In the Linux kernel, the following vulnerability has been resolved:
cxl/mem: Fix shutdown order
Ira reports that removing cxlmockmem causes a crash with the following trace:
BUG: kernel NULL pointer dereference, address: 0000000000000044 [..] RIP: 0010:cxlregiondecodereset+0x7f/0x180 [cxlcore] [..] Call Trace: <TASK> cxlregiondetach+0xe8/0x210 [cxlcore] cxldecoderkillregion+0x27/0x40 [cxlcore] cxldunregister+0x29/0x40 [cxlcore] devresreleaseall+0xb8/0x110 deviceunbindcleanup+0xe/0x70 devicereleasedriverinternal+0x1d2/0x210 busremovedevice+0xd7/0x150 devicedel+0x155/0x3e0 deviceunregister+0x13/0x60 devmreleaseaction+0x4d/0x90 ? _pfxunregisterport+0x10/0x10 [cxlcore] deleteendpoint+0x121/0x130 [cxlcore] devresreleaseall+0xb8/0x110 deviceunbindcleanup+0xe/0x70 devicereleasedriverinternal+0x1d2/0x210 busremovedevice+0xd7/0x150 devicedel+0x155/0x3e0 ? lockrelease+0x142/0x290 cdevdevicedel+0x15/0x50 cxlmemdevunregister+0x54/0x70 [cxlcore]
This crash is due to the clearing out the cxl_memdev's driver context (@cxlds) before the subsystem is done with it. This is ultimately due to the region(s), that this memdev is a member, being torn down and expecting to be able to de-reference @cxlds, like here:
static int cxlregiondecodereset(struct cxlregion *cxlr, int count) ... if (cxlds->rcd) goto endpoint_reset; ...
Fix it by keeping the driver context valid until memdev-device unregistration, and subsequently the entire stack of related dependencies, unwinds.
{ "vanir_signatures": [ { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/cxl/core/memdev.c", "function": "cxl_memdev_unregister" }, "deprecated": false, "digest": { "length": 167.0, "function_hash": "270727150202033455723945921444115890858" }, "id": "CVE-2023-52849-00479fe9", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cad22a757029c3a1985c221a2d4a6491ad4035ae" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/cxl/core/memdev.c" }, "deprecated": false, "digest": { "line_hashes": [ "100175410088905967820785519474210502843", "287105922906519308771673821920480279467", "234516488863894529890532918582286495140", "327000852016287168722166700664819694412", "195146127888158116171125367342882954031" ], "threshold": 0.9 }, "id": "CVE-2023-52849-0723fc1e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca074f7d788627a4e0b047ca5fbdb5fc567220c" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/cxl/core/memdev.c" }, "deprecated": false, "digest": { "line_hashes": [ "100175410088905967820785519474210502843", "287105922906519308771673821920480279467", "234516488863894529890532918582286495140", "327000852016287168722166700664819694412", "195146127888158116171125367342882954031" ], "threshold": 0.9 }, "id": "CVE-2023-52849-312eb573", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/cxl/core/memdev.c", "function": "cxl_memdev_unregister" }, "deprecated": false, "digest": { "length": 167.0, "function_hash": "270727150202033455723945921444115890858" }, "id": "CVE-2023-52849-3f239d8a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca074f7d788627a4e0b047ca5fbdb5fc567220c" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/cxl/core/memdev.c", "function": "cxl_memdev_unregister" }, "deprecated": false, "digest": { "length": 167.0, "function_hash": "270727150202033455723945921444115890858" }, "id": "CVE-2023-52849-43b9161e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/cxl/core/memdev.c" }, "deprecated": false, "digest": { "line_hashes": [ "100175410088905967820785519474210502843", "287105922906519308771673821920480279467", "234516488863894529890532918582286495140", "327000852016287168722166700664819694412", "195146127888158116171125367342882954031" ], "threshold": 0.9 }, "id": "CVE-2023-52849-8b9ed5d2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88d3917f82ed4215a2154432c26de1480a61b209" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/cxl/core/memdev.c" }, "deprecated": false, "digest": { "line_hashes": [ "234172886118717696427229093459459399433", "319041162470859091447391870607067419463", "176451136728962661212696152032723350019", "234760680768900686100419623579836385427", "274058848961953977558443405247526572391", "248576012765064186159330294526394323939" ], "threshold": 0.9 }, "id": "CVE-2023-52849-9a82d77d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20bd0198bebdd706bd4614b3933ef70d7c19618f" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/cxl/core/memdev.c", "function": "cxl_memdev_unregister" }, "deprecated": false, "digest": { "length": 167.0, "function_hash": "270727150202033455723945921444115890858" }, "id": "CVE-2023-52849-bb93d1f5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88d3917f82ed4215a2154432c26de1480a61b209" }, { "signature_version": "v1", "signature_type": "Function", "target": { "file": "drivers/cxl/core/memdev.c", "function": "cxl_memdev_unregister" }, "deprecated": false, "digest": { "length": 282.0, "function_hash": "240910955651810192287373699659130239689" }, "id": "CVE-2023-52849-cf193957", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20bd0198bebdd706bd4614b3933ef70d7c19618f" }, { "signature_version": "v1", "signature_type": "Line", "target": { "file": "drivers/cxl/core/memdev.c" }, "deprecated": false, "digest": { "line_hashes": [ "100175410088905967820785519474210502843", "287105922906519308771673821920480279467", "234516488863894529890532918582286495140", "327000852016287168722166700664819694412", "195146127888158116171125367342882954031" ], "threshold": 0.9 }, "id": "CVE-2023-52849-f248ea94", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cad22a757029c3a1985c221a2d4a6491ad4035ae" } ] }