In the Linux kernel, the following vulnerability has been resolved:
dpll: fix dpllpinonpinregister() for multiple parent pins
In scenario where pin is registered with multiple parent pins via dpllpinonpinregister(..), all belonging to the same dpll device. A second call to dpllpinonpinunregister(..) would cause a call trace, as it tries to use already released registration resources (due to fix introduced in b446631f355e). In this scenario pin was registered twice, so resources are not yet expected to be release until each registered pin/pin pair is unregistered.
Currently, the following crash/call trace is produced when ice driver is removed on the system with installed E810T NIC which includes dpll device:
WARNING: CPU: 51 PID: 9155 at drivers/dpll/dpllcore.c:809 dpllpinops+0x20/0x30 RIP: 0010:dpllpinops+0x20/0x30 Call Trace: ? _warn+0x7f/0x130 ? dpllpinops+0x20/0x30 dpllmsgaddpinfreq+0x37/0x1d0 dpllcmdpingetone+0x1c0/0x400 ? _nlmsgput+0x63/0x80 dpllpineventsend+0x93/0x140 dpllpinonpinunregister+0x3f/0x100 icedplldeinitpins+0xa1/0x230 [ice] ice_remove+0xf1/0x210 [ice]
Fix by adding a parent pointer as a cookie when creating a registration, also when searching for it. For the regular pins pass NULL, this allows to create separated registration for each parent the pin is registered with.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36002.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36002.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"function_hash": "35798974107559279754210289238252844240",
"length": 339.0
},
"id": "CVE-2024-36002-0dd39849",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "__dpll_pin_unregister"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"function_hash": "64456040978207190066999870279876811602",
"length": 531.0
},
"id": "CVE-2024-36002-1357c0dc",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_xa_ref_pin_del"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"function_hash": "35198252646284304844769155901208603956",
"length": 1011.0
},
"id": "CVE-2024-36002-164c3548",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_xa_ref_pin_add"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"function_hash": "244932171166930572045842640619588670608",
"length": 1001.0
},
"id": "CVE-2024-36002-2477d6f0",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_xa_ref_dpll_add"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"function_hash": "63352906967223727763366074544439277814",
"length": 475.0
},
"id": "CVE-2024-36002-47cb6df3",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "__dpll_pin_register"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"function_hash": "111137891052318592457949535981158665429",
"length": 397.0
},
"id": "CVE-2024-36002-4f1f97af",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_pin_on_pin_unregister"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"function_hash": "326275825086972092261746554482479967663",
"length": 502.0
},
"id": "CVE-2024-36002-5b22793c",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_xa_ref_dpll_del"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"function_hash": "27999603468246069404080758561402205725",
"length": 339.0
},
"id": "CVE-2024-36002-683db3a5",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_pin_unregister"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"function_hash": "13054311930729756742680734353832298858",
"length": 477.0
},
"id": "CVE-2024-36002-68b89866",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_pin_register"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"function_hash": "27999603468246069404080758561402205725",
"length": 339.0
},
"id": "CVE-2024-36002-6d19ccdb",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_pin_unregister"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"function_hash": "271840216486525680018387758282432433135",
"length": 1036.0
},
"id": "CVE-2024-36002-7c7c15ad",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_pin_on_pin_register"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"function_hash": "244932171166930572045842640619588670608",
"length": 1001.0
},
"id": "CVE-2024-36002-7d13dfc6",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_xa_ref_dpll_add"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"function_hash": "271840216486525680018387758282432433135",
"length": 1036.0
},
"id": "CVE-2024-36002-7ff61de2",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_pin_on_pin_register"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"function_hash": "35198252646284304844769155901208603956",
"length": 1011.0
},
"id": "CVE-2024-36002-81d62513",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_xa_ref_pin_add"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"line_hashes": [
"51743071226460470085940115502582306536",
"61891004228953670282749934735966040714",
"147432999025964355505816251586780707401",
"30077099968264159207868900875416547328",
"166942928267887753781006808528557459409",
"116898435677600913279745460007233443790",
"188102618439679499556977027219081692266",
"108117893963603397730084625248198583732",
"92256899844223885856153737474756145758",
"148193048854250184985176201717284901291",
"37527811653447350470748586590655980718",
"261511080318300493270209754382846683356",
"163206678112549270685504869992806296019",
"121679526929749472024300332797663691277",
"77531660489165265839080744119657976392",
"220029657987027141157888918578553607350",
"321180010143110987197144175823638390625",
"141281000211341179422426892021552383969",
"194065768246130798504307576025614184467",
"84115325046227761062223307805287608896",
"280789870836701778282689529129269601141",
"34271188132687971323474371581943148035",
"210037260242388271398937933136730526144",
"257572446790510124404268106761556714013",
"312156852317876909970367058154556866826",
"193629830866676649545290581116142093702",
"289633170014040607367368652139714178244",
"220029657987027141157888918578553607350",
"321180010143110987197144175823638390625",
"44110243411779789046317385097195761467",
"147341347549879617374276164546712861823",
"98946195058928482537160739420951044948",
"334559014560364439146438405174816721185",
"190241048441775292271929411853045531758",
"82254466978898777646308395601720095114",
"220029657987027141157888918578553607350",
"119839277605331355621045753198613419725",
"7776608939168297482679738397674114315",
"194065768246130798504307576025614184467",
"84115325046227761062223307805287608896",
"280789870836701778282689529129269601141",
"34271188132687971323474371581943148035",
"210037260242388271398937933136730526144",
"257572446790510124404268106761556714013",
"130954813030617224503089963614681260632",
"194626247485630535675104730655719900703",
"188453359439148766656758229071009654230",
"220029657987027141157888918578553607350",
"119839277605331355621045753198613419725",
"39685439892896744829417852452893691095",
"68081803449249151995954345226432057663",
"88195029171171123772081061102859173949",
"330083842310265886689814992059735059933",
"330457353862862768975875926482534834796",
"282913520866602899833805583214796624771",
"138141316963795346051794350944730585287",
"190860752541801563479721045414768331843",
"94371810373524165872135173315766652144",
"184061491358866991411455907914729918226",
"175654611453719765589734627736914815427",
"245529215539888393367436560821852782297",
"235989952086791801934719081371298018312",
"180141556022130734076575067979369395275",
"334127201660178050447661940851117105581",
"221302584849319662543456952191299812562",
"32792881748130154971107097540766467028",
"321278404244017384391872817383173683613",
"302972043643225766806783800673830256590",
"94278210069321871056967041761308431778",
"126298275391837821696858848690818213574",
"307745498807192389822432917551133474829",
"269962219758110067555910265778987187332",
"125896011762883440918893648254144064085",
"28531508358949264844722121372127207749",
"96233953349231493911732286271194782224",
"245075506445092574879573094538149696631",
"143567935909264205018128783155096583535",
"171801417318775561045877288420027274354",
"39894712945673050775938018618699031872",
"158076380321780504732778655474520534324",
"127146951533444850007637463498194378569",
"31667487724385840169502782345356269517",
"105876886123160627161056198375928138111",
"85736631509770442142932432566598291584",
"134149348150295735411982877506385923238",
"295750610238175624009251768859488761638",
"25778458777212546647481214762872511585",
"186018509946209372347417449679464906294",
"258721419867247136585032551890817379883",
"47460354366530564973327173778795855861",
"84479373564710892265078951583424469120",
"236576846527236782761715871424246597199",
"47111561960196639558334524310746032349",
"60648696808107038818729369218542556302",
"123700157078871736072503657076708104224",
"26704343162022795214495353226088201637",
"83872244691446178902025115877023444464",
"224606444874357195332491464591162763923",
"221492399298894380145747728027322019955",
"126101815035193561771477524480026848574",
"103923265760236908579080675551359565507",
"204469732688434617464673249899532662908",
"5086413625867906764970503108532437627",
"270637909950494658049284139533123128897",
"133925972685385989284994945917600244341",
"263359079527839297350974726813628509061"
],
"threshold": 0.9
},
"id": "CVE-2024-36002-831cc12f",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"function_hash": "13054311930729756742680734353832298858",
"length": 477.0
},
"id": "CVE-2024-36002-ab98b49a",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_pin_register"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"function_hash": "326275825086972092261746554482479967663",
"length": 502.0
},
"id": "CVE-2024-36002-cad4b4d8",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_xa_ref_dpll_del"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"line_hashes": [
"51743071226460470085940115502582306536",
"61891004228953670282749934735966040714",
"147432999025964355505816251586780707401",
"30077099968264159207868900875416547328",
"166942928267887753781006808528557459409",
"116898435677600913279745460007233443790",
"188102618439679499556977027219081692266",
"108117893963603397730084625248198583732",
"92256899844223885856153737474756145758",
"148193048854250184985176201717284901291",
"37527811653447350470748586590655980718",
"261511080318300493270209754382846683356",
"163206678112549270685504869992806296019",
"121679526929749472024300332797663691277",
"77531660489165265839080744119657976392",
"220029657987027141157888918578553607350",
"321180010143110987197144175823638390625",
"141281000211341179422426892021552383969",
"194065768246130798504307576025614184467",
"84115325046227761062223307805287608896",
"280789870836701778282689529129269601141",
"34271188132687971323474371581943148035",
"210037260242388271398937933136730526144",
"257572446790510124404268106761556714013",
"312156852317876909970367058154556866826",
"193629830866676649545290581116142093702",
"289633170014040607367368652139714178244",
"220029657987027141157888918578553607350",
"321180010143110987197144175823638390625",
"44110243411779789046317385097195761467",
"147341347549879617374276164546712861823",
"98946195058928482537160739420951044948",
"334559014560364439146438405174816721185",
"190241048441775292271929411853045531758",
"82254466978898777646308395601720095114",
"220029657987027141157888918578553607350",
"119839277605331355621045753198613419725",
"7776608939168297482679738397674114315",
"194065768246130798504307576025614184467",
"84115325046227761062223307805287608896",
"280789870836701778282689529129269601141",
"34271188132687971323474371581943148035",
"210037260242388271398937933136730526144",
"257572446790510124404268106761556714013",
"130954813030617224503089963614681260632",
"194626247485630535675104730655719900703",
"188453359439148766656758229071009654230",
"220029657987027141157888918578553607350",
"119839277605331355621045753198613419725",
"39685439892896744829417852452893691095",
"68081803449249151995954345226432057663",
"88195029171171123772081061102859173949",
"330083842310265886689814992059735059933",
"330457353862862768975875926482534834796",
"282913520866602899833805583214796624771",
"138141316963795346051794350944730585287",
"190860752541801563479721045414768331843",
"94371810373524165872135173315766652144",
"184061491358866991411455907914729918226",
"175654611453719765589734627736914815427",
"245529215539888393367436560821852782297",
"235989952086791801934719081371298018312",
"180141556022130734076575067979369395275",
"334127201660178050447661940851117105581",
"221302584849319662543456952191299812562",
"32792881748130154971107097540766467028",
"321278404244017384391872817383173683613",
"302972043643225766806783800673830256590",
"94278210069321871056967041761308431778",
"126298275391837821696858848690818213574",
"307745498807192389822432917551133474829",
"269962219758110067555910265778987187332",
"125896011762883440918893648254144064085",
"28531508358949264844722121372127207749",
"96233953349231493911732286271194782224",
"245075506445092574879573094538149696631",
"143567935909264205018128783155096583535",
"171801417318775561045877288420027274354",
"39894712945673050775938018618699031872",
"158076380321780504732778655474520534324",
"127146951533444850007637463498194378569",
"31667487724385840169502782345356269517",
"105876886123160627161056198375928138111",
"85736631509770442142932432566598291584",
"134149348150295735411982877506385923238",
"295750610238175624009251768859488761638",
"25778458777212546647481214762872511585",
"186018509946209372347417449679464906294",
"258721419867247136585032551890817379883",
"47460354366530564973327173778795855861",
"84479373564710892265078951583424469120",
"236576846527236782761715871424246597199",
"47111561960196639558334524310746032349",
"60648696808107038818729369218542556302",
"123700157078871736072503657076708104224",
"26704343162022795214495353226088201637",
"83872244691446178902025115877023444464",
"224606444874357195332491464591162763923",
"221492399298894380145747728027322019955",
"126101815035193561771477524480026848574",
"103923265760236908579080675551359565507",
"204469732688434617464673249899532662908",
"5086413625867906764970503108532437627",
"270637909950494658049284139533123128897",
"133925972685385989284994945917600244341",
"263359079527839297350974726813628509061"
],
"threshold": 0.9
},
"id": "CVE-2024-36002-d2906a23",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"function_hash": "63352906967223727763366074544439277814",
"length": 475.0
},
"id": "CVE-2024-36002-d8877ba1",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "__dpll_pin_register"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"function_hash": "64456040978207190066999870279876811602",
"length": 531.0
},
"id": "CVE-2024-36002-e05f545d",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_xa_ref_pin_del"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38d7b94e81d068b8d8c8392f421cfd2c3bbfd1a6",
"digest": {
"function_hash": "111137891052318592457949535981158665429",
"length": 397.0
},
"id": "CVE-2024-36002-f12a0d0c",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "dpll_pin_on_pin_unregister"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f3e1cf62d18220a3aa97e084e7a3552debece9fc",
"digest": {
"function_hash": "35798974107559279754210289238252844240",
"length": 339.0
},
"id": "CVE-2024-36002-f269cbe4",
"deprecated": false,
"target": {
"file": "drivers/dpll/dpll_core.c",
"function": "__dpll_pin_unregister"
}
}
]