| From bippy-1.1.0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@kernel.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49900: i2c: piix4: Fix adapter not be removed in piix4_remove() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| i2c: piix4: Fix adapter not be removed in piix4_remove() |
| |
| In piix4_probe(), the piix4 adapter will be registered in: |
| |
| piix4_probe() |
| piix4_add_adapters_sb800() / piix4_add_adapter() |
| i2c_add_adapter() |
| |
| Based on the probed device type, piix4_add_adapters_sb800() or single |
| piix4_add_adapter() will be called. |
| For the former case, piix4_adapter_count is set as the number of adapters, |
| while for antoher case it is not set and kept default *zero*. |
| |
| When piix4 is removed, piix4_remove() removes the adapters added in |
| piix4_probe(), basing on the piix4_adapter_count value. |
| Because the count is zero for the single adapter case, the adapter won't |
| be removed and makes the sources allocated for adapter leaked, such as |
| the i2c client and device. |
| |
| These sources can still be accessed by i2c or bus and cause problems. |
| An easily reproduced case is that if a new adapter is registered, i2c |
| will get the leaked adapter and try to call smbus_algorithm, which was |
| already freed: |
| |
| Triggered by: rmmod i2c_piix4 && modprobe max31730 |
| |
| BUG: unable to handle page fault for address: ffffffffc053d860 |
| #PF: supervisor read access in kernel mode |
| #PF: error_code(0x0000) - not-present page |
| Oops: 0000 [#1] PREEMPT SMP KASAN |
| CPU: 0 PID: 3752 Comm: modprobe Tainted: G |
| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) |
| RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core |
| RSP: 0018:ffff888107477710 EFLAGS: 00000246 |
| ... |
| <TASK> |
| i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core |
| __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core |
| bus_for_each_dev (drivers/base/bus.c:301) |
| i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core |
| i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core |
| do_one_initcall (init/main.c:1296) |
| do_init_module (kernel/module/main.c:2455) |
| ... |
| </TASK> |
| ---[ end trace 0000000000000000 ]--- |
| |
| Fix this problem by correctly set piix4_adapter_count as 1 for the |
| single adapter so it can be normally removed. |
| |
| The Linux kernel CVE team has assigned CVE-2022-49900 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.4 with commit 528d53a1592b0e27c423f7cafc1df85f77fc1163 and fixed in 5.10.154 with commit bfd5e62f9a7ee214661cb6f143a3b40ccc63317f |
| Issue introduced in 5.4 with commit 528d53a1592b0e27c423f7cafc1df85f77fc1163 and fixed in 5.15.78 with commit d78ccdce662e88f41e87e90cf2bee63c1715d2a5 |
| Issue introduced in 5.4 with commit 528d53a1592b0e27c423f7cafc1df85f77fc1163 and fixed in 6.0.8 with commit fe51636fffc8108c7c4da6aa393010e786530ad9 |
| Issue introduced in 5.4 with commit 528d53a1592b0e27c423f7cafc1df85f77fc1163 and fixed in 6.1 with commit 569bea74c94d37785682b11bab76f557520477cd |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49900 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/i2c/busses/i2c-piix4.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/bfd5e62f9a7ee214661cb6f143a3b40ccc63317f |
| https://git.kernel.org/stable/c/d78ccdce662e88f41e87e90cf2bee63c1715d2a5 |
| https://git.kernel.org/stable/c/fe51636fffc8108c7c4da6aa393010e786530ad9 |
| https://git.kernel.org/stable/c/569bea74c94d37785682b11bab76f557520477cd |
