CVE-2023-52492

dmaengine: fix NULL pointer in channel unregistration function

Medium · published February 29, 2024

CVSS v3.1
4.4
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: fix NULL pointer in channel unregistration function

__dma_async_device_channel_register() can fail. In case of failure,

chan->local is freed (with free_percpu()), and chan->local is nullified.

When dma_async_device_unregister() is called (because of managed API or

intentionally by DMA controller driver), channels are unconditionally

unregistered, leading to this NULL pointer:

[ 1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0

[...]

[ 1.484499] Call trace:

[ 1.486930] device_del+0x40/0x394

[ 1.490314] device_unregister+0x20/0x7c

[ 1.494220] __dma_async_device_channel_unregister+0x68/0xc0

Look at dma_async_device_register() function error path, channel device

unregistration is done only if chan->local is not NULL.

Then add the same condition at the beginning of

__dma_async_device_channel_unregister() function, to avoid NULL pointer

issue whatever the API used to reach this function.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.3th percentile
Published
2024-02-29T15:52Z
EPSS history
Timeline
  • 29 FEB 15:52Z
    dmaengine: fix NULL pointer in channel unregistration function
    cvelistv5