[cbr79] Many VULNs 9-9-25 #560
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bmastbergen
requested review from
kerneltoast,
PlaidCat,
thefossguy-ciq and
shreeya-patel98
bmastbergen
changed the title
PlaidCat
approved these changes
Sep 9, 2025
kerneltoast
requested changes
Sep 9, 2025
…x_cpu_timer_del() jira VULN-136687 cve CVE-2025-38352 commit-author Oleg Nesterov <oleg@redhat.com> commit f90fff1 upstream-diff Applying to kernel/posix-cpu-timers.c instead of kernel/time/posix-cpu-timers.c in upstream. There were minor merge conflicts due to differences in surrounding code but the code added is the same. If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case. Cc: stable@vger.kernel.org Reported-by: Benoît Sevens <bsevens@google.com> Fixes: 0bdd2ed ("sched: run_posix_cpu_timers: Don't check ->exit_state, use lock_task_sighand()") Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit f90fff1) Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com> fixup
jira VULN-135015 cve CVE-2022-50022 commit-author Wentao_Liang <Wentao_Liang_g@163.com> commit 1042124 In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 2886 "if (sh->batch_head && sh != sh->batch_head)". This may result in an use-after-free bug. It can be fixed by moving "raid5_release_stripe(sh);" to the bottom of the function. Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com> Signed-off-by: Song Liu <song@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> (cherry picked from commit 1042124) Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
jira VULN-72165 cve CVE-2025-38079 commit-author Ivan Pravdin <ipravdin.official@gmail.com> commit b2df03e If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cd ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable@vger.kernel.org> Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> (cherry picked from commit b2df03e) Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
bmastbergen
force-pushed
the
bmastbergen_ciqcbr7_9/many-vulns-9-9-25
branch
from
e3ad0fc to
a963322
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Commits
Build Log
Testing
selftest-3.10.0-1160.119.1.el7_9.ciqcbr.7.1.x86_64.log
selftest-3.10.0-bmastbergen_ciqcbr7_9_many-vulns-9-9-25-e3ad0fc+.log