CVE-2023-52849

cxl/mem: Fix shutdown order

published May 21, 2024

CVSS
—
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

cxl/mem: Fix shutdown order

Ira reports that removing cxl_mock_mem causes a crash with the following

trace:

BUG: kernel NULL pointer dereference, address: 0000000000000044

[..]

RIP: 0010:cxl_region_decode_reset+0x7f/0x180 [cxl_core]

[..]

Call Trace:

<TASK>

cxl_region_detach+0xe8/0x210 [cxl_core]

cxl_decoder_kill_region+0x27/0x40 [cxl_core]

cxld_unregister+0x29/0x40 [cxl_core]

devres_release_all+0xb8/0x110

device_unbind_cleanup+0xe/0x70

device_release_driver_internal+0x1d2/0x210

bus_remove_device+0xd7/0x150

device_del+0x155/0x3e0

device_unregister+0x13/0x60

devm_release_action+0x4d/0x90

? __pfx_unregister_port+0x10/0x10 [cxl_core]

delete_endpoint+0x121/0x130 [cxl_core]

devres_release_all+0xb8/0x110

device_unbind_cleanup+0xe/0x70

device_release_driver_internal+0x1d2/0x210

bus_remove_device+0xd7/0x150

device_del+0x155/0x3e0

? lock_release+0x142/0x290

cdev_device_del+0x15/0x50

cxl_memdev_unregister+0x54/0x70 [cxl_core]

This crash is due to the clearing out the cxl_memdev's driver context

(@cxlds) before the subsystem is done with it. This is ultimately due to

the region(s), that this memdev is a member, being torn down and expecting

to be able to de-reference @cxlds, like here:

static int cxl_region_decode_reset(struct cxl_region *cxlr, int count)

...

if (cxlds->rcd)

goto endpoint_reset;

...

Fix it by keeping the driver context valid until memdev-device

unregistration, and subsequently the entire stack of related

dependencies, unwinds.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00236 · 13.7th percentile
Published
2024-05-21T15:31Z
EPSS history
Timeline
  • 21 MAY 15:31Z
    cxl/mem: Fix shutdown order
    cvelistv5