CVE-2022-50378

In the Linux kernel, the following vulnerability has been resolved:

drm/meson: reorder driver deinit sequence to fix use-after-free bug

Unloading the driver triggers the following KASAN warning:

[ +0.006275] =============================================================

[ +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0

[ +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695

[ +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1

[ +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT)

[ +0.000008] Call trace:

[ +0.000007] dump_backtrace+0x1ec/0x280

[ +0.000013] show_stack+0x24/0x80

[ +0.000008] dump_stack_lvl+0x98/0xd4

[ +0.000011] print_address_description.constprop.0+0x80/0x520

[ +0.000011] print_report+0x128/0x260

[ +0.000007] kasan_report+0xb8/0xfc

[ +0.000008] __asan_report_load8_noabort+0x3c/0x50

[ +0.000010] __list_del_entry_valid+0xe0/0x1a0

[ +0.000009] drm_atomic_private_obj_fini+0x30/0x200 [drm]

[ +0.000172] drm_bridge_detach+0x94/0x260 [drm]

[ +0.000145] drm_encoder_cleanup+0xa4/0x290 [drm]

[ +0.000144] drm_mode_config_cleanup+0x118/0x740 [drm]

[ +0.000143] drm_mode_config_init_release+0x1c/0x2c [drm]

[ +0.000144] drm_managed_release+0x170/0x414 [drm]

[ +0.000142] drm_dev_put.part.0+0xc0/0x124 [drm]

[ +0.000143] drm_dev_put+0x20/0x30 [drm]

[ +0.000142] meson_drv_unbind+0x1d8/0x2ac [meson_drm]

[ +0.000028] take_down_aggregate_device+0xb0/0x160

[ +0.000016] component_del+0x18c/0x360

[ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]

[ +0.000015] platform_remove+0x64/0xb0

[ +0.000009] device_remove+0xb8/0x154

[ +0.000009] device_release_driver_internal+0x398/0x5b0

[ +0.000009] driver_detach+0xac/0x1b0

[ +0.000009] bus_remove_driver+0x158/0x29c

[ +0.000009] driver_unregister+0x70/0xb0

[ +0.000008] platform_driver_unregister+0x20/0x2c

[ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi]

[ +0.000012] __do_sys_delete_module+0x288/0x400

[ +0.000011] __arm64_sys_delete_module+0x5c/0x80

[ +0.000009] invoke_syscall+0x74/0x260

[ +0.000009] el0_svc_common.constprop.0+0xcc/0x260

[ +0.000009] do_el0_svc+0x50/0x70

[ +0.000007] el0_svc+0x68/0x1a0

[ +0.000012] el0t_64_sync_handler+0x11c/0x150

[ +0.000008] el0t_64_sync+0x18c/0x190

[ +0.000018] Allocated by task 0:

[ +0.000007] (stack is not available)

[ +0.000011] Freed by task 2695:

[ +0.000008] kasan_save_stack+0x2c/0x5c

[ +0.000011] kasan_set_track+0x2c/0x40

[ +0.000008] kasan_set_free_info+0x28/0x50

[ +0.000009] ____kasan_slab_free+0x128/0x1d4

[ +0.000008] __kasan_slab_free+0x18/0x24

[ +0.000007] slab_free_freelist_hook+0x108/0x230

[ +0.000011] kfree+0x110/0x35c

[ +0.000008] release_nodes+0xf0/0x16c

[ +0.000009] devres_release_group+0x180/0x270

[ +0.000008] component_unbind+0x128/0x1e0

[ +0.000010] component_unbind_all+0x1b8/0x264

[ +0.000009] meson_drv_unbind+0x1a0/0x2ac [meson_drm]

[ +0.000025] take_down_aggregate_device+0xb0/0x160

[ +0.000009] component_del+0x18c/0x360

[ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi]

[ +0.000012] platform_remove+0x64/0xb0

[ +0.000008] device_remove+0xb8/0x154

[ +0.000009] device_release_driver_internal+0x398/0x5b0

[ +0.000009] driver_detach+0xac/0x1b0

[ +0.000009] bus_remove_driver+0x158/0x29c

[ +0.000008] driver_unregister+0x70/0xb0

[ +0.000008] platform_driver_unregister+0x20/0x2c

[ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi]

[ +0.000011] __do_sys_delete_module+0x288/0x400

[ +0.000010] __arm64_sys_delete_module+0x5c/0x80

[ +0.000008] invoke_syscall+0x74/0x260

[ +0.000008] el0_svc_common.constprop.0+0xcc/0x260

[ +0.000008] do_el0_svc+0x50/0x70

[ +0.000007] el0_svc+0x68/0x1a0

[ +0.000009] el0t_64_sync_handler+0x11c/0x150

[ +0.000009] el0t_64_sync+0x18c/0x190

[ +0.000014] The buggy address belongs to the object at ffff000020c39000

---truncated---