Skip to content

[LTS 8.6] CVE-2022-1055, CVE-2023-1989, CVE-2023-1252, CVE-2023-1118, CVE-2022-3640 #585

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Sep 24, 2025
Merged

[LTS 8.6] CVE-2022-1055, CVE-2023-1989, CVE-2023-1252, CVE-2023-1118, CVE-2022-3640 #585

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
457dff8
net: sched: fix use-after-free in tc_new_tfilter()
pvts-mat Sep 16, 2025
68b3ca9
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to rac…
pvts-mat Sep 19, 2025
b033dc8
ovl: fix use after free in struct ovl_aio_req
pvts-mat Sep 19, 2025
9208830
media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
pvts-mat Sep 19, 2025
590fa62
Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del()
pvts-mat Sep 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions drivers/bluetooth/btsdio.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -370,6 +370,7 @@ static void btsdio_remove(struct sdio_func *func)
if (!data)
return;

cancel_work_sync(&data->work);
hdev = data->hdev;

sdio_set_drvdata(func, NULL);
Expand Down
3 changes: 2 additions & 1 deletion drivers/media/rc/ene_ir.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1116,14 +1116,15 @@ static void ene_remove(struct pnp_dev *pnp_dev)
struct ene_device *dev = pnp_get_drvdata(pnp_dev);
unsigned long flags;

rc_unregister_device(dev->rdev);
del_timer_sync(&dev->tx_sim_timer);
spin_lock_irqsave(&dev->hw_lock, flags);
ene_rx_disable(dev);
ene_rx_restore_hw_buffer(dev);
spin_unlock_irqrestore(&dev->hw_lock, flags);

free_irq(dev->irq, dev);
release_region(dev->hw_io, ENE_IO_SIZE);
rc_unregister_device(dev->rdev);
kfree(dev);
}

Expand Down
16 changes: 14 additions & 2 deletions fs/overlayfs/file.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@

struct ovl_aio_req {
struct kiocb iocb;
refcount_t ref;
struct kiocb *orig_iocb;
struct fd fd;
};
Expand Down Expand Up @@ -255,6 +256,14 @@ static rwf_t ovl_iocb_to_rwf(int ifl)
return flags;
}

static inline void ovl_aio_put(struct ovl_aio_req *aio_req)
{
if (refcount_dec_and_test(&aio_req->ref)) {
fdput(aio_req->fd);
kmem_cache_free(ovl_aio_request_cachep, aio_req);
}
}

static void ovl_aio_cleanup_handler(struct ovl_aio_req *aio_req)
{
struct kiocb *iocb = &aio_req->iocb;
Expand All @@ -271,8 +280,7 @@ static void ovl_aio_cleanup_handler(struct ovl_aio_req *aio_req)
}

orig_iocb->ki_pos = iocb->ki_pos;
fdput(aio_req->fd);
kmem_cache_free(ovl_aio_request_cachep, aio_req);
ovl_aio_put(aio_req);
}

static void ovl_aio_rw_complete(struct kiocb *iocb, long res, long res2)
Expand Down Expand Up @@ -316,7 +324,9 @@ static ssize_t ovl_read_iter(struct kiocb *iocb, struct iov_iter *iter)
aio_req->orig_iocb = iocb;
kiocb_clone(&aio_req->iocb, iocb, real.file);
aio_req->iocb.ki_complete = ovl_aio_rw_complete;
refcount_set(&aio_req->ref, 2);
ret = vfs_iocb_iter_read(real.file, &aio_req->iocb, iter);
ovl_aio_put(aio_req);
if (ret != -EIOCBQUEUED)
ovl_aio_cleanup_handler(aio_req);
}
Expand Down Expand Up @@ -381,7 +391,9 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter)
kiocb_clone(&aio_req->iocb, iocb, real.file);
aio_req->iocb.ki_flags = ifl;
aio_req->iocb.ki_complete = ovl_aio_rw_complete;
refcount_set(&aio_req->ref, 2);
ret = vfs_iocb_iter_write(real.file, &aio_req->iocb, iter);
ovl_aio_put(aio_req);
if (ret != -EIOCBQUEUED)
ovl_aio_cleanup_handler(aio_req);
}
Expand Down
1 change: 1 addition & 0 deletions net/bluetooth/l2cap_core.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7597,6 +7597,7 @@ static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
return;
}

l2cap_chan_hold(chan);
l2cap_chan_lock(chan);
} else {
BT_DBG("unknown cid 0x%4.4x", cid);
Expand Down
11 changes: 7 additions & 4 deletions net/sched/cls_api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1955,9 +1955,9 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
bool prio_allocate;
u32 parent;
u32 chain_index;
struct Qdisc *q = NULL;
struct Qdisc *q;
struct tcf_chain_info chain_info;
struct tcf_chain *chain = NULL;
struct tcf_chain *chain;
struct tcf_block *block;
struct tcf_proto *tp;
unsigned long cl;
Expand Down Expand Up @@ -1985,6 +1985,8 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n,
tp = NULL;
cl = 0;
block = NULL;
q = NULL;
chain = NULL;

if (prio == 0) {
/* If no priority is provided by the user,
Expand Down Expand Up @@ -2806,8 +2808,8 @@ static int tc_ctl_chain(struct sk_buff *skb, struct nlmsghdr *n,
struct tcmsg *t;
u32 parent;
u32 chain_index;
struct Qdisc *q = NULL;
struct tcf_chain *chain = NULL;
struct Qdisc *q;
struct tcf_chain *chain;
struct tcf_block *block;
unsigned long cl;
int err;
Expand All @@ -2817,6 +2819,7 @@ static int tc_ctl_chain(struct sk_buff *skb, struct nlmsghdr *n,
return -EPERM;

replay:
q = NULL;
err = nlmsg_parse_deprecated(n, sizeof(*t), tca, TCA_MAX,
rtm_tca_policy, extack);
if (err < 0)
Expand Down
Loading