CVE-2021-47439
Assigner: Linux
Published: 2024-05-22T06:19:34.192Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

net: dsa: microchip: Added the condition for scheduling ksz_mib_read_work

When the ksz module is installed and removed using rmmod, kernel crashes
with null pointer dereferrence error. During rmmod, ksz_switch_remove
function tries to cancel the mib_read_workqueue using
cancel_delayed_work_sync routine and unregister switch from dsa.

During dsa_unregister_switch it calls ksz_mac_link_down, which in turn
reschedules the workqueue since mib_interval is non-zero.
Due to which queue executed after mib_interval and it tries to access
dp->slave. But the slave is unregistered in the ksz_switch_remove
function. Hence kernel crashes.

To avoid this crash, before canceling the workqueue, resetted the
mib_interval to 0.

v1 -> v2:
-Removed the if condition in ksz_mib_read_work
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 469b390e1ba3
lessThan: f2e1de075018
status: affected
versionType: git
version: 469b390e1ba3
lessThan: 383239a33cf2
status: affected
versionType: git
version: 469b390e1ba3
lessThan: ef1100ef20f2
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 5.7
status: affected
version: 0
lessThan: 5.7
status: unaffected
versionType: custom
version: 5.10.75
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.14.14
lessThanOrEqual: 5.14.*
status: unaffected
versionType: custom
version: 5.15
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: net: dsa: microchip: Added the condition for scheduling ksz_mib_read_work
x_generator: engine: bippy-d175d3acf727