In the Linux kernel, the following vulnerability has been resolved:
cxl/mem: Fix shutdown order
Ira reports that removing cxlmockmem causes a crash with the following trace:
BUG: kernel NULL pointer dereference, address: 0000000000000044 [..] RIP: 0010:cxlregiondecodereset+0x7f/0x180 [cxlcore] [..] Call Trace: <TASK> cxlregiondetach+0xe8/0x210 [cxlcore] cxldecoderkillregion+0x27/0x40 [cxlcore] cxldunregister+0x29/0x40 [cxlcore] devresreleaseall+0xb8/0x110 deviceunbindcleanup+0xe/0x70 devicereleasedriverinternal+0x1d2/0x210 busremovedevice+0xd7/0x150 devicedel+0x155/0x3e0 deviceunregister+0x13/0x60 devmreleaseaction+0x4d/0x90 ? _pfxunregisterport+0x10/0x10 [cxlcore] deleteendpoint+0x121/0x130 [cxlcore] devresreleaseall+0xb8/0x110 deviceunbindcleanup+0xe/0x70 devicereleasedriverinternal+0x1d2/0x210 busremovedevice+0xd7/0x150 devicedel+0x155/0x3e0 ? lockrelease+0x142/0x290 cdevdevicedel+0x15/0x50 cxlmemdevunregister+0x54/0x70 [cxlcore]
This crash is due to the clearing out the cxl_memdev's driver context (@cxlds) before the subsystem is done with it. This is ultimately due to the region(s), that this memdev is a member, being torn down and expecting to be able to de-reference @cxlds, like here:
static int cxlregiondecodereset(struct cxlregion *cxlr, int count) ... if (cxlds->rcd) goto endpoint_reset; ...
Fix it by keeping the driver context valid until memdev-device unregistration, and subsequently the entire stack of related dependencies, unwinds.
[
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "cxl_memdev_unregister",
"file": "drivers/cxl/core/memdev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cad22a757029c3a1985c221a2d4a6491ad4035ae",
"digest": {
"function_hash": "270727150202033455723945921444115890858",
"length": 167.0
},
"signature_type": "Function",
"id": "CVE-2023-52849-00479fe9"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/cxl/core/memdev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca074f7d788627a4e0b047ca5fbdb5fc567220c",
"digest": {
"line_hashes": [
"100175410088905967820785519474210502843",
"287105922906519308771673821920480279467",
"234516488863894529890532918582286495140",
"327000852016287168722166700664819694412",
"195146127888158116171125367342882954031"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52849-0723fc1e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/cxl/core/memdev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b",
"digest": {
"line_hashes": [
"100175410088905967820785519474210502843",
"287105922906519308771673821920480279467",
"234516488863894529890532918582286495140",
"327000852016287168722166700664819694412",
"195146127888158116171125367342882954031"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52849-312eb573"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "cxl_memdev_unregister",
"file": "drivers/cxl/core/memdev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ca074f7d788627a4e0b047ca5fbdb5fc567220c",
"digest": {
"function_hash": "270727150202033455723945921444115890858",
"length": 167.0
},
"signature_type": "Function",
"id": "CVE-2023-52849-3f239d8a"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "cxl_memdev_unregister",
"file": "drivers/cxl/core/memdev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c7371b41a14e86f53e7dbe5baa7b1d3e0ab324b",
"digest": {
"function_hash": "270727150202033455723945921444115890858",
"length": 167.0
},
"signature_type": "Function",
"id": "CVE-2023-52849-43b9161e"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/cxl/core/memdev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88d3917f82ed4215a2154432c26de1480a61b209",
"digest": {
"line_hashes": [
"100175410088905967820785519474210502843",
"287105922906519308771673821920480279467",
"234516488863894529890532918582286495140",
"327000852016287168722166700664819694412",
"195146127888158116171125367342882954031"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52849-8b9ed5d2"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/cxl/core/memdev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20bd0198bebdd706bd4614b3933ef70d7c19618f",
"digest": {
"line_hashes": [
"234172886118717696427229093459459399433",
"319041162470859091447391870607067419463",
"176451136728962661212696152032723350019",
"234760680768900686100419623579836385427",
"274058848961953977558443405247526572391",
"248576012765064186159330294526394323939"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52849-9a82d77d"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "cxl_memdev_unregister",
"file": "drivers/cxl/core/memdev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88d3917f82ed4215a2154432c26de1480a61b209",
"digest": {
"function_hash": "270727150202033455723945921444115890858",
"length": 167.0
},
"signature_type": "Function",
"id": "CVE-2023-52849-bb93d1f5"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "cxl_memdev_unregister",
"file": "drivers/cxl/core/memdev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20bd0198bebdd706bd4614b3933ef70d7c19618f",
"digest": {
"function_hash": "240910955651810192287373699659130239689",
"length": 282.0
},
"signature_type": "Function",
"id": "CVE-2023-52849-cf193957"
},
{
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "drivers/cxl/core/memdev.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cad22a757029c3a1985c221a2d4a6491ad4035ae",
"digest": {
"line_hashes": [
"100175410088905967820785519474210502843",
"287105922906519308771673821920480279467",
"234516488863894529890532918582286495140",
"327000852016287168722166700664819694412",
"195146127888158116171125367342882954031"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-52849-f248ea94"
}
]