From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 52E7E78C6E for ; Wed, 22 May 2024 06:24:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716359050; cv=none; b=j0pekyuU5jqRmanocfpwukhk1JmDMD2Pgcw77kVkvqbGFhAtG8JkBHsPxdPS/A6e04YwSy0lmI5c1qn2gCYa5kaCfzLwhNC1na2/52YmxHZ/Y0VfUKcFqFJIVabVh+q6FJcdWYxv0ZW2RNrh2d8xE8zpFeEA08LiggyVOuyDGvM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716359050; c=relaxed/simple; bh=liCQT1xHsL0KicV9Ev5toaWpivc1D6+3Gl3oIuxkukY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gIScGrh8iPTi+jcuIzLaGf90W8FpBvlwV8dRu7O+NiPkx4j3xTGoVg/39416TGEe/sw4SGfl838E3neCtrqstGSU1sGGN9q/IA42yw+lp3oxuHtkgoed1yTy7EGPhIP8RWGcGt01NLwqRRPAzju1gKYr/9Q7k/XD/Pj3w23wnMc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=gl2L0Kw0; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="gl2L0Kw0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BA2BBC2BD11; Wed, 22 May 2024 06:24:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1716359049; bh=liCQT1xHsL0KicV9Ev5toaWpivc1D6+3Gl3oIuxkukY=; h=From:To:Cc:Subject:Date:Reply-to:From; b=gl2L0Kw08nUPoXwiK81ge/7TPBuDHMYqMFKXGPhiGPq5jHbu+mLSCjigBDzuSoe/Y Wgm1VFgKZqPOICOsFrvQNK7mlXXuaMLeilOlk/2s7Ydg4/J/hyriOhzzYMAMUBGc0T b+XSPk0s6n0SBKJHsZczHl/SdiK4a9r1Z829XJg4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2021-47472: net: mdiobus: Fix memory leak in __mdiobus_register Date: Wed, 22 May 2024 08:23:38 +0200 Message-ID: <2024052228-CVE-2021-47472-bd55@gregkh> X-Mailer: git-send-email 2.45.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=7125; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=liCQT1xHsL0KicV9Ev5toaWpivc1D6+3Gl3oIuxkukY=; b=owGbwMvMwCRo6H6F97bub03G02pJDGm+/QmHdnT4MspZtFjO9v4/s73wmNGNFwUzby7fx+j97 FGa0eEjHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRt5oMC7aHslppTZf9wZB2 4s0LOeHNXVrNegwLTqzSmLM4vry6O/PhUvk/HTxTVI2uAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: net: mdiobus: Fix memory leak in __mdiobus_register Once device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it will cause memory leak. BUG: memory leak unreferenced object 0xffff888114032e00 (size 256): comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff ................ 08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff .........ve..... backtrace: [] kmalloc include/linux/slab.h:591 [inline] [] kzalloc include/linux/slab.h:721 [inline] [] device_private_init drivers/base/core.c:3203 [inline] [] device_add+0x89b/0xdf0 drivers/base/core.c:3253 [] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537 [] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87 [] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline] [] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786 [] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745 [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [] call_driver_probe drivers/base/dd.c:517 [inline] [] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596 [] really_probe drivers/base/dd.c:558 [inline] [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751 [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781 [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898 [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [] __device_attach+0x122/0x260 drivers/base/dd.c:969 [] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 [] device_add+0x5fb/0xdf0 drivers/base/core.c:3359 [] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170 [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 BUG: memory leak unreferenced object 0xffff888116f06900 (size 32): comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s) hex dump (first 32 bytes): 75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00 usb-001:003..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kstrdup+0x36/0x70 mm/util.c:60 [] kstrdup_const+0x53/0x80 mm/util.c:83 [] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48 [] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289 [] dev_set_name+0x63/0x90 drivers/base/core.c:3147 [] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535 [] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87 [] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline] [] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786 [] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745 [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [] call_driver_probe drivers/base/dd.c:517 [inline] [] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596 [] really_probe drivers/base/dd.c:558 [inline] [] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751 [] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781 [] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898 [] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [] __device_attach+0x122/0x260 drivers/base/dd.c:969 The Linux kernel CVE team has assigned CVE-2021-47472 to this issue. Affected and fixed versions =========================== Fixed in 4.4.290 with commit fd2400dd4f1b Fixed in 4.4.291 with commit b89f4537d7fd Fixed in 4.9.288 with commit bc5f2f3431ce Fixed in 4.9.289 with commit 2bc10dca9432 Fixed in 4.14.253 with commit 4ec0f9abc512 Fixed in 4.14.254 with commit fdbffd95c4ce Fixed in 4.19.214 with commit a9831afa2dc8 Fixed in 4.19.215 with commit 8121d0d4fd10 Fixed in 5.4.156 with commit b0feaa8376f5 Fixed in 5.4.157 with commit 6a18d155d5b3 Fixed in 5.10.76 with commit 3a0dc2e35a5d Fixed in 5.10.77 with commit c828115a14ea Fixed in 5.14.15 with commit 0c4e87ba11eb Fixed in 5.14.16 with commit 8ba94a7f7b9f Fixed in 5.15 with commit ab609f25d198 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47472 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/phy/mdio_bus.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/fd2400dd4f1b8bd7a309b1b424d9e0d188151b01 https://git.kernel.org/stable/c/b89f4537d7fdbd0bafb6d8a66a484e0bc99871a4 https://git.kernel.org/stable/c/bc5f2f3431ced08300e4cb3aff35f1da14c26433 https://git.kernel.org/stable/c/2bc10dca9432fadb09e45127e258fc7127fd346d https://git.kernel.org/stable/c/4ec0f9abc512cc02fb04daa89ccf6697e80ab417 https://git.kernel.org/stable/c/fdbffd95c4ce94d2197c504008eaac46b16bc5a4 https://git.kernel.org/stable/c/a9831afa2dc8a18205403907c41aa4e0950ac611 https://git.kernel.org/stable/c/8121d0d4fd108280f5cd7b7fe8c6592adaa37be9 https://git.kernel.org/stable/c/b0feaa8376f52357bf2fd020d0c471713a859728 https://git.kernel.org/stable/c/6a18d155d5b35ad50c8fac2be091212487ae58ec https://git.kernel.org/stable/c/3a0dc2e35a5d6546b1db87fe985582dadc64fe7b https://git.kernel.org/stable/c/c828115a14eacbf42042770fd68543f134e89efa https://git.kernel.org/stable/c/0c4e87ba11eb331dca2315d484d08441b8c13193 https://git.kernel.org/stable/c/8ba94a7f7b9fc2a2b808ccceb99b77135deae21a https://git.kernel.org/stable/c/ab609f25d19858513919369ff3d9a63c02cd9e2e