In the Linux kernel, the following vulnerability has been resolved:
fbdev: smscufx: fix error handling code in ufxusbprobe
The current error handling code in ufxusbprobe have many unmatching issues, e.g., missing ufxfreeusblist, destroymodedb label should only include framebufferrelease, fbdealloccmap only matches fballoc_cmap.
My local syzkaller reports a memory leak bug:
memory leak in ufxusbprobe
BUG: memory leak unreferenced object 0xffff88802f879580 (size 128): comm "kworker/0:7", pid 17416, jiffies 4295067474 (age 46.710s) hex dump (first 32 bytes): 80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff .!|............. 00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00 ................ backtrace: [<ffffffff814c99a0>] kmalloctrace+0x20/0x90 mm/slabcommon.c:1045 [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline] [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline] [<ffffffff824d219c>] ufxallocurblist drivers/video/fbdev/smscufx.c:1873 [inline] [<ffffffff824d219c>] ufxusbprobe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655 [<ffffffff82d17927>] usbprobeinterface+0x177/0x370 drivers/usb/core/driver.c:396 [<ffffffff82712f0d>] calldriverprobe drivers/base/dd.c:560 [inline] [<ffffffff82712f0d>] reallyprobe+0x12d/0x390 drivers/base/dd.c:639 [<ffffffff8271322f>] _driverprobedevice+0xbf/0x140 drivers/base/dd.c:778 [<ffffffff827132da>] driverprobedevice+0x2a/0x120 drivers/base/dd.c:808 [<ffffffff82713c27>] _deviceattachdriver+0xf7/0x150 drivers/base/dd.c:936 [<ffffffff82710137>] busforeachdrv+0xb7/0x100 drivers/base/bus.c:427 [<ffffffff827136b5>] _deviceattach+0x105/0x2d0 drivers/base/dd.c:1008 [<ffffffff82711d36>] busprobedevice+0xc6/0xe0 drivers/base/bus.c:487 [<ffffffff8270e242>] deviceadd+0x642/0xdc0 drivers/base/core.c:3517 [<ffffffff82d14d5f>] usbsetconfiguration+0x8ef/0xb80 drivers/usb/core/message.c:2170 [<ffffffff82d2576c>] usbgenericdriverprobe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<ffffffff82d16ffc>] usbprobedevice+0x5c/0x140 drivers/usb/core/driver.c:293 [<ffffffff82712f0d>] calldriverprobe drivers/base/dd.c:560 [inline] [<ffffffff82712f0d>] reallyprobe+0x12d/0x390 drivers/base/dd.c:639 [<ffffffff8271322f>] _driverprobe_device+0xbf/0x140 drivers/base/dd.c:778
Fix this bug by rewriting the error handling code in ufxusbprobe.
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"293518790350184704245162509198630405521",
"58106796081714540077948745412921862723",
"328147418811275461850722604778274344565",
"120516865397589010365380713534084450524",
"152327301943766899895455760254608460023",
"265952841287391347010000025785577113349",
"51967709465073160700434337853152780971",
"129145262378427285197348404891810399299",
"123002262107203516738390385190688062236",
"187951145361138671446147395283834069810",
"169800574899591986050049982666157496404",
"259785024007716274376549069282816791525",
"156472480020033225982678359714684202922",
"208097125618163694491431390027992557821",
"214984730000992300112597245991781566299",
"265444148010485418326947742890316982959",
"118751237021813606105447749191266220955",
"163413535549569051652702541456436757185",
"176465984000958854536735886390477272004",
"292616342771127504064723782896963046775",
"91754975007940198302801992029498868350",
"93374596302782685609770209569493746861",
"237759028843600023251286697087894587680",
"136496326552541142409953679970022153567",
"208116381175867904132672043329443649006",
"298620155947428959122628042942156380532",
"51334401458811575309221678048169391428",
"328795811070414178482194445858717151581",
"139344178923514450522539644823323156352",
"164145847031869112144597620031671071628",
"92372887840573102660254912826650266106",
"114068719729159767445074598581790251308",
"163619931996195096615265658226971606382",
"235087627687424653520926970517514433973",
"290050773569748065126402962035606963414",
"149200031635706179090072646185539623768",
"183058812677607569966426124358834261507",
"255580370582154830159148801750562160612",
"168586624670365308996518560443801416491",
"290630219815513262636277669882588850671",
"78983379107170746106193226856764529842",
"177336290427435072219022306055373599609",
"192649587749099981118071450509038644102"
]
},
"target": {
"file": "drivers/video/fbdev/smscufx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b76449ee75e21acfe9fa4c653d8598f191ed7d68",
"id": "CVE-2022-49741-32d6959d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65140394970346209308020945070363580304",
"length": 3651.0
},
"target": {
"file": "drivers/video/fbdev/smscufx.c",
"function": "ufx_usb_probe"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b76449ee75e21acfe9fa4c653d8598f191ed7d68",
"id": "CVE-2022-49741-3a255520",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65140394970346209308020945070363580304",
"length": 3651.0
},
"target": {
"file": "drivers/video/fbdev/smscufx.c",
"function": "ufx_usb_probe"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64fa364ad3245508d393e16ed4886f92d7eb423c",
"id": "CVE-2022-49741-5a3a6625",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65140394970346209308020945070363580304",
"length": 3651.0
},
"target": {
"file": "drivers/video/fbdev/smscufx.c",
"function": "ufx_usb_probe"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b3d3127f5b4291ae4caaf50f7b66089ad600480",
"id": "CVE-2022-49741-743b8f6d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"293518790350184704245162509198630405521",
"58106796081714540077948745412921862723",
"328147418811275461850722604778274344565",
"120516865397589010365380713534084450524",
"152327301943766899895455760254608460023",
"265952841287391347010000025785577113349",
"51967709465073160700434337853152780971",
"129145262378427285197348404891810399299",
"123002262107203516738390385190688062236",
"187951145361138671446147395283834069810",
"169800574899591986050049982666157496404",
"259785024007716274376549069282816791525",
"156472480020033225982678359714684202922",
"208097125618163694491431390027992557821",
"214984730000992300112597245991781566299",
"265444148010485418326947742890316982959",
"118751237021813606105447749191266220955",
"163413535549569051652702541456436757185",
"176465984000958854536735886390477272004",
"292616342771127504064723782896963046775",
"91754975007940198302801992029498868350",
"93374596302782685609770209569493746861",
"237759028843600023251286697087894587680",
"136496326552541142409953679970022153567",
"208116381175867904132672043329443649006",
"298620155947428959122628042942156380532",
"51334401458811575309221678048169391428",
"328795811070414178482194445858717151581",
"139344178923514450522539644823323156352",
"164145847031869112144597620031671071628",
"92372887840573102660254912826650266106",
"114068719729159767445074598581790251308",
"163619931996195096615265658226971606382",
"235087627687424653520926970517514433973",
"290050773569748065126402962035606963414",
"149200031635706179090072646185539623768",
"183058812677607569966426124358834261507",
"255580370582154830159148801750562160612",
"168586624670365308996518560443801416491",
"290630219815513262636277669882588850671",
"78983379107170746106193226856764529842",
"177336290427435072219022306055373599609",
"192649587749099981118071450509038644102"
]
},
"target": {
"file": "drivers/video/fbdev/smscufx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b",
"id": "CVE-2022-49741-7c5fbcb7",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65140394970346209308020945070363580304",
"length": 3651.0
},
"target": {
"file": "drivers/video/fbdev/smscufx.c",
"function": "ufx_usb_probe"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b",
"id": "CVE-2022-49741-863efa98",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "65140394970346209308020945070363580304",
"length": 3651.0
},
"target": {
"file": "drivers/video/fbdev/smscufx.c",
"function": "ufx_usb_probe"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3931014367ef31d26af65386a4ca496f50f0cfdf",
"id": "CVE-2022-49741-9d77018b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"293518790350184704245162509198630405521",
"58106796081714540077948745412921862723",
"328147418811275461850722604778274344565",
"120516865397589010365380713534084450524",
"152327301943766899895455760254608460023",
"265952841287391347010000025785577113349",
"51967709465073160700434337853152780971",
"129145262378427285197348404891810399299",
"123002262107203516738390385190688062236",
"187951145361138671446147395283834069810",
"169800574899591986050049982666157496404",
"259785024007716274376549069282816791525",
"156472480020033225982678359714684202922",
"208097125618163694491431390027992557821",
"214984730000992300112597245991781566299",
"265444148010485418326947742890316982959",
"118751237021813606105447749191266220955",
"163413535549569051652702541456436757185",
"176465984000958854536735886390477272004",
"292616342771127504064723782896963046775",
"91754975007940198302801992029498868350",
"93374596302782685609770209569493746861",
"237759028843600023251286697087894587680",
"136496326552541142409953679970022153567",
"208116381175867904132672043329443649006",
"298620155947428959122628042942156380532",
"51334401458811575309221678048169391428",
"328795811070414178482194445858717151581",
"139344178923514450522539644823323156352",
"164145847031869112144597620031671071628",
"92372887840573102660254912826650266106",
"114068719729159767445074598581790251308",
"163619931996195096615265658226971606382",
"235087627687424653520926970517514433973",
"290050773569748065126402962035606963414",
"149200031635706179090072646185539623768",
"183058812677607569966426124358834261507",
"255580370582154830159148801750562160612",
"168586624670365308996518560443801416491",
"290630219815513262636277669882588850671",
"78983379107170746106193226856764529842",
"177336290427435072219022306055373599609",
"192649587749099981118071450509038644102"
]
},
"target": {
"file": "drivers/video/fbdev/smscufx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3931014367ef31d26af65386a4ca496f50f0cfdf",
"id": "CVE-2022-49741-d6846608",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"293518790350184704245162509198630405521",
"58106796081714540077948745412921862723",
"328147418811275461850722604778274344565",
"120516865397589010365380713534084450524",
"152327301943766899895455760254608460023",
"265952841287391347010000025785577113349",
"51967709465073160700434337853152780971",
"129145262378427285197348404891810399299",
"123002262107203516738390385190688062236",
"187951145361138671446147395283834069810",
"169800574899591986050049982666157496404",
"259785024007716274376549069282816791525",
"156472480020033225982678359714684202922",
"208097125618163694491431390027992557821",
"214984730000992300112597245991781566299",
"265444148010485418326947742890316982959",
"118751237021813606105447749191266220955",
"163413535549569051652702541456436757185",
"176465984000958854536735886390477272004",
"292616342771127504064723782896963046775",
"91754975007940198302801992029498868350",
"93374596302782685609770209569493746861",
"237759028843600023251286697087894587680",
"136496326552541142409953679970022153567",
"208116381175867904132672043329443649006",
"298620155947428959122628042942156380532",
"51334401458811575309221678048169391428",
"328795811070414178482194445858717151581",
"139344178923514450522539644823323156352",
"164145847031869112144597620031671071628",
"92372887840573102660254912826650266106",
"114068719729159767445074598581790251308",
"163619931996195096615265658226971606382",
"235087627687424653520926970517514433973",
"290050773569748065126402962035606963414",
"149200031635706179090072646185539623768",
"183058812677607569966426124358834261507",
"255580370582154830159148801750562160612",
"168586624670365308996518560443801416491",
"290630219815513262636277669882588850671",
"78983379107170746106193226856764529842",
"177336290427435072219022306055373599609",
"192649587749099981118071450509038644102"
]
},
"target": {
"file": "drivers/video/fbdev/smscufx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3b3d3127f5b4291ae4caaf50f7b66089ad600480",
"id": "CVE-2022-49741-e2ff7aea",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"293518790350184704245162509198630405521",
"58106796081714540077948745412921862723",
"328147418811275461850722604778274344565",
"120516865397589010365380713534084450524",
"152327301943766899895455760254608460023",
"265952841287391347010000025785577113349",
"51967709465073160700434337853152780971",
"129145262378427285197348404891810399299",
"123002262107203516738390385190688062236",
"187951145361138671446147395283834069810",
"169800574899591986050049982666157496404",
"259785024007716274376549069282816791525",
"156472480020033225982678359714684202922",
"208097125618163694491431390027992557821",
"214984730000992300112597245991781566299",
"265444148010485418326947742890316982959",
"118751237021813606105447749191266220955",
"163413535549569051652702541456436757185",
"176465984000958854536735886390477272004",
"292616342771127504064723782896963046775",
"91754975007940198302801992029498868350",
"93374596302782685609770209569493746861",
"237759028843600023251286697087894587680",
"136496326552541142409953679970022153567",
"208116381175867904132672043329443649006",
"298620155947428959122628042942156380532",
"51334401458811575309221678048169391428",
"328795811070414178482194445858717151581",
"139344178923514450522539644823323156352",
"164145847031869112144597620031671071628",
"92372887840573102660254912826650266106",
"114068719729159767445074598581790251308",
"163619931996195096615265658226971606382",
"235087627687424653520926970517514433973",
"290050773569748065126402962035606963414",
"149200031635706179090072646185539623768",
"183058812677607569966426124358834261507",
"255580370582154830159148801750562160612",
"168586624670365308996518560443801416491",
"290630219815513262636277669882588850671",
"78983379107170746106193226856764529842",
"177336290427435072219022306055373599609",
"192649587749099981118071450509038644102"
]
},
"target": {
"file": "drivers/video/fbdev/smscufx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64fa364ad3245508d393e16ed4886f92d7eb423c",
"id": "CVE-2022-49741-e45a4d16",
"deprecated": false,
"signature_version": "v1"
}
]