Bjorn Andersson

A vulnerability in the Linux kernel has been resolved. The issue occurs when the SCM driver fails during the probe, leaving the global ' scm' variable assigned. This can cause external users of the driver to assume the probe finished successfully, potentially leading to a NULL pointer exception. The problem is triggered by introducing probe deferral in the SCM driver.

A issue in the Linux kernel has been resolved, specifically in the qcom scm smc firmware. The problem was related to handling a missing SCM device. A commit was made to explicitly handle the case where qcom scm get tzmem pool() can return NULL, ensuring its users can properly manage this situation.

The issue is related to the mapping of shared memory in the Linux kernel, specifically in the soc: qcom: cmd-db component. The problem arises when the XPU falsely detects clean cache eviction as a "write" into the write-protected region, leading to a secure interrupt and an endless loop in the Trust Zone. This occurs because the Qualcomm Hypervisor maps the region as Non-Cacheable memory in Stage 2 translation tables, but other hypervisors like Xen or KVM do not know about these specific mappings. The patch fixes the issue by updating the mapping of cmd-db memory from MEMREMAP WB to MEMREMAP WT/WC, removing the dependency on correct mappings in Stage 2 tables.

A vulnerability has been resolved in the Linux kernel. The issue occurred when the `msm drm uninit()` function was called from the `msm drm init()` error path, which could lead to calling `free irq()` for an IRQ that was not requested before due to an earlier error. This resulted in a warning and a backtrace indicating an attempt to free an already-free IRQ. The vulnerability is related to the `drm/msm` module and affects the `msm drm uninit()` and `msm drm bind()` functions.

A issue in the Linux kernel has been resolved, related to a struct clk leak on probe errors in the phy: qcom-qmp module. The problem occurred when a late probe error happened, such as probe deferral, and the pipe clock reference was not released.

A shift-out-of-bounds error was found in the Linux kernel, specifically in the gpio-wcd934x driver. The bit-mask for pins 0 to 4 is incorrectly set to BIT(n - 1) instead of BIT(0) to BIT(4). This issue was caught by the UBSAN check, which reported a shift-out-of-bounds error in the drivers/gpio/gpio-wcd934x.c file at line 34, column 14.

A potential use after free issue in the MHI send functionality of the Linux kernel has been resolved. The `MHI ul callback` may be invoked immediately after the `skb` is queued for transmission, leading to the callback decrementing the refcount of the associated `sk` and freeing the `skb`. To avoid this issue, the dereference of `skb` and the increment of the `sk` refcount must happen before the `skb` is queued.