Re: CVE-2021-47472: net: mdiobus: Fix memory leak in __mdiobus_register

[Michal Hocko <mhocko@suse.com>]

Fix for this CVE ab609f25d198 ("net: mdiobus: Fix memory leak in
__mdiobus_register") has been later reverted by 10eff1f5788b ("Revert
"net: mdiobus: Fix memory leak in __mdiobus_register"") which itself is
not recognized as a CVE fix.

Reading through the revert I am quite confused TBH. It claims there
is some problem but also that this is not the right fix. That would
suggest that there is a CVE but it should be addressed by a different
fix. Can anybody clarify please?

On Wed 22-05-24 08:23:38, Greg KH wrote:
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> net: mdiobus: Fix memory leak in __mdiobus_register
> 
> Once device_register() failed, we should call put_device() to
> decrement reference count for cleanup. Or it will cause memory
> leak.
> 
> BUG: memory leak
> unreferenced object 0xffff888114032e00 (size 256):
>   comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s)
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff  ................
>     08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff  .........ve.....
>   backtrace:
>     [<ffffffff8265cfab>] kmalloc include/linux/slab.h:591 [inline]
>     [<ffffffff8265cfab>] kzalloc include/linux/slab.h:721 [inline]
>     [<ffffffff8265cfab>] device_private_init drivers/base/core.c:3203 [inline]
>     [<ffffffff8265cfab>] device_add+0x89b/0xdf0 drivers/base/core.c:3253
>     [<ffffffff828dd643>] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537
>     [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
>     [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
>     [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
>     [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
>     [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
>     [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
>     [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
>     [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
>     [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
>     [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
>     [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
>     [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
>     [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
>     [<ffffffff82660916>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
>     [<ffffffff8265cd0b>] device_add+0x5fb/0xdf0 drivers/base/core.c:3359
>     [<ffffffff82c343b9>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170
>     [<ffffffff82c4473c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
> 
> BUG: memory leak
> unreferenced object 0xffff888116f06900 (size 32):
>   comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s)
>   hex dump (first 32 bytes):
>     75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00  usb-001:003.....
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<ffffffff81484516>] kstrdup+0x36/0x70 mm/util.c:60
>     [<ffffffff814845a3>] kstrdup_const+0x53/0x80 mm/util.c:83
>     [<ffffffff82296ba2>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
>     [<ffffffff82358d4b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
>     [<ffffffff826575f3>] dev_set_name+0x63/0x90 drivers/base/core.c:3147
>     [<ffffffff828dd63b>] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535
>     [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
>     [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
>     [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
>     [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
>     [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
>     [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
>     [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
>     [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
>     [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
>     [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
>     [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
>     [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
>     [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
> 
> The Linux kernel CVE team has assigned CVE-2021-47472 to this issue.
> 
> 
> Affected and fixed versions
> ===========================
> 
> 	Fixed in 4.4.290 with commit fd2400dd4f1b
> 	Fixed in 4.4.291 with commit b89f4537d7fd
> 	Fixed in 4.9.288 with commit bc5f2f3431ce
> 	Fixed in 4.9.289 with commit 2bc10dca9432
> 	Fixed in 4.14.253 with commit 4ec0f9abc512
> 	Fixed in 4.14.254 with commit fdbffd95c4ce
> 	Fixed in 4.19.214 with commit a9831afa2dc8
> 	Fixed in 4.19.215 with commit 8121d0d4fd10
> 	Fixed in 5.4.156 with commit b0feaa8376f5
> 	Fixed in 5.4.157 with commit 6a18d155d5b3
> 	Fixed in 5.10.76 with commit 3a0dc2e35a5d
> 	Fixed in 5.10.77 with commit c828115a14ea
> 	Fixed in 5.14.15 with commit 0c4e87ba11eb
> 	Fixed in 5.14.16 with commit 8ba94a7f7b9f
> 	Fixed in 5.15 with commit ab609f25d198
> 
> Please see https://www.kernel.org for a full list of currently supported
> kernel versions by the kernel community.
> 
> Unaffected versions might change over time as fixes are backported to
> older supported kernel versions.  The official CVE entry at
> 	https://cve.org/CVERecord/?id=CVE-2021-47472
> will be updated if fixes are backported, please check that for the most
> up to date information about this issue.
> 
> 
> Affected files
> ==============
> 
> The file(s) affected by this issue are:
> 	drivers/net/phy/mdio_bus.c
> 
> 
> Mitigation
> ==========
> 
> The Linux kernel CVE team recommends that you update to the latest
> stable kernel version for this, and many other bugfixes.  Individual
> changes are never tested alone, but rather are part of a larger kernel
> release.  Cherry-picking individual commits is not recommended or
> supported by the Linux kernel community at all.  If however, updating to
> the latest release is impossible, the individual changes to resolve this
> issue can be found at these commits:
> 	https://git.kernel.org/stable/c/fd2400dd4f1b8bd7a309b1b424d9e0d188151b01
> 	https://git.kernel.org/stable/c/b89f4537d7fdbd0bafb6d8a66a484e0bc99871a4
> 	https://git.kernel.org/stable/c/bc5f2f3431ced08300e4cb3aff35f1da14c26433
> 	https://git.kernel.org/stable/c/2bc10dca9432fadb09e45127e258fc7127fd346d
> 	https://git.kernel.org/stable/c/4ec0f9abc512cc02fb04daa89ccf6697e80ab417
> 	https://git.kernel.org/stable/c/fdbffd95c4ce94d2197c504008eaac46b16bc5a4
> 	https://git.kernel.org/stable/c/a9831afa2dc8a18205403907c41aa4e0950ac611
> 	https://git.kernel.org/stable/c/8121d0d4fd108280f5cd7b7fe8c6592adaa37be9
> 	https://git.kernel.org/stable/c/b0feaa8376f52357bf2fd020d0c471713a859728
> 	https://git.kernel.org/stable/c/6a18d155d5b35ad50c8fac2be091212487ae58ec
> 	https://git.kernel.org/stable/c/3a0dc2e35a5d6546b1db87fe985582dadc64fe7b
> 	https://git.kernel.org/stable/c/c828115a14eacbf42042770fd68543f134e89efa
> 	https://git.kernel.org/stable/c/0c4e87ba11eb331dca2315d484d08441b8c13193
> 	https://git.kernel.org/stable/c/8ba94a7f7b9fc2a2b808ccceb99b77135deae21a
> 	https://git.kernel.org/stable/c/ab609f25d19858513919369ff3d9a63c02cd9e2e

-- 
Michal Hocko
SUSE Labs