2022-50228 commit-author Maciej S. Szmigiero <maciej.szmigiero@oracle.com> commit f17c31c Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct for KVM internally generated injections). kernel BUG at arch/x86/kvm/svm/svm.c:3386! invalid opcode: 0000 [#1] SMP CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd] Code: <0f> 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53 RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810a234ac0 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffffc90000b37df7 RDI: ffff88810a234ac0 RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000 FS: 0000000001821380(0000) GS:ffff88846fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4: 0000000000350ea0 Call Trace: <TASK> inject_pending_event+0x2f7/0x4c0 [kvm] kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm] kvm_vcpu_ioctl+0x26d/0x650 [kvm] __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> Fixes: 219b65d ("KVM: SVM: Improve nested interrupt injection") Cc: stable@vger.kernel.org Co-developed-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com> Message-Id: <35426af6e123cbe91ec7ce5132ce72521f02b1b5.1651440202.git.maciej.szmigiero@oracle.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit f17c31c) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com> Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

jira VULN-70295 cve CVE-2022-50229 commit-author Zheyu Ma <zheyuma97@gmail.com> commit ffb2759 When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug. The following log can reveal it: [ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] Fix this by adding usb_kill_urb() before usb_free_urb(). Fixes: b47a222 ("ALSA: MIDI driver for Behringer BCD2000 USB device") Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220715010515.2087925-1-zheyuma97@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de> (cherry picked from commit ffb2759) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com> Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

jira VULN-67484 cve CVE-2023-53125 commit-author Szymon Heidrich <szymon.heidrich@gmail.com> commit d8b2283 Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026 bytes). In such case the cloned skb passed up the network stack will leak kernel memory contents. Fixes: d0cad87 ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> (cherry picked from commit d8b2283) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com> Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

bmastbergen

cve-bpf CVE-2023-53125 ?

…in skb_pull jira VULN-67484 cve-bf CVE-2023-53125 commit-author Szymon Heidrich <szymon.heidrich@gmail.com> commit 43ffe6c Packet length check needs to be located after size and align_count calculation to prevent kernel panic in skb_pull() in case rx_cmd_a & RX_CMD_A_RED evaluates to true. Fixes: d8b2283 ("net: usb: smsc75xx: Limit packet length to skb->len") Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com> Link: https://lore.kernel.org/r/20230316110540.77531-1-szymon.heidrich@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 43ffe6c) Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com> Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>

roxanan1996 · 2025-10-30T15:35:08Z

cve-bpf CVE-2023-53125 ?

typo..I had the impression the check-commit script will check for this. Will add it.
I fixed the commit, but I did not test again, not worth it.

Thanks for catching this.

PlaidCat

bmastbergen

🥌

roxanan1996 added 8 commits October 30, 2025 13:22

roxanan1996 requested a review from a team October 30, 2025 13:50

bmastbergen reviewed Oct 30, 2025

View reviewed changes

roxanan1996 force-pushed the {rnicolescu}/ciqlts8_6 branch from 2791bc6 to c0b982b Compare October 30, 2025 15:34

roxanan1996 requested a review from bmastbergen October 30, 2025 15:35

roxanan1996 self-assigned this Oct 30, 2025

PlaidCat approved these changes Oct 30, 2025

View reviewed changes

bmastbergen approved these changes Oct 31, 2025

View reviewed changes

roxanan1996 merged commit 60be944 into ciqlts8_6 Oct 31, 2025
3 checks passed

roxanan1996 deleted the {rnicolescu}/ciqlts8_6 branch October 31, 2025 16:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[lts8 6] Multiple VULNs #656

[lts8 6] Multiple VULNs #656

Uh oh!

roxanan1996 commented Oct 30, 2025 •

edited

Loading

Uh oh!

bmastbergen left a comment

Uh oh!

roxanan1996 commented Oct 30, 2025

Uh oh!

PlaidCat left a comment

Uh oh!

bmastbergen left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

[lts8 6] Multiple VULNs #656

[lts8 6] Multiple VULNs #656

Uh oh!

Conversation

roxanan1996 commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DESCRIPTION

COMMITS

TESTING

BUILD

Kselftests

Check_kernel_commits including interdiff

Uh oh!

bmastbergen left a comment

Choose a reason for hiding this comment

Uh oh!

roxanan1996 commented Oct 30, 2025

Uh oh!

PlaidCat left a comment

Choose a reason for hiding this comment

Uh oh!

bmastbergen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

roxanan1996 commented Oct 30, 2025 •

edited

Loading