| From bippy-1.1.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-53098: media: rc: gpio-ir-recv: add remove function |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| media: rc: gpio-ir-recv: add remove function |
| |
| In case runtime PM is enabled, do runtime PM clean up to remove |
| cpu latency qos request, otherwise driver removal may have below |
| kernel dump: |
| |
| [ 19.463299] Unable to handle kernel NULL pointer dereference at |
| virtual address 0000000000000048 |
| [ 19.472161] Mem abort info: |
| [ 19.474985] ESR = 0x0000000096000004 |
| [ 19.478754] EC = 0x25: DABT (current EL), IL = 32 bits |
| [ 19.484081] SET = 0, FnV = 0 |
| [ 19.487149] EA = 0, S1PTW = 0 |
| [ 19.490361] FSC = 0x04: level 0 translation fault |
| [ 19.495256] Data abort info: |
| [ 19.498149] ISV = 0, ISS = 0x00000004 |
| [ 19.501997] CM = 0, WnR = 0 |
| [ 19.504977] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000049f81000 |
| [ 19.511432] [0000000000000048] pgd=0000000000000000, |
| p4d=0000000000000000 |
| [ 19.518245] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP |
| [ 19.524520] Modules linked in: gpio_ir_recv(+) rc_core [last |
| unloaded: rc_core] |
| [ 19.531845] CPU: 0 PID: 445 Comm: insmod Not tainted |
| 6.2.0-rc1-00028-g2c397a46d47c #72 |
| [ 19.531854] Hardware name: FSL i.MX8MM EVK board (DT) |
| [ 19.531859] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS |
| BTYPE=--) |
| [ 19.551777] pc : cpu_latency_qos_remove_request+0x20/0x110 |
| [ 19.557277] lr : gpio_ir_recv_runtime_suspend+0x18/0x30 |
| [gpio_ir_recv] |
| [ 19.557294] sp : ffff800008ce3740 |
| [ 19.557297] x29: ffff800008ce3740 x28: 0000000000000000 x27: |
| ffff800008ce3d50 |
| [ 19.574270] x26: ffffc7e3e9cea100 x25: 00000000000f4240 x24: |
| ffffc7e3f9ef0e30 |
| [ 19.574284] x23: 0000000000000000 x22: ffff0061803820f4 x21: |
| 0000000000000008 |
| [ 19.574296] x20: ffffc7e3fa75df30 x19: 0000000000000020 x18: |
| ffffffffffffffff |
| [ 19.588570] x17: 0000000000000000 x16: ffffc7e3f9efab70 x15: |
| ffffffffffffffff |
| [ 19.595712] x14: ffff800008ce37b8 x13: ffff800008ce37aa x12: |
| 0000000000000001 |
| [ 19.602853] x11: 0000000000000001 x10: ffffcbe3ec0dff87 x9 : |
| 0000000000000008 |
| [ 19.609991] x8 : 0101010101010101 x7 : 0000000000000000 x6 : |
| 000000000f0bfe9f |
| [ 19.624261] x5 : 00ffffffffffffff x4 : 0025ab8e00000000 x3 : |
| ffff006180382010 |
| [ 19.631405] x2 : ffffc7e3e9ce8030 x1 : ffffc7e3fc3eb810 x0 : |
| 0000000000000020 |
| [ 19.638548] Call trace: |
| [ 19.640995] cpu_latency_qos_remove_request+0x20/0x110 |
| [ 19.646142] gpio_ir_recv_runtime_suspend+0x18/0x30 [gpio_ir_recv] |
| [ 19.652339] pm_generic_runtime_suspend+0x2c/0x44 |
| [ 19.657055] __rpm_callback+0x48/0x1dc |
| [ 19.660807] rpm_callback+0x6c/0x80 |
| [ 19.664301] rpm_suspend+0x10c/0x640 |
| [ 19.667880] rpm_idle+0x250/0x2d0 |
| [ 19.671198] update_autosuspend+0x38/0xe0 |
| [ 19.675213] pm_runtime_set_autosuspend_delay+0x40/0x60 |
| [ 19.680442] gpio_ir_recv_probe+0x1b4/0x21c [gpio_ir_recv] |
| [ 19.685941] platform_probe+0x68/0xc0 |
| [ 19.689610] really_probe+0xc0/0x3dc |
| [ 19.693189] __driver_probe_device+0x7c/0x190 |
| [ 19.697550] driver_probe_device+0x3c/0x110 |
| [ 19.701739] __driver_attach+0xf4/0x200 |
| [ 19.705578] bus_for_each_dev+0x70/0xd0 |
| [ 19.709417] driver_attach+0x24/0x30 |
| [ 19.712998] bus_add_driver+0x17c/0x240 |
| [ 19.716834] driver_register+0x78/0x130 |
| [ 19.720676] __platform_driver_register+0x28/0x34 |
| [ 19.725386] gpio_ir_recv_driver_init+0x20/0x1000 [gpio_ir_recv] |
| [ 19.731404] do_one_initcall+0x44/0x2ac |
| [ 19.735243] do_init_module+0x48/0x1d0 |
| [ 19.739003] load_module+0x19fc/0x2034 |
| [ 19.742759] __do_sys_finit_module+0xac/0x12c |
| [ 19.747124] __arm64_sys_finit_module+0x20/0x30 |
| [ 19.751664] invoke_syscall+0x48/0x114 |
| [ 19.755420] el0_svc_common.constprop.0+0xcc/0xec |
| [ 19.760132] do_el0_svc+0x38/0xb0 |
| [ 19.763456] el0_svc+0x2c/0x84 |
| [ 19.766516] el0t_64_sync_handler+0xf4/0x120 |
| [ 19.770789] el0t_64_sync+0x190/0x194 |
| [ 19.774460] Code: 910003fd a90153f3 aa0003f3 91204021 (f9401400) |
| [ 19.780556] ---[ end trace 0000000000000000 ]--- |
| |
| The Linux kernel CVE team has assigned CVE-2023-53098 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Fixed in 5.10.175 with commit a5c140d88a69eb43de2a030f1d7ff7b16bff3b1a |
| Fixed in 5.15.103 with commit 513572bb89e8075f5d2a2bb4c89f1152e44da9d8 |
| Fixed in 6.1.20 with commit 00e81f191bc00cb6faabf468960e96ebf0404a6c |
| Fixed in 6.2.7 with commit 2ece4d2f7eac1cb51dc0e9859e09bfdb00faa28e |
| Fixed in 6.3 with commit 30040818b338b8ebc956ce0ebd198f8d593586a6 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-53098 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/media/rc/gpio-ir-recv.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/a5c140d88a69eb43de2a030f1d7ff7b16bff3b1a |
| https://git.kernel.org/stable/c/513572bb89e8075f5d2a2bb4c89f1152e44da9d8 |
| https://git.kernel.org/stable/c/00e81f191bc00cb6faabf468960e96ebf0404a6c |
| https://git.kernel.org/stable/c/2ece4d2f7eac1cb51dc0e9859e09bfdb00faa28e |
| https://git.kernel.org/stable/c/30040818b338b8ebc956ce0ebd198f8d593586a6 |
