dropmonitor: fix size calculations for 64-bit attributes

In the Linux kernel, the following vulnerability has been resolved:

Input: socbuttonarray - check btnsdesc->package.count

Check that btnsdesc->package.count is not 0 before accessing btnsdesc->package.elements[0].

drm/gud: fix out-of-bounds write in gudplaneatomiccheck()

hwmon: (pmbus/core) increase number of phases and add new mask

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: require a full expif record in PDRINTERFACELIST

The PDRINTERFACELIST loop only checks that the record start is within the entry before reading an entire struct expif from it. A truncated trailing record makes the ifid/variant reads cross the entry boundary into the heap beyond the EEPROM buffer (verified with a KASAN reproducer of the loop). The variant also feeds the synth front-end selection, so this is not only a leak.

Advance only while a full record still fits in the entry.

In the Linux kernel, the following vulnerability has been resolved:

wifi: p54: validate curve data length in the calibration curve converters

p54convertrev0() and p54convertrev1() read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry, so an entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer (verified with a KASAN reproducer of the conversion loop). The sibling converters p54convertoutputlimits() and p54convertdb() already validate their counts against the entry length; this path was missed.

Reject the entry when the counts do not fit in the entry data.

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length

mwifiexsearchouiinie() reads a pairwise-cipher (PTK) count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs, comparing each with memcmp(). The count comes straight from the (attacker-supplied) IE and is never checked against the element's own length, and the callers admit the element on elementid alone (hasieeehdr() / hasvendorhdr(), no length check). A crafted RSN/WPA IE with a large pairwise count therefore makes the walk read up to 255 4 bytes past the element -- an out-of-bounds read of the kmemdup()'d beacon buffer, reachable from any AP whose beacon/probe response is processed during scan-result parsing.

Pass the number of IE bytes available at the OUI list and bound the walk to the element. Keep the length signed and reject a negative value before any unsigned arithmetic, so a small or zero IE length cannot underflow to a large sizet and defeat the bound.

Found by 0sec automated security-research tooling (https://0sec.ai).

In the Linux kernel, the following vulnerability has been resolved:

wifi: wlcore: release runtime PM ref on regdomain config failure

wlcoreregdomainconfig() gets a runtime PM reference before sending the regulatory-domain command. When wlcorecmdregdomainconfiglocked() fails, the function queues recovery and returns without dropping that reference.

Release the reference after handling the command result so both success and failure paths balance the preceding pmruntimeresumeandget(). The recovery worker takes a separate runtime PM reference and cannot release the reference held here.

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix reparse buffer bounds in cifsqueryreparsepoint()

In cifsqueryreparsepoint(), the start >= end check before casting to struct reparsedatabuffer only ensures the start pointer is within the response. It fails to verify that there is enough space remaining for the fixed 8-byte header of the structure.

If a server provides a DataOffset that leaves less than 8 bytes remaining, the check passes, but subsequent reads of ReparseTag and ReparseDataLength will occur out-of-bounds.

Fix this by ensuring the remaining space is at least the size of the reparsedatabuffer structure before accessing its fields.

In the Linux kernel, the following vulnerability has been resolved:

smb: client: fix smbdconnection leak on cifsgettcpsession() error

When an RDMA connection is successfully established via smbdgetconnection() but cifsgettcpsession() later fails (e.g. kthreadcreate() returns an error), the error path frees tcpses without first destroying the smbdconnection.

Fix this by calling smbddestroy() in the outerr cleanup path before kfree(tcpses). smbddestroy() safely handles the case where smbdconn is NULL, so it can be called unconditionally.

In the Linux kernel, the following vulnerability has been resolved:

Input: cyttsp5 - clamp the HID report size before memcpy

The size field comes from the device and is used as the memcpy() length into responsebuf, which is CYMAXINPUT bytes.

In the Linux kernel, the following vulnerability has been resolved:

net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb()

The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst[] only has room for NICDEVMAX (21) entries. t7xxccmnirecvskb() indexes the array without a bounds check, so indexes 21 to 31 read past it. The out-of-bounds value lands in the callback table that follows the array, which is never NULL, so the existing !ccmni check does not catch it and the driver dereferences whatever sits there as a struct t7xxccmni.

Drop the skb when the index is out of range.

Verified in a QEMU guest with a fault injector setting the netif index to 25: the unpatched driver reads a value past ccmniinst[], which lands in the callback table, and dereferences it far enough to queue the skb. With this check the packet is dropped. Well-formed traffic on index 0 is unaffected.

Changes in v2: none.

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Validate MODE SENSE lengths in scsicdlenable()

scsicdlenable() uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its mode header and block descriptors. The unsigned subtraction used for the MODE SELECT length can wrap, and the separately computed bufdata can point beyond buf.

During automatic scan, enable is false, so the read-modify-write of bufdata[4] can clear the low two bits of a target-selected out-of-bounds stack byte. scsimodeselect() can then copy up to 64 bytes from outside the buffer into the outgoing MODE SELECT payload, disclosing stack contents to the target.

This is reachable while scanning a USB storage device that identifies as an ATA device and advertises CDL support. No filesystem mount or userspace access to the block device is required.

On upstream commit cee9395acd80 ("Linux 7.3-rc1"), a build-specific, one-vCPU QEMU/Raw Gadget proof using QEMU-only multi-UDC allocator sampling executed a fixed proof command inside the guest and created a UID-0-owned marker during automatic enumeration, with KASLR and NX enabled.

The issue was independently found during security research at Drivesec S.r.l.

Cap the available length to the buffer size. Validate and consume the mode header and block descriptor lengths before using the page, and require the five bytes needed to access the CDL field.

In the Linux kernel, the following vulnerability has been resolved:

mmc: spi: reset bytesxfered before retrying CRC failures

mmcspidatado() updates data->bytesxfered after each block has been transferred successfully. If a later block in the same data request fails with a CRC error, data->bytesxfered may therefore contain the number of bytes completed before the failing block.

mmcspirequest() has a private recovery path for such CRC failures. It sends STOPTRANSMISSION, clears data->error and jumps back to crcrecover to issue the same command and data request again. However, it does not clear data->bytesxfered before the retry.

If the retry succeeds, the request is completed with the bytes from the failed attempt still included in data->bytesxfered. For a multi-block request this can make the completed request report more bytes than were transferred by the successful retry, and can even exceed the request size when most blocks completed before the CRC error.

This is most likely to be observed on MMC-over-SPI systems where long multi-block transfers occasionally hit a data CRC error but the mmcspi-internal retry succeeds. The data itself is retried, but the completion accounting is not.

Clear data->bytesxfered together with data->error before repeating the request so the final completion reports only the bytes transferred by the successful attempt.

arm64: hibernate: pass HVCSETVECTORS args to the resume hvc

In the Linux kernel, the following vulnerability has been resolved:

net/packet: clear RX owner on VNET header error

Commit 61fad6816fc1 ("net/packet: tpacketrcv: avoid a producer race condition") added rxownermap and made tpacketrcv() claim a V1 or V2 ring slot before converting the virtio-net header. If the conversion fails, the drop path leaves the slot claimed.

With a one-frame TPACKETV2 ring, an unsupported UDP GSO packet leaves the only slot unavailable, so the ring also drops the next valid packet.

Clear the ownership bit on this error path. TPACKETV3 already clears its block state here.

IB/mlx4: Fix use-after-free on pkey sysfs registration failure

In the Linux kernel, the following vulnerability has been resolved:

selinux: preserve user SID across nested backing files

SELinux saves the user file SID in a backing-file security blob so it remains available after mmap() replaces vma->vmfile with a backing file.

For nested backing files (overlayfs over overlayfs, or FUSE passthrough backed by overlayfs), userfile may itself be a backing file. Its fsec->sid is the SID of the mounter that opened it, rather than the user that opened the top-level file. mprotect() then checks fd { use } against the mounter SID. This can incorrectly deny access without a domain transition, or check the wrong target SID after one.

Copy the saved user SID when userfile is a backing file. Keep using the regular file SID for the first backing layer.

With two nested overlayfs mounts and SELinux enforcing, mprotect(PROTREAD) returns EACCES with an fd { use } denial against the mounter SID. With this change, mprotect() succeeds.

Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built SELinux policy. The original test was also repeated with Fedora Cloud Base 44 userspace and gave the same result.

In the Linux kernel, the following vulnerability has been resolved:

mmc: hsq: Fix use-after-free in retry work

mmchsqpumprequests() queues retrywork when requestatomic() returns -EBUSY; today sdhci-sprd is the only consumer that implements requestatomic(). The work is embedded in a devm-allocated mmchsq, but is never cancelled during driver removal. Work still pending at unbind can therefore run after the devm allocation has been released and dereference hsq->mmc and hsq->mrq.

Use devmworkautocancel() to cancel and drain retrywork before the devm allocation is released. By the time devres cleanup begins, mmcremovehost() has already stopped the host, so no new requests can arm the work.

This issue was found by an in-house static analysis tool.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: fix refcount bug in iwpmgetnlmsgrequest()

iwpmgetnlmsgrequest() initializes refcount after listaddtail() making it accessible to global list where another CPU can krefget() on nlmsgrequest causing a refcount "addition on 0" bug. Fix this by initializing kref before listaddtail() so refcount for nlmsgrequest can be incremented/decremented normally. In addition, also initialize every field before listaddtail().

In the Linux kernel, the following vulnerability has been resolved:

selinux: recheck intermediate backing files on mprotect()

mprotect() can be used to bypass the SELinux checks that mmap() performs against the intermediate layers of a stacked filesystem.

mmap() checks every backing layer as the request descends through the stack. mprotect() only has the lowest backing file in vma->vmfile, so it rechecks the top-level user and the lowest mounter, but skips the mounters of every layer in between. With two nested overlayfs mounts and a policy denying mountert -> middlefilet:file { execute }, a direct mmap(PROTEXEC) is denied:

avc: denied { execute } for pid=71 comm="nestedexec" path="/payload" dev="overlay" ino=9 scontext=useru:baser:mountert tcontext=useru:objectr:middlefilet tclass=file permissive=0

while mmap(PROTNONE) followed by mprotect(PROTEXEC) succeeds.

Preserve each intermediate path, mounter SID and file-description SID in the backing-file security blob, copying the saved entries when another backing layer is opened. Allocate the array only for nested backing files, and release it and the path references in the backingfilefree hook.

During mprotect(), recheck fd { use } and the requested inode permissions for every saved mounter, and include the intermediate layers in the execmod checks. Policy for nested stacking may then need to grant intermediate mounters what a direct mmap() already requires, and execmod on intermediate labels for binaries using text relocations.

Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built SELinux policy, on a mainline tree containing commit f2381b546e7e ("fs: fix user path of nested backing files").

[PM: subject tweak]

In the Linux kernel, the following vulnerability has been resolved:

mmc: sdhci-of-aspeed: Remove children before releasing SDC resources

Probe failure and removal leave SDHCI child devices registered after the parent clock and managed resources are released.

Unregister the OF children in reverse order before disabling the parent clock on both paths. Use ofplatformdevicedestroy() because manual child creation does not set the flag required by ofplatformdepopulate().

This issue was identified during our ongoing static-analysis research while reviewing kernel code.

In the Linux kernel, the following vulnerability has been resolved:

openvswitch: avoid reallocating confirmed conntrack labels

ovsctgetconnlabels() adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate and free the extension block while another CPU accesses it.

Only add the extension for unconfirmed conntracks. A confirmed conntrack without labels now fails the caller's label operation instead of reallocating its extension storage.

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix tpm2loadcmd() boundary check

tpm2loadcmd() does boundary checks against the ASN.1 size i.e., payload->bloblen. Address this by passing the decoded blob size to tpm2loadcmd(), and use it for the boundary checks.

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ucma: Serialize join and leave on copytouser failure

rdmajoinmulticast() queues RoCE work that later reads the ucmamulticast through event->param.ud.privatedata, then listadd()s the CMA multicast at the head of idpriv->mclist. rdmaleavemulticast() matches only by sockaddr and destroys the first hit.

ucmaprocessjoin() used to drop ctx->mutex after a successful join and retake it only if copytouser() failed. Two concurrent JOINMCAST calls with the same address can therefore insert a second CMA entry before the first thread's leave. leave then cancels the newer work and the older worker still dereferences the ucmamulticast that the first thread frees.

Keep ctx->mutex held from rdmajoinmulticast() through copytouser() and, on -EFAULT, through rdmaleavemulticast() so leave cannot miss this join. Do not leave if join itself failed: that path never published this address on mclist, and a leave-by-addr would destroy an earlier successful join.

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mst: move switchdev call outside rcu

This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate() calls switchdevportattrset() for nonzero MSTIs while holding rcureadlock() which invokes the blocking switchdev notifier chain and may sleep. Nonzero MSTI changes come from netlink with rtnl held. Move the switchdev call before entering the rcu section and assert that rtnl is held.

The call cannot be deferred because netlink needs its error and extack. Also DSA reads the old bridge MST state during the callback and checks it. A deferred callback will be late and will see the updated state.

drm/amdgpu: check ras and obj before dereference

ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig->type

In the Linux kernel, the following vulnerability has been resolved:

pppoatm: ensure a writable skb header and linear data

In pppoatmsend(), LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable.

Normal transmit packets passing through pppstartxmit() have their header unshared via skbcowhead(). However, packets can also reach pppoatmsend() via PPP channel bridging (PPPIOCBRIDGECHAN) without going through pppstartxmit().

Use skbcowhead() to ensure both sufficient headroom and a writable header before pushing the LLC header.

While at it: - Call pskbmaypull(skb, 1) before inspecting skb->data[0] to prevent out-of-bounds reads on zero-length or non-linear frames (e.g. from bridging). - Defer SCCOMPPROT protocol compression until after pppoatmmaysend() succeeds. This eliminates the temporary skb allocation on admission failure and completely removes the fragile "undo" heuristic at the nospace label, avoiding any risk of reading uninitialized headroom or performing an unbalanced skbpush().

dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg()