In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tcpci: fix of node refcount leak in tcpciregisterport()
I got the following report while doing device(mt6370-tcpc) load test with CONFIGOFUNITTEST and CONFIGOFDYNAMIC enabled:
OF: ERROR: memory leak, expected refcount 1 instead of 2, ofnodeget()/ofnodeput() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@34/tcpc/connector
The 'fwnode' set in tcpciparseconfig() which is called in tcpciregisterport(), its node refcount is increased in devicegetnamedchildnode(). It needs be put while exiting, so call fwnodehandleput() in the error path of tcpciregisterport() and in tcpciunregisterport() to avoid leak.
{ "vanir_signatures": [ { "id": "CVE-2022-50246-0c0c6e66", "signature_type": "Function", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c", "function": "tcpci_unregister_port" }, "signature_version": "v1", "digest": { "length": 65.0, "function_hash": "48098766260554565483022838873660021838" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b6c28a71f111a6c67ddc3238aab95910fd86cf" }, { "id": "CVE-2022-50246-3e140931", "signature_type": "Line", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "13762606732915864665630997122152229875", "157103666199069102552614728840472738791", "206906011254959363732349875206705238954", "261091175948174668474438022673852876596", "261983775393434597650602566923408294519", "148676483861848956276201190593003142344", "75362340602243456475246422340467465243", "267557522085026421811564955799885315780", "32991690349082536996112332711263438685" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f125507d2270035dfcf83fbff6cff5a143e200c" }, { "id": "CVE-2022-50246-3e48bc93", "signature_type": "Function", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c", "function": "tcpci_unregister_port" }, "signature_version": "v1", "digest": { "length": 65.0, "function_hash": "48098766260554565483022838873660021838" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f257e2eba419ab4cd880c822346450e4e7b2af3" }, { "id": "CVE-2022-50246-48b5652e", "signature_type": "Line", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "13762606732915864665630997122152229875", "157103666199069102552614728840472738791", "206906011254959363732349875206705238954", "261091175948174668474438022673852876596", "261983775393434597650602566923408294519", "148676483861848956276201190593003142344", "75362340602243456475246422340467465243", "267557522085026421811564955799885315780", "32991690349082536996112332711263438685" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f257e2eba419ab4cd880c822346450e4e7b2af3" }, { "id": "CVE-2022-50246-4ca967f6", "signature_type": "Function", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c", "function": "tcpci_unregister_port" }, "signature_version": "v1", "digest": { "length": 65.0, "function_hash": "48098766260554565483022838873660021838" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f125507d2270035dfcf83fbff6cff5a143e200c" }, { "id": "CVE-2022-50246-557069b0", "signature_type": "Function", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c", "function": "tcpci_register_port" }, "signature_version": "v1", "digest": { "length": 1656.0, "function_hash": "207905677659525797654546935919161755068" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5f125507d2270035dfcf83fbff6cff5a143e200c" }, { "id": "CVE-2022-50246-5f4e7cec", "signature_type": "Line", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "13762606732915864665630997122152229875", "157103666199069102552614728840472738791", "206906011254959363732349875206705238954", "261091175948174668474438022673852876596", "261983775393434597650602566923408294519", "148676483861848956276201190593003142344", "75362340602243456475246422340467465243", "267557522085026421811564955799885315780", "32991690349082536996112332711263438685" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b6c28a71f111a6c67ddc3238aab95910fd86cf" }, { "id": "CVE-2022-50246-6b50fa83", "signature_type": "Line", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "13762606732915864665630997122152229875", "157103666199069102552614728840472738791", "206906011254959363732349875206705238954", "261091175948174668474438022673852876596", "261983775393434597650602566923408294519", "148676483861848956276201190593003142344", "75362340602243456475246422340467465243", "267557522085026421811564955799885315780", "32991690349082536996112332711263438685" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0384e87e3fec735e47f1c133c796f32ef7a72a9b" }, { "id": "CVE-2022-50246-6f35a020", "signature_type": "Line", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "13762606732915864665630997122152229875", "157103666199069102552614728840472738791", "206906011254959363732349875206705238954", "261091175948174668474438022673852876596", "261983775393434597650602566923408294519", "148676483861848956276201190593003142344", "75362340602243456475246422340467465243", "267557522085026421811564955799885315780", "32991690349082536996112332711263438685" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e75a324409715bd71348f79a49aa61b69dbeb676" }, { "id": "CVE-2022-50246-a5af425e", "signature_type": "Function", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c", "function": "tcpci_register_port" }, "signature_version": "v1", "digest": { "length": 1042.0, "function_hash": "189180008059903520960200176789954169396" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3b6c28a71f111a6c67ddc3238aab95910fd86cf" }, { "id": "CVE-2022-50246-c60a259b", "signature_type": "Function", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c", "function": "tcpci_register_port" }, "signature_version": "v1", "digest": { "length": 944.0, "function_hash": "225232643464034196279831010500402178915" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f257e2eba419ab4cd880c822346450e4e7b2af3" }, { "id": "CVE-2022-50246-c814c397", "signature_type": "Function", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c", "function": "tcpci_unregister_port" }, "signature_version": "v1", "digest": { "length": 65.0, "function_hash": "48098766260554565483022838873660021838" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0384e87e3fec735e47f1c133c796f32ef7a72a9b" }, { "id": "CVE-2022-50246-ceac969e", "signature_type": "Function", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c", "function": "tcpci_register_port" }, "signature_version": "v1", "digest": { "length": 1656.0, "function_hash": "207905677659525797654546935919161755068" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e75a324409715bd71348f79a49aa61b69dbeb676" }, { "id": "CVE-2022-50246-ee55a478", "signature_type": "Function", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c", "function": "tcpci_unregister_port" }, "signature_version": "v1", "digest": { "length": 65.0, "function_hash": "48098766260554565483022838873660021838" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e75a324409715bd71348f79a49aa61b69dbeb676" }, { "id": "CVE-2022-50246-ee89d39c", "signature_type": "Function", "target": { "file": "drivers/usb/typec/tcpm/tcpci.c", "function": "tcpci_register_port" }, "signature_version": "v1", "digest": { "length": 1656.0, "function_hash": "207905677659525797654546935919161755068" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0384e87e3fec735e47f1c133c796f32ef7a72a9b" } ] }