Summary
[5.15.0-306.177.4]
- Revert 'usb: gadget: u_serial: Disable ep before setting port to null to fix the crash caused by port being null' (Greg Kroah-Hartman)
- drm/v3d: Assign job pointer to NULL before signaling the fence (Maira Canal)
- scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs (Ranjan Kumar) [Orabug: 37472354] {CVE-2024-57804}
[5.15.0-306.177.3]
- uek-rpm: Update network stress testing options for embedded2 (Joe Dobosenski) [Orabug: 37530219]
- mm, madvise: fix potential workingset node list_lru leaks (Kairui Song) [Orabug: 37464586]
- crypto: qat/qat_4xxx - fix off by one in uof_get_name() (Dan Carpenter) [Orabug: 37427536] {CVE-2024-53162}
- vdpa/mlx5: Fix error path during device add (Dragos Tatulea) [Orabug: 37296163]
- vp_vdpa: fix id_table array not null terminated error (Xiaoguang Wang) [Orabug: 37296163] {CVE-2024-53110}
- vdpa/mlx5: Postpone MR deletion (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Introduce init/destroy for MR resources (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Rename mr_mtx -> lock (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Extract mr members in own resource struct (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Rename function (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Delete direct MKEYs in parallel (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Create direct MKEYs in parallel (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Parallelize VQ suspend/resume for CVQ MQ command (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Small improvement for change_num_qps() (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Keep notifiers during suspend but ignore (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Parallelize device resume (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Parallelize device suspend (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Use async API for vq modify commands (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Use async API for vq query command (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Introduce async fw command wrapper (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Introduce error logging function (Dragos Tatulea) [Orabug: 37296163]
- net/mlx5: Support throttled commands from async API (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Add the support of set mac address (Cindy Lu) [Orabug: 37296163]
- vdpa_sim_net: Add the support of set mac address (Cindy Lu) [Orabug: 37296163]
- vdpa: support set mac address from vdpa tool (Cindy Lu) [Orabug: 37296163]
- vdpa/mlx5: Fix invalid mr resource destroy (Dragos Tatulea) [Orabug: 37296163] {CVE-2024-47687}
- vdpa/mlx5: Don't enable non-active VQs in .set_vq_ready() (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Don't reset VQs more than necessary (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Re-create HW VQs under certain conditions (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Pre-create hardware VQs at vdpa .dev_add time (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Use suspend/resume during VQP change (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Forward error in suspend/resume device (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Consolidate all VQ modify to Ready to use resume_vq() (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Add error code for suspend/resume VQ (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Accept Init -> Ready VQ transition in resume_vq() (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Allow creation of blank VQs (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Set mkey modified flags on all VQs (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Start off rqt_size with max VQPs (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Set an initial size on the VQ (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Add support for modifying the VQ features field (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Add support for modifying the virtio_version VQ field (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Rename init_mvqs (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Clear and reinitialize software VQ data on reset (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Initialize and reset device with one queue pair (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Remove duplicate suspend code (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Iterate over active VQs during suspend/resume (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Drop redundant check in teardown_virtqueues() (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Drop redundant code (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Make setup/teardown_vq_resources() symmetrical (Dragos Tatulea) [Orabug: 37296163]
- vdpa/mlx5: Clarify meaning thorough function rename (Dragos Tatulea) [Orabug: 37296163]
- vhost-vdpa: Remove usage of the deprecated ida_simple_xx() API (Christophe JAILLET) [Orabug: 37296163]
- vp_vdpa: don't allocate unused msix vectors (Yuxue Liu) [Orabug: 37296163]
- vdpa: Convert sprintf/snprintf to sysfs_emit (Li Zhijian) [Orabug: 37296163]
- vp_vdpa: Fix return value check vp_vdpa_request_irq (Yuxue Liu) [Orabug: 37296163]
- vhost-vdpa: change ioctl # for VDPA_GET_VRING_SIZE (Michael S. Tsirkin) [Orabug: 37296163]
- virtio_vdpa: create vqs with the actual size (Zhu Lingshan) [Orabug: 37296163]
- vdpa_sim: implement vdpa_config_ops.get_vq_size for vDPA simulator (Zhu Lingshan) [Orabug: 37296163]
- vp_vdpa: implement vdpa_config_ops.get_vq_size (Zhu Lingshan) [Orabug: 37296163]
- vDPA: introduce get_vq_size to vdpa_config_ops (Zhu Lingshan) [Orabug: 37296163]
- vhost-vdpa: uapi to support reporting per vq size (Zhu Lingshan) [Orabug: 37296163]
- vdpa: skip suspend/resume ops if not DRIVER_OK (Steve Sistare) [Orabug: 37296163]
- vdpa_sim: reset must not run (Steve Sistare) [Orabug: 37296163]
- vdpa: Block vq property changes in DRIVER_OK (Dragos Tatulea) [Orabug: 37296163]
- vdpa: Track device suspended state (Dragos Tatulea) [Orabug: 37296163]
- vdpa: Remove usage of the deprecated ida_simple_xx() API (Christophe JAIL
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-container | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-container-debug | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-core | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-debug | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-core | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-devel | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules-extra | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-devel | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-doc | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-modules | 0:5.15.0-306.177.4.el9uek |
| Oracle Linux · 8 | kernel-uek-modules-extra | 0:5.15.0-306.177.4.el9uek |
Vulnerabilities 9
-
High 7.8
scsi: sg: Fix slab-use-after-free read in sg_release()
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Fix slab-use-after-free read in sg_release() Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 ker…
-
High 7.8
blk-cgroup: Fix UAF in blkcg_unpin_online()
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix UAF in blkcg_unpin_online() blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blk…
-
High 7.5
net: fix data-races around sk->sk_forward_alloc
In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported this warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c…
-
High 7.3
vp_vdpa: fix id_table array not null terminated error
In the Linux kernel, the following vulnerability has been resolved: vp_vdpa: fix id_table array not null terminated error Allocate one extra virtio_device_id as null terminator, otherwise vdpa_mgmtdev_get_classes() may iterate multiple times and visit undefin…
-
High 7.3
scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. W…
-
High 7.1
crypto: qat/qat_4xxx - fix off by one in uof_get_name()
In the Linux kernel, the following vulnerability has been resolved: crypto: qat/qat_4xxx - fix off by one in uof_get_name() The fw_objs[] array has "num_objs" elements so the > needs to be >= to prevent an out of bounds read.
-
Unscored —
gpiolib: cdev: Fix use after free in lineinfo_changed_notify
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watc…
-
Unscored —
vdpa/mlx5: Fix invalid mr resource destroy
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix invalid mr resource destroy Certain error paths from mlx5_vdpa_dev_add() can end up releasing mr resources which never got initialized in the first place. This patch adds the m…
-
Unscored —
ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() Blamed commit accidentally removed a check for rt->rt6i_idev being NULL, as spotted by syzbot: Oops: general protection fault,…