In the Linux kernel, the following vulnerability has been resolved:
platform/chrome: crosusbpdnotify: Fix error handling in crosusbpdnotify_init()
The following WARNING message was given when rmmod crosusbpdnotify:
Unexpected driver unregister! WARNING: CPU: 0 PID: 253 at drivers/base/driver.c:270 driverunregister+0x8a/0xb0 Modules linked in: crosusbpdnotify(-) CPU: 0 PID: 253 Comm: rmmod Not tainted 6.1.0-rc3 #24 ... Call Trace: <TASK> crosusbpdnotifyexit+0x11/0x1e [crosusbpdnotify] _x64sysdeletemodule+0x3c7/0x570 ? _ia32sysdeletemodule+0x570/0x570 ? lockisheldtype+0xe3/0x140 ? syscallenterfromusermode+0x17/0x50 ? rcureadlockschedheld+0xa0/0xd0 ? syscallenterfromusermode+0x1c/0x50 dosyscall64+0x37/0x90 entrySYSCALL64after_hwframe+0x63/0xcd RIP: 0033:0x7f333fe9b1b7
The reason is that the crosusbpdnotifyinit() does not check the return value of platformdriverregister(), and the crosusbpdnotify can install successfully even if platformdriver_register() failed.
Fix by checking the return value of platformdriverregister() and unregister crosusbpdnotifyplatdriver when it failed.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "deprecated": false, "digest": { "line_hashes": [ "95650271559034545307808771942837255803", "32559996761118365525936764032003878133", "263832092961053960860173507627791564326", "108925990323853307010736964917524883972" ], "threshold": 0.9 }, "id": "CVE-2022-50468-245046db", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cab345f9d51943898e406275f9607c145adb1877" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "deprecated": false, "digest": { "line_hashes": [ "95650271559034545307808771942837255803", "32559996761118365525936764032003878133", "263832092961053960860173507627791564326", "108925990323853307010736964917524883972" ], "threshold": 0.9 }, "id": "CVE-2022-50468-36540504", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@751f12696d797e785d2611099fe9f0569d47556e" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "deprecated": false, "digest": { "line_hashes": [ "95650271559034545307808771942837255803", "32559996761118365525936764032003878133", "263832092961053960860173507627791564326", "108925990323853307010736964917524883972" ], "threshold": 0.9 }, "id": "CVE-2022-50468-59391c48", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0cacdd354987f8f5348d16908716f154047890" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c", "function": "cros_usbpd_notify_init" }, "deprecated": false, "digest": { "length": 214.0, "function_hash": "159224670634311890346733960709475005361" }, "id": "CVE-2022-50468-64f03845", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@751f12696d797e785d2611099fe9f0569d47556e" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "deprecated": false, "digest": { "line_hashes": [ "95650271559034545307808771942837255803", "32559996761118365525936764032003878133", "263832092961053960860173507627791564326", "108925990323853307010736964917524883972" ], "threshold": 0.9 }, "id": "CVE-2022-50468-6ee1e476", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a2d96623670155d94aca72c320c0ac27bdc6bd2" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c", "function": "cros_usbpd_notify_init" }, "deprecated": false, "digest": { "length": 214.0, "function_hash": "159224670634311890346733960709475005361" }, "id": "CVE-2022-50468-6f988217", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b6ee54995739202b4a0cc01b7e9269f761c573d" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c", "function": "cros_usbpd_notify_init" }, "deprecated": false, "digest": { "length": 214.0, "function_hash": "159224670634311890346733960709475005361" }, "id": "CVE-2022-50468-ab9e678e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cab345f9d51943898e406275f9607c145adb1877" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c", "function": "cros_usbpd_notify_init" }, "deprecated": false, "digest": { "length": 214.0, "function_hash": "159224670634311890346733960709475005361" }, "id": "CVE-2022-50468-af41293a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a2d96623670155d94aca72c320c0ac27bdc6bd2" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "deprecated": false, "digest": { "line_hashes": [ "95650271559034545307808771942837255803", "32559996761118365525936764032003878133", "263832092961053960860173507627791564326", "108925990323853307010736964917524883972" ], "threshold": 0.9 }, "id": "CVE-2022-50468-b71f7c9c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b6ee54995739202b4a0cc01b7e9269f761c573d" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c", "function": "cros_usbpd_notify_init" }, "deprecated": false, "digest": { "length": 214.0, "function_hash": "159224670634311890346733960709475005361" }, "id": "CVE-2022-50468-da46b40b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0cacdd354987f8f5348d16908716f154047890" } ] }