* Re: CVE-2021-47472: net: mdiobus: Fix memory leak in __mdiobus_register
[not found] <2024052228-CVE-2021-47472-bd55@gregkh>
@ 2024-06-05 12:16 ` Michal Hocko
2024-06-17 16:15 ` Greg Kroah-Hartman
0 siblings, 1 reply; 2+ messages in thread
From: Michal Hocko @ 2024-06-05 12:16 UTC (permalink / raw)
To: cve, linux-kernel, Yanfei Xu, Pavel Skripkin
Cc: linux-cve-announce, Greg Kroah-Hartman
Fix for this CVE ab609f25d198 ("net: mdiobus: Fix memory leak in
__mdiobus_register") has been later reverted by 10eff1f5788b ("Revert
"net: mdiobus: Fix memory leak in __mdiobus_register"") which itself is
not recognized as a CVE fix.
Reading through the revert I am quite confused TBH. It claims there
is some problem but also that this is not the right fix. That would
suggest that there is a CVE but it should be addressed by a different
fix. Can anybody clarify please?
On Wed 22-05-24 08:23:38, Greg KH wrote:
> Description
> ===========
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> net: mdiobus: Fix memory leak in __mdiobus_register
>
> Once device_register() failed, we should call put_device() to
> decrement reference count for cleanup. Or it will cause memory
> leak.
>
> BUG: memory leak
> unreferenced object 0xffff888114032e00 (size 256):
> comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff ................
> 08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff .........ve.....
> backtrace:
> [<ffffffff8265cfab>] kmalloc include/linux/slab.h:591 [inline]
> [<ffffffff8265cfab>] kzalloc include/linux/slab.h:721 [inline]
> [<ffffffff8265cfab>] device_private_init drivers/base/core.c:3203 [inline]
> [<ffffffff8265cfab>] device_add+0x89b/0xdf0 drivers/base/core.c:3253
> [<ffffffff828dd643>] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537
> [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
> [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
> [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
> [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
> [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
> [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
> [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
> [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
> [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
> [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
> [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
> [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
> [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
> [<ffffffff82660916>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
> [<ffffffff8265cd0b>] device_add+0x5fb/0xdf0 drivers/base/core.c:3359
> [<ffffffff82c343b9>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170
> [<ffffffff82c4473c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
>
> BUG: memory leak
> unreferenced object 0xffff888116f06900 (size 32):
> comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s)
> hex dump (first 32 bytes):
> 75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00 usb-001:003.....
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<ffffffff81484516>] kstrdup+0x36/0x70 mm/util.c:60
> [<ffffffff814845a3>] kstrdup_const+0x53/0x80 mm/util.c:83
> [<ffffffff82296ba2>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
> [<ffffffff82358d4b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
> [<ffffffff826575f3>] dev_set_name+0x63/0x90 drivers/base/core.c:3147
> [<ffffffff828dd63b>] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535
> [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
> [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
> [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
> [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
> [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
> [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
> [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
> [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
> [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
> [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
> [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
> [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
> [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
>
> The Linux kernel CVE team has assigned CVE-2021-47472 to this issue.
>
>
> Affected and fixed versions
> ===========================
>
> Fixed in 4.4.290 with commit fd2400dd4f1b
> Fixed in 4.4.291 with commit b89f4537d7fd
> Fixed in 4.9.288 with commit bc5f2f3431ce
> Fixed in 4.9.289 with commit 2bc10dca9432
> Fixed in 4.14.253 with commit 4ec0f9abc512
> Fixed in 4.14.254 with commit fdbffd95c4ce
> Fixed in 4.19.214 with commit a9831afa2dc8
> Fixed in 4.19.215 with commit 8121d0d4fd10
> Fixed in 5.4.156 with commit b0feaa8376f5
> Fixed in 5.4.157 with commit 6a18d155d5b3
> Fixed in 5.10.76 with commit 3a0dc2e35a5d
> Fixed in 5.10.77 with commit c828115a14ea
> Fixed in 5.14.15 with commit 0c4e87ba11eb
> Fixed in 5.14.16 with commit 8ba94a7f7b9f
> Fixed in 5.15 with commit ab609f25d198
>
> Please see https://www.kernel.org for a full list of currently supported
> kernel versions by the kernel community.
>
> Unaffected versions might change over time as fixes are backported to
> older supported kernel versions. The official CVE entry at
> https://cve.org/CVERecord/?id=CVE-2021-47472
> will be updated if fixes are backported, please check that for the most
> up to date information about this issue.
>
>
> Affected files
> ==============
>
> The file(s) affected by this issue are:
> drivers/net/phy/mdio_bus.c
>
>
> Mitigation
> ==========
>
> The Linux kernel CVE team recommends that you update to the latest
> stable kernel version for this, and many other bugfixes. Individual
> changes are never tested alone, but rather are part of a larger kernel
> release. Cherry-picking individual commits is not recommended or
> supported by the Linux kernel community at all. If however, updating to
> the latest release is impossible, the individual changes to resolve this
> issue can be found at these commits:
> https://git.kernel.org/stable/c/fd2400dd4f1b8bd7a309b1b424d9e0d188151b01
> https://git.kernel.org/stable/c/b89f4537d7fdbd0bafb6d8a66a484e0bc99871a4
> https://git.kernel.org/stable/c/bc5f2f3431ced08300e4cb3aff35f1da14c26433
> https://git.kernel.org/stable/c/2bc10dca9432fadb09e45127e258fc7127fd346d
> https://git.kernel.org/stable/c/4ec0f9abc512cc02fb04daa89ccf6697e80ab417
> https://git.kernel.org/stable/c/fdbffd95c4ce94d2197c504008eaac46b16bc5a4
> https://git.kernel.org/stable/c/a9831afa2dc8a18205403907c41aa4e0950ac611
> https://git.kernel.org/stable/c/8121d0d4fd108280f5cd7b7fe8c6592adaa37be9
> https://git.kernel.org/stable/c/b0feaa8376f52357bf2fd020d0c471713a859728
> https://git.kernel.org/stable/c/6a18d155d5b35ad50c8fac2be091212487ae58ec
> https://git.kernel.org/stable/c/3a0dc2e35a5d6546b1db87fe985582dadc64fe7b
> https://git.kernel.org/stable/c/c828115a14eacbf42042770fd68543f134e89efa
> https://git.kernel.org/stable/c/0c4e87ba11eb331dca2315d484d08441b8c13193
> https://git.kernel.org/stable/c/8ba94a7f7b9fc2a2b808ccceb99b77135deae21a
> https://git.kernel.org/stable/c/ab609f25d19858513919369ff3d9a63c02cd9e2e
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 2+ messages in thread