| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-26784: pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| pmdomain: arm: Fix NULL dereference on scmi_perf_domain removal |
| |
| On unloading of the scmi_perf_domain module got the below splat, when in |
| the DT provided to the system under test the '#power-domain-cells' property |
| was missing. Indeed, this particular setup causes the probe to bail out |
| early without giving any error, which leads to the ->remove() callback gets |
| to run too, but without all the expected initialized structures in place. |
| |
| Add a check and bail out early on remove too. |
| |
| Call trace: |
| scmi_perf_domain_remove+0x28/0x70 [scmi_perf_domain] |
| scmi_dev_remove+0x28/0x40 [scmi_core] |
| device_remove+0x54/0x90 |
| device_release_driver_internal+0x1dc/0x240 |
| driver_detach+0x58/0xa8 |
| bus_remove_driver+0x78/0x108 |
| driver_unregister+0x38/0x70 |
| scmi_driver_unregister+0x28/0x180 [scmi_core] |
| scmi_perf_domain_driver_exit+0x18/0xb78 [scmi_perf_domain] |
| __arm64_sys_delete_module+0x1a8/0x2c0 |
| invoke_syscall+0x50/0x128 |
| el0_svc_common.constprop.0+0x48/0xf0 |
| do_el0_svc+0x24/0x38 |
| el0_svc+0x34/0xb8 |
| el0t_64_sync_handler+0x100/0x130 |
| el0t_64_sync+0x190/0x198 |
| Code: a90153f3 f9403c14 f9414800 955f8a05 (b9400a80) |
| ---[ end trace 0000000000000000 ]--- |
| |
| The Linux kernel CVE team has assigned CVE-2024-26784 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.7 with commit 2af23ceb8624a419eaf40295c11fcb86ec9ee303 and fixed in 6.7.9 with commit f6aaf131e4d4a9a26040ecc018eb70ab8b3d355d |
| Issue introduced in 6.7 with commit 2af23ceb8624a419eaf40295c11fcb86ec9ee303 and fixed in 6.8 with commit eb5555d422d0fc325e1574a7353d3c616f82d8b5 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-26784 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/pmdomain/arm/scmi_perf_domain.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/f6aaf131e4d4a9a26040ecc018eb70ab8b3d355d |
| https://git.kernel.org/stable/c/eb5555d422d0fc325e1574a7353d3c616f82d8b5 |
