CVE-2022-48707

cxl/region: Fix null pointer dereference for resetting decoder

published May 21, 2024

CVSS
—
EPSS
0%
Percentile
10.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

cxl/region: Fix null pointer dereference for resetting decoder

Not all decoders have a reset callback.

The CXL specification allows a host bridge with a single root port to

have no explicit HDM decoders. Currently the region driver assumes there

are none. As such the CXL core creates a special pass through decoder

instance without a commit/reset callback.

Prior to this patch, the ->reset() callback was called unconditionally when

calling cxl_region_decode_reset. Thus a configuration with 1 Host Bridge,

1 Root Port, and one directly attached CXL type 3 device or multiple CXL

type 3 devices attached to downstream ports of a switch can cause a null

pointer dereference.

Before the fix, a kernel crash was observed when we destroy the region, and

a pass through decoder is reset.

The issue can be reproduced as below,

1) create a region with a CXL setup which includes a HB with a

single root port under which a memdev is attached directly.

2) destroy the region with cxl destroy-region regionX -f.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00205 · 10.0th percentile
Published
2024-05-21T15:22Z
EPSS history
Timeline
  • 21 MAY 15:22Z
    cxl/region: Fix null pointer dereference for resetting decoder
    cvelistv5