CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-48817 – net: dsa: ar9331: register the mdiobus under devres
https://notcve.org/view.php?id=CVE-2022-48817
In the Linux kernel, the following vulnerability has been resolved: net: dsa: ar9331: register the mdiobus under devres As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The ar9331 is an MDIO device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the ar9331 switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The ar9331 driver doesn't have a complex code structure for mdiobus removal, so just replace of_mdiobus_register with the devres variant in order to be all-devres and ensure that we don't free a still-registered bus. • https://git.kernel.org/stable/c/ac3a68d56651c3dad2c12c7afce065fe15267f44 https://git.kernel.org/stable/c/475ce5dcf2d88fd4f3c213a0ac944e3e40702970 https://git.kernel.org/stable/c/aae1c6a1d3d696fc33b609fb12fe744a556d1dc5 https://git.kernel.org/stable/c/f1842a8cb71de4d7eb75a86f76e88c7ee739218c https://git.kernel.org/stable/c/50facd86e9fbc4b93fe02e5fe05776047f45dbfb •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-48816 – SUNRPC: lock against ->sock changing during sysfs read
https://notcve.org/view.php?id=CVE-2022-48816
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: lock against ->sock changing during sysfs read ->sock can be set to NULL asynchronously unless ->recv_mutex is held. So it is important to hold that mutex. Otherwise a sysfs read can trigger an oops. Commit 17f09d3f619a ("SUNRPC: Check if the xprt is connected before handling sysfs reads") appears to attempt to fix this problem, but it only narrows the race window. • https://git.kernel.org/stable/c/a8482488a7d6d320f63a9ee1912dbb5ae5b80a61 https://git.kernel.org/stable/c/21a2be1a5145d072deedc7cdc5b2d17380abea75 https://git.kernel.org/stable/c/77876473912d1bf1ed16bffa1674e5ff0f499f25 https://git.kernel.org/stable/c/9482ab4540f5bcc869b44c067ae99b5fca16bd07 https://git.kernel.org/stable/c/b49ea673e119f59c71645e2f65b3ccad857c90ee https://access.redhat.com/security/cve/CVE-2022-48816 https://bugzilla.redhat.com/show_bug.cgi?id=2298155 • CWE-476: NULL Pointer Dereference •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-48815 – net: dsa: bcm_sf2: don't use devres for mdiobus
https://notcve.org/view.php?id=CVE-2022-48815
In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The Starfighter 2 is a platform device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the bcm_sf2 switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The bcm_sf2 driver has the code structure in place for orderly mdiobus removal, so just replace devm_mdiobus_alloc() with the non-devres variant, and add manual free where necessary, to ensure that we don't let devres free a still-registered bus. • https://git.kernel.org/stable/c/ac3a68d56651c3dad2c12c7afce065fe15267f44 https://git.kernel.org/stable/c/2770b795294ed312375c11ef1d0b810499c66b83 https://git.kernel.org/stable/c/caabb5f64f5c32fceed93356bb688ef1ec6c5783 https://git.kernel.org/stable/c/08e1a3554e99a1a5bd2835907381e2383ee85cae https://git.kernel.org/stable/c/08f1a20822349004bb9cc1b153ecb516e9f2889d •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2022-48814 – net: dsa: seville: register the mdiobus under devres
https://notcve.org/view.php?id=CVE-2022-48814
In the Linux kernel, the following vulnerability has been resolved: net: dsa: seville: register the mdiobus under devres As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The Seville VSC9959 switch is a platform device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the seville switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The seville driver has a code structure that could accommodate both the mdiobus_unregister and mdiobus_free calls, but it has an external dependency upon mscc_miim_setup() from mdio-mscc-miim.c, which calls devm_mdiobus_alloc_size() on its behalf. So rather than restructuring that, and exporting yet one more symbol mscc_miim_teardown(), let's work with devres and replace of_mdiobus_register with the devres variant. When we use all-devres, we can ensure that devres doesn't free a still-registered bus (it either runs both callbacks, or none). • https://git.kernel.org/stable/c/ac3a68d56651c3dad2c12c7afce065fe15267f44 https://git.kernel.org/stable/c/1d13e7221035947c62800c9d3d99b4ed570e27e7 https://git.kernel.org/stable/c/0e816362d823cd46c666e64d8bffe329ee22f4cc https://git.kernel.org/stable/c/bd488afc3b39e045ba71aab472233f2a78726e7b •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2022-48813 – net: dsa: felix: don't use devres for mdiobus
https://notcve.org/view.php?id=CVE-2022-48813
In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres") mdiobus_free() will panic when called from devm_mdiobus_free() <- devres_release_all() <- __device_release_driver(), and that mdiobus was not previously unregistered. The Felix VSC9959 switch is a PCI device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here. If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and device_links_unbind_consumers() will unbind the felix switch driver on shutdown. So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all. The felix driver has the code structure in place for orderly mdiobus removal, so just replace devm_mdiobus_alloc_size() with the non-devres variant, and add manual free where necessary, to ensure that we don't let devres free a still-registered bus. • https://git.kernel.org/stable/c/ac3a68d56651c3dad2c12c7afce065fe15267f44 https://git.kernel.org/stable/c/95e5402f9430b3c7d885dd3ec4c8c02c17936923 https://git.kernel.org/stable/c/8cda7577a0b4018572f31e0caadfabd305ea2786 https://git.kernel.org/stable/c/9db6f056efd089e80d81c774c01b639adf30c097 https://git.kernel.org/stable/c/209bdb7ec6a28c7cdf580a0a98afbc9fc3b98932 •