CVE-2021-47044 sched/fair: Fix shift-out-of-bounds in load_balance()

In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix shift-out-of-bounds in loadbalance Syzbot reported a handful of occurrences where an sd-nrbalancefailed can grow to much higher values than one would expect. A successful loadbalance resets it to 0; a failed one...

CVE-2021-47043 media: venus: core: Fix some resource leaks in the error path of 'venus_probe()'

In the Linux kernel, the following vulnerability has been resolved: media: venus: core: Fix some resource leaks in the error path of 'venusprobe' If an error occurs after a successful 'oficcget' call, it must be undone. Use 'devmoficcget' instead of 'oficcget' to avoid the leak. Update the remove...

CVE-2021-47024

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: free queued packets when closing socket As reported by syzbot 1, there is a memory leak while closing the socket. We partially solved this issue with commit ac03046ece2b "vsock/virtio: free packets during the socket...

CVE-2021-47019 mt76: mt7921: fix possible invalid register access

In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix possible invalid register access Disable the interrupt and synchronze for the pending irq handlers to ensure the irq tasklet is not being scheduled after the suspend to avoid the possible invalid register access...

CVE-2021-47010 net: Only allow init netns to set default tcp cong to a restricted algo

In the Linux kernel, the following vulnerability has been resolved: net: Only allow init netns to set default tcp cong to a restricted algo tcpsetdefaultcongestioncontrol is netns-safe in that it writes to &net-ipv4.tcpcongestioncontrol, but it also sets ca-flags |= TCPCONGNONRESTRICTED which is...

CVE-2021-47007 f2fs: fix panic during f2fs_resize_fs()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix panic during f2fsresizefs f2fsresizefs hangs in below callstack with testcase: - mkfs 16GB image & mount image - dd 8GB fileA - dd 8GB fileB - sync - rm fileA - sync - resize filesystem to 8GB kernel BUG at...

CVE-2021-46995 can: mcp251xfd: mcp251xfd_probe(): fix an error pointer dereference in probe

In the Linux kernel, the following vulnerability has been resolved: can: mcp251xfd: mcp251xfdprobe: fix an error pointer dereference in probe When we converted this code to use deverrprobe we accidentally removed a return. It means that if devmclkget it will lead to an Oops when we call clkgetrat...

CVE-2021-46983 nvmet-rdma: Fix NULL deref when SEND is completed with error

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: Fix NULL deref when SEND is completed with error When running some traffic and taking down the link on peer, a retry counter exceeded error is received. This leads to nvmetrdmaerrorcomp which tried accessing the...

CVE-2021-46983 nvmet-rdma: Fix NULL deref when SEND is completed with error

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: Fix NULL deref when SEND is completed with error When running some traffic and taking down the link on peer, a retry counter exceeded error is received. This leads to nvmetrdmaerrorcomp which tried accessing the...

CVE-2021-46984 kyber: fix out of bounds access when preempted

In the Linux kernel, the following vulnerability has been resolved: kyber: fix out of bounds access when preempted blkmqschedbiomerge gets the ctx and hctx for the current CPU and passes the hctx to -biomerge. kyberbiomerge then gets the ctx for the current CPU again and uses that to get the...

CVE-2021-46979

In the Linux kernel, the following vulnerability has been resolved: iio: core: fix ioctl handlers removal Currently ioctl handlers are removed twice. For the first time during iiodeviceunregister then later on inside iiodeviceunregistereventset and iiobuffersfreesysfsandmask. Double free leads to...

CVE-2020-36784 i2c: cadence: fix reference leak when pm_runtime_get_sync fails

In the Linux kernel, the following vulnerability has been resolved: i2c: cadence: fix reference leak when pmruntimegetsync fails The PM reference count is not expected to be incremented on return in functions cdnsi2cmasterxfer and cdnsregslave. However, pmruntimegetsync will increment pm usage...

CVE-2020-36779 i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails

In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: fix reference leak when pmruntimegetsync fails The PM reference count is not expected to be incremented on return in these stm32f7i2cxx serious functions. However, pmruntimegetsync will increment the PM reference...

CVE-2021-46942

In the Linux kernel, the following vulnerability has been resolved: iouring: fix shared sqpoll cancellation hangs 736.982891 INFO: task iou-sqp-4294:4295 blocked for more than 122 seconds. 736.982897 Call Trace: 736.982901 schedule+0x68/0xe0 736.982903 iouringcancelsqpoll+0xdb/0x110 736.982908...

CVE-2021-46914

A flaw was found in the Linux kernel, in unbalanced device enable/disable in suspend/resume. This may cause a crash...

CVE-2021-46940

In the Linux kernel, the following vulnerability has been resolved: tools/power turbostat: Fix offset overflow issue in index converting The idxtooffset function returns type int 32-bit signed, but MSRPKGENERGYSTAT is u32 and would be interpreted as a negative number. The end result is that it hi...

CVE-2021-46963 scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash in qla2xxxmqueuecommand RIP: 0010:kmemcachefree+0xfa/0x1b0 Call Trace: qla2xxxmqueuecommand+0x2b5/0x2c0 qla2xxx scsiqueuerq+0x5e2/0xa40 blkmqtryissuedirectly+0x128/0x1d0 blkmqrequestissuedirectly+0x4e/0xb...

CVE-2021-46957 riscv/kprobe: fix kernel panic when invoking sys_read traced by kprobe

In the Linux kernel, the following vulnerability has been resolved: riscv/kprobe: fix kernel panic when invoking sysread traced by kprobe The execution of sysread end up hitting a BUGON in findgetblock after installing kprobe at sysread, the BUG message like the following: 65.708663 ------------...

CVE-2021-46957 riscv/kprobe: fix kernel panic when invoking sys_read traced by kprobe

In the Linux kernel, the following vulnerability has been resolved: riscv/kprobe: fix kernel panic when invoking sysread traced by kprobe The execution of sysread end up hitting a BUGON in findgetblock after installing kprobe at sysread, the BUG message like the following: 65.708663 ------------...

CVE-2021-46954 net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets

In the Linux kernel, the following vulnerability has been resolved: net/sched: schfrag: fix stack OOB read while fragmenting IPv4 packets when 'actmirred' tries to fragment IPv4 packets that had been previously re-assembled using 'actct', splats like the following can be observed on kernels built...