CVE-2022-48817

net: dsa: ar9331: register the mdiobus under devres

published July 16, 2024

CVSS
—
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: ar9331: register the mdiobus under devres

As explained in commits:

74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres")

5135e96a3dd2 ("net: dsa: don't allocate the slave_mii_bus using devres")

mdiobus_free() will panic when called from devm_mdiobus_free() <-

devres_release_all() <- __device_release_driver(), and that mdiobus was

not previously unregistered.

The ar9331 is an MDIO device, so the initial set of constraints that I

thought would cause this (I2C or SPI buses which call ->remove on

->shutdown) do not apply. But there is one more which applies here.

If the DSA master itself is on a bus that calls ->remove from ->shutdown

(like dpaa2-eth, which is on the fsl-mc bus), there is a device link

between the switch and the DSA master, and device_links_unbind_consumers()

will unbind the ar9331 switch driver on shutdown.

So the same treatment must be applied to all DSA switch drivers, which

is: either use devres for both the mdiobus allocation and registration,

or don't use devres at all.

The ar9331 driver doesn't have a complex code structure for mdiobus

removal, so just replace of_mdiobus_register with the devres variant in

order to be all-devres and ensure that we don't free a still-registered

bus.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.3th percentile
Published
2024-07-16T11:44Z
EPSS history
Timeline
  • 16 JUL 11:44Z
    net: dsa: ar9331: register the mdiobus under devres
    cvelistv5