In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dpll: fix NULL deref in dpll_device_ops() during teardown race<\/p>\n
When the last owner of a dpll device unregisters while a foreign driver
\nstill holds a pin on it via dpll_pin_on_pin_register(), the dpll object
\nstays alive with an empty registration list. A pin notification queued
\nbefore the unregister (e.g. ice reacting to zl3073x_i2c removal) then
\nwalks pin->dpll_refs into dpll_device_ops(), which trips the WARN_ON and
\ndereferences the missing registration. dpll_lock cannot help because the
\nnotification work was queued before the unregistering driver took the
\nlock.<\/p>\n
Treat the empty registration list as a legitimate transient state. Make
\ndpll_priv() and dpll_device_ops() return NULL in that case and make
\nevery pin netlink path that resolves a device from a pin skip such
\ndplls. dpll_cmd_pin_get_one() picks a ref with a live registration and
\nreturns -ENODEV when there is none, the pin dumpit skips such a pin
\ninstead of aborting the dump, dpll_msg_add_pin_dplls() and the
\nfrequency, esync, reference sync and phase adjust set paths skip dead
\nrefs, and dpll_pin_parent_device_set() validates the parent with
\ndpll_device_get_by_id(). dpll_pin_register() is the last caller that
\ndereferenced the device ops without a check, so move its frequency
\nmonitor validation under dpll_lock and tolerate a missing registration
\nthere as well.<\/p>\n
The empty registration list is equivalent to a cleared DPLL_REGISTERED
\nmark, both transitions happen under dpll_lock in dpll_device_register()
\nand dpll_device_unregister(). A pin notification for a pin whose dplls
\nare all gone is now dropped with -ENODEV instead of crashing, all
\ncallers in the core ignore that return value.<\/p>\n
WARNING: drivers\/dpll\/dpll_core.c:1092 at dpll_device_ops+0x24\/0x40,
\n CPU#83: kworker\/u576:3\/23471
\n Modules linked in: … ice … zl3073x_i2c(-) … zl3073x …
\n Workqueue: ice_dpll_wq ice_dpll_pin_notify_work [ice]
\n RIP: 0010:dpll_device_ops+0x24\/0x40
\n Call Trace:<\/p>\n
dpll_cmd_pin_get_one+0x336\/0x520
\n dpll_pin_event_send+0x82\/0x140
\n dpll_pin_on_pin_unregister+0xbb\/0x160
\n ice_dpll_pin_notify_work+0x1bc\/0x1f0 [ice]
\n process_one_work+0x19e\/0x370
\n worker_thread+0x1a6\/0x310
\n kthread+0xe4\/0x120
\n ret_from_fork+0x1a1\/0x270
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n
—[ end trace 0000000000000000 ]—
\n BUG: kernel NULL pointer dereference, address: 0000000000000010
\n #PF: supervisor read access in kernel mode
\n #PF: error_code(0x0000) – not-present page<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dpll: fix NULL deref in dpll_device_ops() during teardown race<\/p>\n
When the last owner of a dpll device unregisters while a foreign dr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25553","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25553","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25553"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25553"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25553"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}