In the Linux kernel, the following vulnerability has been resolved:
media: qcom: camss: fix error path on configuration of power domains
There is a chance to meet runtime issues during configuration of CAMSS power domains, because on the error path devpmdomain_detach() is unexpectedly called with NULL or error pointer.
One of the simplest ways to reproduce the problem is to probe CAMSS driver before registration of CAMSS power domains, for instance if a platform CAMCC driver is simply not built.
Warning backtrace example:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a2
<snip>
pc : dev_pm_domain_detach+0x8/0x48
lr : camss_probe+0x374/0x9c0
<snip>
Call trace:
dev_pm_domain_detach+0x8/0x48
platform_probe+0x70/0xf0
really_probe+0xc4/0x2a8
__driver_probe_device+0x80/0x140
driver_probe_device+0x48/0x170
__device_attach_driver+0xc0/0x148
bus_for_each_drv+0x88/0xf0
__device_attach+0xb0/0x1c0
device_initial_probe+0x1c/0x30
bus_probe_device+0xb4/0xc0
deferred_probe_work_func+0x90/0xd0
process_one_work+0x164/0x3e0
worker_thread+0x310/0x420
kthread+0x120/0x130
ret_from_fork+0x10/0x20
[
{
"id": "CVE-2024-56580-4f21ddac",
"target": {
"file": "drivers/media/platform/qcom/camss/camss.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"144854011028837202141919191190314606542",
"232799533752202546918395009919665144133",
"263097303050630715701203574131714453280",
"314726218825903015029939684216640347672",
"209891041110932728671136712834097050978",
"170855267797812991704771826168350851761",
"6175031627058302165912623793817349009",
"79936202355620554287434640947005830595",
"66094875779160359509698167688077092095",
"269978140165467650024941810142679637577",
"48850226950129950867158081670603677254",
"90134254438685654424143700574123170233",
"88041630260611883020670368758191454398",
"210347845430805287836921845531852476408",
"264051784129635297184630167663018957739",
"26032462390075717236450180206204193759",
"305056858989079913042538517703040576292",
"124179019544092117297857818437262868878",
"285825296035376403618453614455956571694"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f45d65b781499d2a79eca12155532739c876aa2",
"signature_version": "v1"
},
{
"id": "CVE-2024-56580-8ca983ff",
"target": {
"file": "drivers/media/platform/qcom/camss/camss.c",
"function": "camss_configure_pd"
},
"digest": {
"function_hash": "32871880393126939703488980575260520888",
"length": 1270.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f45d65b781499d2a79eca12155532739c876aa2",
"signature_version": "v1"
},
{
"id": "CVE-2024-56580-b4a5cb6b",
"target": {
"file": "drivers/media/platform/qcom/camss/camss.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"144854011028837202141919191190314606542",
"232799533752202546918395009919665144133",
"263097303050630715701203574131714453280",
"314726218825903015029939684216640347672",
"209891041110932728671136712834097050978",
"170855267797812991704771826168350851761",
"6175031627058302165912623793817349009",
"79936202355620554287434640947005830595",
"66094875779160359509698167688077092095",
"269978140165467650024941810142679637577",
"48850226950129950867158081670603677254",
"90134254438685654424143700574123170233",
"88041630260611883020670368758191454398",
"210347845430805287836921845531852476408",
"264051784129635297184630167663018957739",
"26032462390075717236450180206204193759",
"305056858989079913042538517703040576292",
"124179019544092117297857818437262868878",
"285825296035376403618453614455956571694"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c98586d8d01c9e860e7acc3807c2afeb1dc14e8a",
"signature_version": "v1"
},
{
"id": "CVE-2024-56580-e8e5dd07",
"target": {
"file": "drivers/media/platform/qcom/camss/camss.c",
"function": "camss_configure_pd"
},
"digest": {
"function_hash": "32871880393126939703488980575260520888",
"length": 1270.0
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c98586d8d01c9e860e7acc3807c2afeb1dc14e8a",
"signature_version": "v1"
}
]