In the Linux kernel, the following vulnerability has been resolved:
drm: bridge: adv7511: unregister cec i2c device after cec adapter
cecunregisteradapter() assumes that the underlying adapter ops are callable. For example, if the CEC adapter currently has a valid physical address, then the unregistration procedure will invalidate the physical address by setting it to f.f.f.f. Whence the following kernel oops observed after removing the adv7511 module:
Unable to handle kernel execution of user memory at virtual address 0000000000000000
Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP
Call trace:
0x0
adv7511_cec_adap_log_addr+0x1ac/0x1c8 [adv7511]
cec_adap_unconfigure+0x44/0x90 [cec]
__cec_s_phys_addr.part.0+0x68/0x230 [cec]
__cec_s_phys_addr+0x40/0x50 [cec]
cec_unregister_adapter+0xb4/0x118 [cec]
adv7511_remove+0x60/0x90 [adv7511]
i2c_device_remove+0x34/0xe0
device_release_driver_internal+0x114/0x1f0
driver_detach+0x54/0xe0
bus_remove_driver+0x60/0xd8
driver_unregister+0x34/0x60
i2c_del_driver+0x2c/0x68
adv7511_exit+0x1c/0x67c [adv7511]
__arm64_sys_delete_module+0x154/0x288
invoke_syscall+0x48/0x100
el0_svc_common.constprop.0+0x48/0xe8
do_el0_svc+0x28/0x88
el0_svc+0x1c/0x50
el0t_64_sync_handler+0xa8/0xb0
el0t_64_sync+0x15c/0x160
Code: bad PC value
---[ end trace 0000000000000000 ]---
Protect against this scenario by unregistering i2c_cec after unregistering the CEC adapter. Duly disable the CEC clock afterwards too.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f369fb4deed7ab997cfa703dc85ec08b3adc1af8",
"target": {
"function": "adv7511_remove",
"file": "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c"
},
"deprecated": false,
"id": "CVE-2022-50412-1999159c",
"signature_version": "v1",
"digest": {
"length": 388.0,
"function_hash": "228107677585262824402305700437739886086"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86ae5170786aea3e1751123ca55700fb9b37b623",
"target": {
"file": "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c"
},
"deprecated": false,
"id": "CVE-2022-50412-21f635dc",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193321371177141408571496750016989286913",
"232297331236031783355512633335075041686",
"191186443619608540936690678424852706421",
"264916794193955000405518425847525566318",
"335273360775111778313500392992933368622",
"236524549958663185549406700737849085319",
"334980925101873686436461979243438843747",
"222353573808856832131960679244891117188",
"131495152234567664621478367578388956247"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3747465c5da7a11957a34bbb9485d9fc253b91cc",
"target": {
"file": "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c"
},
"deprecated": false,
"id": "CVE-2022-50412-403e9c10",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193321371177141408571496750016989286913",
"232297331236031783355512633335075041686",
"191186443619608540936690678424852706421",
"264916794193955000405518425847525566318",
"335273360775111778313500392992933368622",
"236524549958663185549406700737849085319",
"334980925101873686436461979243438843747",
"222353573808856832131960679244891117188",
"131495152234567664621478367578388956247"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d4d5bc659206b187263190ad9a03513f625659d",
"target": {
"function": "adv7511_remove",
"file": "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c"
},
"deprecated": false,
"id": "CVE-2022-50412-5233faaf",
"signature_version": "v1",
"digest": {
"length": 313.0,
"function_hash": "129958942315919960201977794500213940591"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f369fb4deed7ab997cfa703dc85ec08b3adc1af8",
"target": {
"file": "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c"
},
"deprecated": false,
"id": "CVE-2022-50412-5403f60a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"74733022925129212972054733856217940011",
"55965887368771278642048438816700827125",
"158718931029862350644499731806524038830",
"264916794193955000405518425847525566318",
"335273360775111778313500392992933368622",
"236524549958663185549406700737849085319",
"334980925101873686436461979243438843747",
"222353573808856832131960679244891117188",
"131495152234567664621478367578388956247"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@40cdb02cb9f965732eb543d47f15bef8d10f0f5f",
"target": {
"file": "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c"
},
"deprecated": false,
"id": "CVE-2022-50412-5ee9f320",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193321371177141408571496750016989286913",
"232297331236031783355512633335075041686",
"191186443619608540936690678424852706421",
"264916794193955000405518425847525566318",
"335273360775111778313500392992933368622",
"236524549958663185549406700737849085319",
"334980925101873686436461979243438843747",
"222353573808856832131960679244891117188",
"131495152234567664621478367578388956247"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3747465c5da7a11957a34bbb9485d9fc253b91cc",
"target": {
"function": "adv7511_remove",
"file": "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c"
},
"deprecated": false,
"id": "CVE-2022-50412-8a34f5f7",
"signature_version": "v1",
"digest": {
"length": 313.0,
"function_hash": "129958942315919960201977794500213940591"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86ae5170786aea3e1751123ca55700fb9b37b623",
"target": {
"function": "adv7511_remove",
"file": "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c"
},
"deprecated": false,
"id": "CVE-2022-50412-9608f927",
"signature_version": "v1",
"digest": {
"length": 313.0,
"function_hash": "129958942315919960201977794500213940591"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d4d5bc659206b187263190ad9a03513f625659d",
"target": {
"file": "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c"
},
"deprecated": false,
"id": "CVE-2022-50412-9c35fa25",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193321371177141408571496750016989286913",
"232297331236031783355512633335075041686",
"191186443619608540936690678424852706421",
"264916794193955000405518425847525566318",
"335273360775111778313500392992933368622",
"236524549958663185549406700737849085319",
"334980925101873686436461979243438843747",
"222353573808856832131960679244891117188",
"131495152234567664621478367578388956247"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@40cdb02cb9f965732eb543d47f15bef8d10f0f5f",
"target": {
"function": "adv7511_remove",
"file": "drivers/gpu/drm/bridge/adv7511/adv7511_drv.c"
},
"deprecated": false,
"id": "CVE-2022-50412-afbafce1",
"signature_version": "v1",
"digest": {
"length": 313.0,
"function_hash": "129958942315919960201977794500213940591"
},
"signature_type": "Function"
}
]