CVE-2022-49926

net: dsa: Fix possible memory leaks in dsa_loop_init()

Medium · published May 1, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
8.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: Fix possible memory leaks in dsa_loop_init()

kmemleak reported memory leaks in dsa_loop_init():

kmemleak: 12 new suspected memory leaks

unreferenced object 0xffff8880138ce000 (size 2048):

comm "modprobe", pid 390, jiffies 4295040478 (age 238.976s)

backtrace:

[<000000006a94f1d5>] kmalloc_trace+0x26/0x60

[<00000000a9c44622>] phy_device_create+0x5d/0x970

[<00000000d0ee2afc>] get_phy_device+0xf3/0x2b0

[<00000000dca0c71f>] __fixed_phy_register.part.0+0x92/0x4e0

[<000000008a834798>] fixed_phy_register+0x84/0xb0

[<0000000055223fcb>] dsa_loop_init+0xa9/0x116 [dsa_loop]

...

There are two reasons for memleak in dsa_loop_init().

First, fixed_phy_register() create and register phy_device:

fixed_phy_register()

get_phy_device()

phy_device_create() # freed by phy_device_free()

phy_device_register() # freed by phy_device_remove()

But fixed_phy_unregister() only calls phy_device_remove().

So the memory allocated in phy_device_create() is leaked.

Second, when mdio_driver_register() fail in dsa_loop_init(),

it just returns and there is no cleanup for phydevs.

Fix the problems by catching the error of mdio_driver_register()

in dsa_loop_init(), then calling both fixed_phy_unregister() and

phy_device_free() to release phydevs.

Also add a function for phydevs cleanup to avoid duplacate.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00188 · 8.0th percentile
Published
2025-05-01T14:11Z
EPSS history
Timeline
  • 01 MAY 14:11Z
    net: dsa: Fix possible memory leaks in dsa_loop_init()
    cvelistv5