* CVE-2021-47472: net: mdiobus: Fix memory leak in __mdiobus_register
@ 2024-05-22 6:23 Greg Kroah-Hartman
2024-06-05 12:16 ` Michal Hocko
0 siblings, 1 reply; 3+ messages in thread
From: Greg Kroah-Hartman @ 2024-05-22 6:23 UTC (permalink / raw)
To: linux-cve-announce; +Cc: Greg Kroah-Hartman
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
net: mdiobus: Fix memory leak in __mdiobus_register
Once device_register() failed, we should call put_device() to
decrement reference count for cleanup. Or it will cause memory
leak.
BUG: memory leak
unreferenced object 0xffff888114032e00 (size 256):
comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff ................
08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff .........ve.....
backtrace:
[<ffffffff8265cfab>] kmalloc include/linux/slab.h:591 [inline]
[<ffffffff8265cfab>] kzalloc include/linux/slab.h:721 [inline]
[<ffffffff8265cfab>] device_private_init drivers/base/core.c:3203 [inline]
[<ffffffff8265cfab>] device_add+0x89b/0xdf0 drivers/base/core.c:3253
[<ffffffff828dd643>] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537
[<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
[<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
[<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
[<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
[<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
[<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
[<ffffffff82660916>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
[<ffffffff8265cd0b>] device_add+0x5fb/0xdf0 drivers/base/core.c:3359
[<ffffffff82c343b9>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170
[<ffffffff82c4473c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
BUG: memory leak
unreferenced object 0xffff888116f06900 (size 32):
comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s)
hex dump (first 32 bytes):
75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00 usb-001:003.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81484516>] kstrdup+0x36/0x70 mm/util.c:60
[<ffffffff814845a3>] kstrdup_const+0x53/0x80 mm/util.c:83
[<ffffffff82296ba2>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
[<ffffffff82358d4b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<ffffffff826575f3>] dev_set_name+0x63/0x90 drivers/base/core.c:3147
[<ffffffff828dd63b>] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535
[<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
[<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
[<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
[<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
[<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
[<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
The Linux kernel CVE team has assigned CVE-2021-47472 to this issue.
Affected and fixed versions
===========================
Fixed in 4.4.290 with commit fd2400dd4f1b
Fixed in 4.4.291 with commit b89f4537d7fd
Fixed in 4.9.288 with commit bc5f2f3431ce
Fixed in 4.9.289 with commit 2bc10dca9432
Fixed in 4.14.253 with commit 4ec0f9abc512
Fixed in 4.14.254 with commit fdbffd95c4ce
Fixed in 4.19.214 with commit a9831afa2dc8
Fixed in 4.19.215 with commit 8121d0d4fd10
Fixed in 5.4.156 with commit b0feaa8376f5
Fixed in 5.4.157 with commit 6a18d155d5b3
Fixed in 5.10.76 with commit 3a0dc2e35a5d
Fixed in 5.10.77 with commit c828115a14ea
Fixed in 5.14.15 with commit 0c4e87ba11eb
Fixed in 5.14.16 with commit 8ba94a7f7b9f
Fixed in 5.15 with commit ab609f25d198
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2021-47472
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/net/phy/mdio_bus.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/fd2400dd4f1b8bd7a309b1b424d9e0d188151b01
https://git.kernel.org/stable/c/b89f4537d7fdbd0bafb6d8a66a484e0bc99871a4
https://git.kernel.org/stable/c/bc5f2f3431ced08300e4cb3aff35f1da14c26433
https://git.kernel.org/stable/c/2bc10dca9432fadb09e45127e258fc7127fd346d
https://git.kernel.org/stable/c/4ec0f9abc512cc02fb04daa89ccf6697e80ab417
https://git.kernel.org/stable/c/fdbffd95c4ce94d2197c504008eaac46b16bc5a4
https://git.kernel.org/stable/c/a9831afa2dc8a18205403907c41aa4e0950ac611
https://git.kernel.org/stable/c/8121d0d4fd108280f5cd7b7fe8c6592adaa37be9
https://git.kernel.org/stable/c/b0feaa8376f52357bf2fd020d0c471713a859728
https://git.kernel.org/stable/c/6a18d155d5b35ad50c8fac2be091212487ae58ec
https://git.kernel.org/stable/c/3a0dc2e35a5d6546b1db87fe985582dadc64fe7b
https://git.kernel.org/stable/c/c828115a14eacbf42042770fd68543f134e89efa
https://git.kernel.org/stable/c/0c4e87ba11eb331dca2315d484d08441b8c13193
https://git.kernel.org/stable/c/8ba94a7f7b9fc2a2b808ccceb99b77135deae21a
https://git.kernel.org/stable/c/ab609f25d19858513919369ff3d9a63c02cd9e2e
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: CVE-2021-47472: net: mdiobus: Fix memory leak in __mdiobus_register
2024-05-22 6:23 CVE-2021-47472: net: mdiobus: Fix memory leak in __mdiobus_register Greg Kroah-Hartman
@ 2024-06-05 12:16 ` Michal Hocko
2024-06-17 16:15 ` Greg Kroah-Hartman
0 siblings, 1 reply; 3+ messages in thread
From: Michal Hocko @ 2024-06-05 12:16 UTC (permalink / raw)
To: cve, linux-kernel, Yanfei Xu, Pavel Skripkin
Cc: linux-cve-announce, Greg Kroah-Hartman
Fix for this CVE ab609f25d198 ("net: mdiobus: Fix memory leak in
__mdiobus_register") has been later reverted by 10eff1f5788b ("Revert
"net: mdiobus: Fix memory leak in __mdiobus_register"") which itself is
not recognized as a CVE fix.
Reading through the revert I am quite confused TBH. It claims there
is some problem but also that this is not the right fix. That would
suggest that there is a CVE but it should be addressed by a different
fix. Can anybody clarify please?
On Wed 22-05-24 08:23:38, Greg KH wrote:
> Description
> ===========
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> net: mdiobus: Fix memory leak in __mdiobus_register
>
> Once device_register() failed, we should call put_device() to
> decrement reference count for cleanup. Or it will cause memory
> leak.
>
> BUG: memory leak
> unreferenced object 0xffff888114032e00 (size 256):
> comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff ................
> 08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff .........ve.....
> backtrace:
> [<ffffffff8265cfab>] kmalloc include/linux/slab.h:591 [inline]
> [<ffffffff8265cfab>] kzalloc include/linux/slab.h:721 [inline]
> [<ffffffff8265cfab>] device_private_init drivers/base/core.c:3203 [inline]
> [<ffffffff8265cfab>] device_add+0x89b/0xdf0 drivers/base/core.c:3253
> [<ffffffff828dd643>] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537
> [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
> [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
> [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
> [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
> [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
> [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
> [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
> [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
> [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
> [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
> [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
> [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
> [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
> [<ffffffff82660916>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
> [<ffffffff8265cd0b>] device_add+0x5fb/0xdf0 drivers/base/core.c:3359
> [<ffffffff82c343b9>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170
> [<ffffffff82c4473c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
>
> BUG: memory leak
> unreferenced object 0xffff888116f06900 (size 32):
> comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s)
> hex dump (first 32 bytes):
> 75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00 usb-001:003.....
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<ffffffff81484516>] kstrdup+0x36/0x70 mm/util.c:60
> [<ffffffff814845a3>] kstrdup_const+0x53/0x80 mm/util.c:83
> [<ffffffff82296ba2>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
> [<ffffffff82358d4b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
> [<ffffffff826575f3>] dev_set_name+0x63/0x90 drivers/base/core.c:3147
> [<ffffffff828dd63b>] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535
> [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
> [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
> [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
> [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
> [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
> [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
> [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
> [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
> [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
> [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
> [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
> [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
> [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
>
> The Linux kernel CVE team has assigned CVE-2021-47472 to this issue.
>
>
> Affected and fixed versions
> ===========================
>
> Fixed in 4.4.290 with commit fd2400dd4f1b
> Fixed in 4.4.291 with commit b89f4537d7fd
> Fixed in 4.9.288 with commit bc5f2f3431ce
> Fixed in 4.9.289 with commit 2bc10dca9432
> Fixed in 4.14.253 with commit 4ec0f9abc512
> Fixed in 4.14.254 with commit fdbffd95c4ce
> Fixed in 4.19.214 with commit a9831afa2dc8
> Fixed in 4.19.215 with commit 8121d0d4fd10
> Fixed in 5.4.156 with commit b0feaa8376f5
> Fixed in 5.4.157 with commit 6a18d155d5b3
> Fixed in 5.10.76 with commit 3a0dc2e35a5d
> Fixed in 5.10.77 with commit c828115a14ea
> Fixed in 5.14.15 with commit 0c4e87ba11eb
> Fixed in 5.14.16 with commit 8ba94a7f7b9f
> Fixed in 5.15 with commit ab609f25d198
>
> Please see https://www.kernel.org for a full list of currently supported
> kernel versions by the kernel community.
>
> Unaffected versions might change over time as fixes are backported to
> older supported kernel versions. The official CVE entry at
> https://cve.org/CVERecord/?id=CVE-2021-47472
> will be updated if fixes are backported, please check that for the most
> up to date information about this issue.
>
>
> Affected files
> ==============
>
> The file(s) affected by this issue are:
> drivers/net/phy/mdio_bus.c
>
>
> Mitigation
> ==========
>
> The Linux kernel CVE team recommends that you update to the latest
> stable kernel version for this, and many other bugfixes. Individual
> changes are never tested alone, but rather are part of a larger kernel
> release. Cherry-picking individual commits is not recommended or
> supported by the Linux kernel community at all. If however, updating to
> the latest release is impossible, the individual changes to resolve this
> issue can be found at these commits:
> https://git.kernel.org/stable/c/fd2400dd4f1b8bd7a309b1b424d9e0d188151b01
> https://git.kernel.org/stable/c/b89f4537d7fdbd0bafb6d8a66a484e0bc99871a4
> https://git.kernel.org/stable/c/bc5f2f3431ced08300e4cb3aff35f1da14c26433
> https://git.kernel.org/stable/c/2bc10dca9432fadb09e45127e258fc7127fd346d
> https://git.kernel.org/stable/c/4ec0f9abc512cc02fb04daa89ccf6697e80ab417
> https://git.kernel.org/stable/c/fdbffd95c4ce94d2197c504008eaac46b16bc5a4
> https://git.kernel.org/stable/c/a9831afa2dc8a18205403907c41aa4e0950ac611
> https://git.kernel.org/stable/c/8121d0d4fd108280f5cd7b7fe8c6592adaa37be9
> https://git.kernel.org/stable/c/b0feaa8376f52357bf2fd020d0c471713a859728
> https://git.kernel.org/stable/c/6a18d155d5b35ad50c8fac2be091212487ae58ec
> https://git.kernel.org/stable/c/3a0dc2e35a5d6546b1db87fe985582dadc64fe7b
> https://git.kernel.org/stable/c/c828115a14eacbf42042770fd68543f134e89efa
> https://git.kernel.org/stable/c/0c4e87ba11eb331dca2315d484d08441b8c13193
> https://git.kernel.org/stable/c/8ba94a7f7b9fc2a2b808ccceb99b77135deae21a
> https://git.kernel.org/stable/c/ab609f25d19858513919369ff3d9a63c02cd9e2e
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: CVE-2021-47472: net: mdiobus: Fix memory leak in __mdiobus_register
2024-06-05 12:16 ` Michal Hocko
@ 2024-06-17 16:15 ` Greg Kroah-Hartman
0 siblings, 0 replies; 3+ messages in thread
From: Greg Kroah-Hartman @ 2024-06-17 16:15 UTC (permalink / raw)
To: Michal Hocko
Cc: cve, linux-kernel, Yanfei Xu, Pavel Skripkin, linux-cve-announce
On Wed, Jun 05, 2024 at 02:16:37PM +0200, Michal Hocko wrote:
> Fix for this CVE ab609f25d198 ("net: mdiobus: Fix memory leak in
> __mdiobus_register") has been later reverted by 10eff1f5788b ("Revert
> "net: mdiobus: Fix memory leak in __mdiobus_register"") which itself is
> not recognized as a CVE fix.
>
> Reading through the revert I am quite confused TBH. It claims there
> is some problem but also that this is not the right fix. That would
> suggest that there is a CVE but it should be addressed by a different
> fix. Can anybody clarify please?
The correct fix was done in commit ca6e11c337da ("phy: mdio: fix memory
leak") which already has CVE-2021-47416 assigned to it.
I'll go revert this CVE now, as it's not correct because it was reverted
upstream.
thanks for the review!
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-06-17 16:15 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-05-22 6:23 CVE-2021-47472: net: mdiobus: Fix memory leak in __mdiobus_register Greg Kroah-Hartman
2024-06-05 12:16 ` Michal Hocko
2024-06-17 16:15 ` Greg Kroah-Hartman
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.