CVE-2023-52492
Assigner: Linux
Published: 2024-02-29T15:52:10.499Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: fix NULL pointer in channel unregistration function

__dma_async_device_channel_register() can fail. In case of failure,
chan->local is freed (with free_percpu()), and chan->local is nullified.
When dma_async_device_unregister() is called (because of managed API or
intentionally by DMA controller driver), channels are unconditionally
unregistered, leading to this NULL pointer:
[    1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
[...]
[    1.484499] Call trace:
[    1.486930]  device_del+0x40/0x394
[    1.490314]  device_unregister+0x20/0x7c
[    1.494220]  __dma_async_device_channel_unregister+0x68/0xc0

Look at dma_async_device_register() function error path, channel device
unregistration is done only if chan->local is not NULL.

Then add the same condition at the beginning of
__dma_async_device_channel_unregister() function, to avoid NULL pointer
issue whatever the API used to reach this function.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: d2fb0a043838
lessThan: 9de69732dde4
status: affected
versionType: git
version: d2fb0a043838
lessThan: 047fce470412
status: affected
versionType: git
version: d2fb0a043838
lessThan: 2ab32986a0b9
status: affected
versionType: git
version: d2fb0a043838
lessThan: 7f0ccfad2031
status: affected
versionType: git
version: d2fb0a043838
lessThan: 9263fd2a6348
status: affected
versionType: git
version: d2fb0a043838
lessThan: f5c24d94512f
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 5.6
status: affected
version: 0
lessThan: 5.6
status: unaffected
versionType: custom
version: 5.10.210
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.15.149
lessThanOrEqual: 5.15.*
status: unaffected
versionType: custom
version: 6.1.76
lessThanOrEqual: 6.1.*
status: unaffected
versionType: custom
version: 6.6.15
lessThanOrEqual: 6.6.*
status: unaffected
versionType: custom
version: 6.7.3
lessThanOrEqual: 6.7.*
status: unaffected
versionType: custom
version: 6.8
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: dmaengine: fix NULL pointer in channel unregistration function
x_generator: engine: bippy-8df59b4913de