From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D5E261AB37B for ; Thu, 20 Jun 2024 11:19:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718882343; cv=none; b=Vdv5172OvISLalPqJb6C92bkv6ZqITKWowAdBL7TVnXzB4NjT1K1QmYfesUCDEm39cVnUF5JCwQFujkFehTpanMgZs2qYqJzjGf72RsBIHWVHkXy8WXzz7vZKny5RlAXy74G7+NqH0NefUP9udKQNlyTLL4s9Upj/CQVSY9Dqx4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718882343; c=relaxed/simple; bh=QNlny/5TaNpQrEq0P0fQkg/Di+oHqN4rFDmlaom+cpc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=HRJrtVdW7NXekYLODb9rtF02TQSSokIGbcmpvibg8PTphg4I+zC2mOx2q8lvA3dntcGCpvn6HGJRXa3TIHQ13kx58BUs0DaCrpkU8qCkt5h3dI/KzerZ3DyUEMMKEzb3XCY51TbqP3Ddrd+AS1NAc0PFT5ixb55h66RfvdbbRUU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=yCoGqhk/; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="yCoGqhk/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08EF0C32781; Thu, 20 Jun 2024 11:19:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1718882343; bh=QNlny/5TaNpQrEq0P0fQkg/Di+oHqN4rFDmlaom+cpc=; h=From:To:Cc:Subject:Date:Reply-to:From; b=yCoGqhk/IcuGeWUgYHtIliNHiz+C66/wXHpWroo/JR83cm3w7LLEUkD1i61UIVONZ PKxH3T+Q+WAJ1KPsnFsPxCe1WzYoPFFORkQ9BnvtebprcqUOiCFCJNewrNrNvtEG5j NEJqpJwACuxdBZcwklLjBTUzgvhXOlLaM9XJmaCA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-48759: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev Date: Thu, 20 Jun 2024 13:16:39 +0200 Message-ID: <2024062008-CVE-2022-48759-d017@gregkh> X-Mailer: git-send-email 2.45.2 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=5502; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=QNlny/5TaNpQrEq0P0fQkg/Di+oHqN4rFDmlaom+cpc=; b=owGbwMvMwCRo6H6F97bub03G02pJDGkl/BWbHDWOs056cuNUgPeX7kBlPuE9vbuPPxRSDVdnu qu/Z/6GjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZhI6FOGBcvWbN02c7GxyOYT zWe3rk/weB/L6MowTyt47hWJ9ltVrVt/2iWUfJm6ds+KiQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_ctrldev could be freed before the cdev is entirely released, as in the backtrace below. [ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c [ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0 [ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig hci_uart btandroid btqca snd_soc_rt5682_i2c bluetooth qcom_spmi_temp_alarm snd_soc_rt5682v [ 93.715175] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.4.163-lockdep #26 [ 93.723855] Hardware name: Google Lazor (rev3 - 8) with LTE (DT) [ 93.730055] Workqueue: events kobject_delayed_cleanup [ 93.735271] pstate: 60c00009 (nZCv daif +PAN +UAO) [ 93.740216] pc : debug_print_object+0x13c/0x1b0 [ 93.744890] lr : debug_print_object+0x13c/0x1b0 [ 93.749555] sp : ffffffacf5bc7940 [ 93.752978] x29: ffffffacf5bc7940 x28: dfffffd000000000 [ 93.758448] x27: ffffffacdb11a800 x26: dfffffd000000000 [ 93.763916] x25: ffffffd0734f856c x24: dfffffd000000000 [ 93.769389] x23: 0000000000000000 x22: ffffffd0733c35b0 [ 93.774860] x21: ffffffd0751994a0 x20: ffffffd075ec27c0 [ 93.780338] x19: ffffffd075199100 x18: 00000000000276e0 [ 93.785814] x17: 0000000000000000 x16: dfffffd000000000 [ 93.791291] x15: ffffffffffffffff x14: 6e6968207473696c [ 93.796768] x13: 0000000000000000 x12: ffffffd075e2b000 [ 93.802244] x11: 0000000000000001 x10: 0000000000000000 [ 93.807723] x9 : d13400dff1921900 x8 : d13400dff1921900 [ 93.813200] x7 : 0000000000000000 x6 : 0000000000000000 [ 93.818676] x5 : 0000000000000080 x4 : 0000000000000000 [ 93.824152] x3 : ffffffd0732a0fa4 x2 : 0000000000000001 [ 93.829628] x1 : ffffffacf5bc7580 x0 : 0000000000000061 [ 93.835104] Call trace: [ 93.837644] debug_print_object+0x13c/0x1b0 [ 93.841963] __debug_check_no_obj_freed+0x25c/0x3c0 [ 93.846987] debug_check_no_obj_freed+0x18/0x20 [ 93.851669] slab_free_freelist_hook+0xbc/0x1e4 [ 93.856346] kfree+0xfc/0x2f4 [ 93.859416] rpmsg_ctrldev_release_device+0x78/0xb8 [ 93.864445] device_release+0x84/0x168 [ 93.868310] kobject_cleanup+0x12c/0x298 [ 93.872356] kobject_delayed_cleanup+0x10/0x18 [ 93.876948] process_one_work+0x578/0x92c [ 93.881086] worker_thread+0x804/0xcf8 [ 93.884963] kthread+0x2a8/0x314 [ 93.888303] ret_from_fork+0x10/0x18 The cdev_device_add/del() API was created to address this issue (see commit '233ed09d7fda ("chardev: add helper function to register char devs with a struct device")'), use it instead of cdev add/del(). The Linux kernel CVE team has assigned CVE-2022-48759 to this issue. Affected and fixed versions =========================== Issue introduced in 4.11 with commit c0cdc19f84a4 and fixed in 4.14.265 with commit 74d85e9fbc70 Issue introduced in 4.11 with commit c0cdc19f84a4 and fixed in 4.19.228 with commit 70cb4295ec80 Issue introduced in 4.11 with commit c0cdc19f84a4 and fixed in 5.4.176 with commit da27b834c1e0 Issue introduced in 4.11 with commit c0cdc19f84a4 and fixed in 5.10.96 with commit 1dbb206730f3 Issue introduced in 4.11 with commit c0cdc19f84a4 and fixed in 5.15.19 with commit 85aba11a8ea9 Issue introduced in 4.11 with commit c0cdc19f84a4 and fixed in 5.16.5 with commit d6cdc6ae5428 Issue introduced in 4.11 with commit c0cdc19f84a4 and fixed in 5.17 with commit b7fb2dad571d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-48759 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/rpmsg/rpmsg_char.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/74d85e9fbc7022a4011102c7474a9c7aeb704a35 https://git.kernel.org/stable/c/70cb4295ec806b663665e1d2ed15caab6159880e https://git.kernel.org/stable/c/da27b834c1e0222e149e06caddf7718478086d1b https://git.kernel.org/stable/c/1dbb206730f3e5ce90014ad569ddf8167ec4124a https://git.kernel.org/stable/c/85aba11a8ea92a8eef2de95ebbe063086fd62d9c https://git.kernel.org/stable/c/d6cdc6ae542845d4d0ac8b6d99362bde7042a3c7 https://git.kernel.org/stable/c/b7fb2dad571d1e21173c06cef0bced77b323990a