CVE-2022-48814

net: dsa: seville: register the mdiobus under devres

published July 16, 2024

CVSS
—
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: seville: register the mdiobus under devres

As explained in commits:

74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres")

5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres")

mdiobus_free() will panic when called from devm_mdiobus_free() <-

devres_release_all() <- __device_release_driver(), and that mdiobus was

not previously unregistered.

The Seville VSC9959 switch is a platform device, so the initial set of

constraints that I thought would cause this (I2C or SPI buses which call

->remove on ->shutdown) do not apply. But there is one more which

applies here.

If the DSA master itself is on a bus that calls ->remove from ->shutdown

(like dpaa2-eth, which is on the fsl-mc bus), there is a device link

between the switch and the DSA master, and device_links_unbind_consumers()

will unbind the seville switch driver on shutdown.

So the same treatment must be applied to all DSA switch drivers, which

is: either use devres for both the mdiobus allocation and registration,

or don't use devres at all.

The seville driver has a code structure that could accommodate both the

mdiobus_unregister and mdiobus_free calls, but it has an external

dependency upon mscc_miim_setup() from mdio-mscc-miim.c, which calls

devm_mdiobus_alloc_size() on its behalf. So rather than restructuring

that, and exporting yet one more symbol mscc_miim_teardown(), let's work

with devres and replace of_mdiobus_register with the devres variant.

When we use all-devres, we can ensure that devres doesn't free a

still-registered bus (it either runs both callbacks, or none).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.3th percentile
Published
2024-07-16T11:44Z
EPSS history
Timeline
  • 16 JUL 11:44Z
    net: dsa: seville: register the mdiobus under devres
    cvelistv5