In the Linux kernel, the following vulnerability has been resolved:
iommu/mediatek: Fix NULL pointer dereference when printing dev_name
When larbdev is NULL (in the case I hit, the node is incorrectly set iommus = <&iommu NUM>), it will cause devicelinkadd() fail and kernel crashes when we try to print dev_name(larbdev).
Let's fail the probe if a larbdev is NULL to avoid invalid inputs from dts.
It should work for normal correct setting and avoid the crash caused by my incorrect setting.
Error log: [ 18.189042][ T301] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050 ... [ 18.344519][ T301] pstate: a0400005 (NzCv daif +PAN -UAO) [ 18.345213][ T301] pc : mtkiommuprobedevice+0xf8/0x118 [mtkiommu] [ 18.346050][ T301] lr : mtkiommuprobedevice+0xd0/0x118 [mtkiommu] [ 18.346884][ T301] sp : ffffffc00a5635e0 [ 18.347392][ T301] x29: ffffffc00a5635e0 x28: ffffffd44a46c1d8 [ 18.348156][ T301] x27: ffffff80c39a8000 x26: ffffffd44a80cc38 [ 18.348917][ T301] x25: 0000000000000000 x24: ffffffd44a80cc38 [ 18.349677][ T301] x23: ffffffd44e4da4c6 x22: ffffffd44a80cc38 [ 18.350438][ T301] x21: ffffff80cecd1880 x20: 0000000000000000 [ 18.351198][ T301] x19: ffffff80c439f010 x18: ffffffc00a50d0c0 [ 18.351959][ T301] x17: ffffffffffffffff x16: 0000000000000004 [ 18.352719][ T301] x15: 0000000000000004 x14: ffffffd44eb5d420 [ 18.353480][ T301] x13: 0000000000000ad2 x12: 0000000000000003 [ 18.354241][ T301] x11: 00000000fffffad2 x10: c0000000fffffad2 [ 18.355003][ T301] x9 : a0d288d8d7142d00 x8 : a0d288d8d7142d00 [ 18.355763][ T301] x7 : ffffffd44c2bc640 x6 : 0000000000000000 [ 18.356524][ T301] x5 : 0000000000000080 x4 : 0000000000000001 [ 18.357284][ T301] x3 : 0000000000000000 x2 : 0000000000000005 [ 18.358045][ T301] x1 : 0000000000000000 x0 : 0000000000000000 [ 18.360208][ T301] Hardware name: MT6873 (DT) [ 18.360771][ T301] Call trace: [ 18.361168][ T301] dumpbacktrace+0xf8/0x1f0 [ 18.361737][ T301] dumpstacklvl+0xa8/0x11c [ 18.362305][ T301] dumpstack+0x1c/0x2c [ 18.362816][ T301] mrdumpcommondie+0x184/0x40c [mrdump] [ 18.363575][ T301] ipanicdie+0x24/0x38 [mrdump] [ 18.364230][ T301] atomicnotifiercallchain+0x128/0x2b8 [ 18.364937][ T301] die+0x16c/0x568 [ 18.365394][ T301] _dokernelfault+0x1e8/0x214 [ 18.365402][ T301] dopagefault+0xb8/0x678 [ 18.366934][ T301] dotranslationfault+0x48/0x64 [ 18.368645][ T301] domemabort+0x68/0x148 [ 18.368652][ T301] el1abort+0x40/0x64 [ 18.368660][ T301] el1h64synchandler+0x54/0x88 [ 18.368668][ T301] el1h64sync+0x68/0x6c [ 18.368673][ T301] mtkiommuprobedevice+0xf8/0x118 [mtk_iommu] ...
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49424.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49424.json"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1031.0,
"function_hash": "27811544329710859924763796419787896076"
},
"signature_type": "Function",
"id": "CVE-2022-49424-481c3272",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3c2734e28d7fac50228c4d2b8896e8695adf304",
"target": {
"function": "mtk_iommu_probe_device",
"file": "drivers/iommu/mtk_iommu_v1.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"2694996446219450022369830976364738448",
"128957167863674778624137219088992688848",
"187884954830119362993841348470936056262",
"278658536294480156628200645602136891972",
"94870944092758914955876104924590150827",
"46863019719750209907484023319060291433",
"34994883625253085582100543689493915431",
"126309470886390444021176051611334553227"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2022-49424-4b3bf740",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9c63c0f73a1bbfd02624f5eae7e881df8b6830f",
"target": {
"file": "drivers/iommu/mtk_iommu.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"248757771904966711904074879925776401033",
"64024607437201598633842384881795435106",
"55236166377477532656766554451219022268",
"224248963362763215711881731091699048843",
"160321520595382274425309287456707294716",
"218105650004795164760949760711364989545",
"51743999334774909203362856884800273051",
"94870944092758914955876104924590150827",
"46863019719750209907484023319060291433",
"34994883625253085582100543689493915431",
"126309470886390444021176051611334553227"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2022-49424-598b6c01",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9c63c0f73a1bbfd02624f5eae7e881df8b6830f",
"target": {
"file": "drivers/iommu/mtk_iommu_v1.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1034.0,
"function_hash": "302228500842924597800327357903208967965"
},
"signature_type": "Function",
"id": "CVE-2022-49424-67e37fcb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de78657e16f41417da9332f09c2d67d100096939",
"target": {
"function": "mtk_iommu_v1_probe_device",
"file": "drivers/iommu/mtk_iommu_v1.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 818.0,
"function_hash": "324347543945613136680422348409113822777"
},
"signature_type": "Function",
"id": "CVE-2022-49424-72df52f3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de78657e16f41417da9332f09c2d67d100096939",
"target": {
"function": "mtk_iommu_probe_device",
"file": "drivers/iommu/mtk_iommu.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"248757771904966711904074879925776401033",
"64024607437201598633842384881795435106",
"55236166377477532656766554451219022268",
"224248963362763215711881731091699048843",
"160321520595382274425309287456707294716",
"218105650004795164760949760711364989545",
"51743999334774909203362856884800273051",
"94870944092758914955876104924590150827",
"46863019719750209907484023319060291433",
"34994883625253085582100543689493915431",
"126309470886390444021176051611334553227"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2022-49424-7c87afd1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3c2734e28d7fac50228c4d2b8896e8695adf304",
"target": {
"file": "drivers/iommu/mtk_iommu_v1.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 735.0,
"function_hash": "178330147593847819913380606645165982309"
},
"signature_type": "Function",
"id": "CVE-2022-49424-803887e5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9c63c0f73a1bbfd02624f5eae7e881df8b6830f",
"target": {
"function": "mtk_iommu_probe_device",
"file": "drivers/iommu/mtk_iommu.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"164990223565395723881522673836330062329",
"188189392416027033266210104284668659260",
"263735759442511379148441885863329858933",
"278658536294480156628200645602136891972",
"94870944092758914955876104924590150827",
"46863019719750209907484023319060291433",
"34994883625253085582100543689493915431",
"126309470886390444021176051611334553227"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2022-49424-88543066",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de78657e16f41417da9332f09c2d67d100096939",
"target": {
"file": "drivers/iommu/mtk_iommu.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"2694996446219450022369830976364738448",
"128957167863674778624137219088992688848",
"187884954830119362993841348470936056262",
"278658536294480156628200645602136891972",
"94870944092758914955876104924590150827",
"46863019719750209907484023319060291433",
"34994883625253085582100543689493915431",
"126309470886390444021176051611334553227"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2022-49424-91d97d3d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8837c2682b9b2eed83e6212bcf79850c593a6fee",
"target": {
"file": "drivers/iommu/mtk_iommu.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1031.0,
"function_hash": "27811544329710859924763796419787896076"
},
"signature_type": "Function",
"id": "CVE-2022-49424-9c6db54b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8837c2682b9b2eed83e6212bcf79850c593a6fee",
"target": {
"function": "mtk_iommu_probe_device",
"file": "drivers/iommu/mtk_iommu_v1.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 1031.0,
"function_hash": "27811544329710859924763796419787896076"
},
"signature_type": "Function",
"id": "CVE-2022-49424-aef6d449",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9c63c0f73a1bbfd02624f5eae7e881df8b6830f",
"target": {
"function": "mtk_iommu_probe_device",
"file": "drivers/iommu/mtk_iommu_v1.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"2694996446219450022369830976364738448",
"128957167863674778624137219088992688848",
"187884954830119362993841348470936056262",
"278658536294480156628200645602136891972",
"94870944092758914955876104924590150827",
"46863019719750209907484023319060291433",
"34994883625253085582100543689493915431",
"126309470886390444021176051611334553227"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2022-49424-b0540257",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3c2734e28d7fac50228c4d2b8896e8695adf304",
"target": {
"file": "drivers/iommu/mtk_iommu.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 735.0,
"function_hash": "178330147593847819913380606645165982309"
},
"signature_type": "Function",
"id": "CVE-2022-49424-c8bb9fe0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3c2734e28d7fac50228c4d2b8896e8695adf304",
"target": {
"function": "mtk_iommu_probe_device",
"file": "drivers/iommu/mtk_iommu.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"117362914642698956624274425888412093763",
"320027982613562385266527739099371002215",
"228679470838092994419763581562803353853",
"319591893900809934979309740999633211126",
"160321520595382274425309287456707294716",
"218105650004795164760949760711364989545",
"51743999334774909203362856884800273051",
"94870944092758914955876104924590150827",
"46863019719750209907484023319060291433",
"34994883625253085582100543689493915431",
"126309470886390444021176051611334553227"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2022-49424-cab6246e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de78657e16f41417da9332f09c2d67d100096939",
"target": {
"file": "drivers/iommu/mtk_iommu_v1.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"248757771904966711904074879925776401033",
"64024607437201598633842384881795435106",
"55236166377477532656766554451219022268",
"224248963362763215711881731091699048843",
"160321520595382274425309287456707294716",
"218105650004795164760949760711364989545",
"51743999334774909203362856884800273051",
"94870944092758914955876104924590150827",
"46863019719750209907484023319060291433",
"34994883625253085582100543689493915431",
"126309470886390444021176051611334553227"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2022-49424-e90116a7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8837c2682b9b2eed83e6212bcf79850c593a6fee",
"target": {
"file": "drivers/iommu/mtk_iommu_v1.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 735.0,
"function_hash": "178330147593847819913380606645165982309"
},
"signature_type": "Function",
"id": "CVE-2022-49424-f524d541",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8837c2682b9b2eed83e6212bcf79850c593a6fee",
"target": {
"function": "mtk_iommu_probe_device",
"file": "drivers/iommu/mtk_iommu.c"
}
}
]