linux-cve-announce - CVE-2023-52730: mmc: sdio: fix possible resource leaks in some error paths

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024052158-CVE-2023-52730-1c8f@gregkh>
Date: Tue, 21 May 2024 17:23:07 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2023-52730: mmc: sdio: fix possible resource leaks in some error paths

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mmc: sdio: fix possible resource leaks in some error paths

If sdio_add_func() or sdio_init_func() fails, sdio_remove_func() can
not release the resources, because the sdio function is not presented
in these two cases, it won't call of_node_put() or put_device().

To fix these leaks, make sdio_func_present() only control whether
device_del() needs to be called or not, then always call of_node_put()
and put_device().

In error case in sdio_init_func(), the reference of 'card->dev' is
not get, to avoid redundant put in sdio_free_func_cis(), move the
get_device() to sdio_alloc_func() and put_device() to sdio_release_func(),
it can keep the get/put function be balanced.

Without this patch, while doing fault inject test, it can get the
following leak reports, after this fix, the leak is gone.

unreferenced object 0xffff888112514000 (size 2048):
  comm "kworker/3:2", pid 65, jiffies 4294741614 (age 124.774s)
  hex dump (first 32 bytes):
    00 e0 6f 12 81 88 ff ff 60 58 8d 06 81 88 ff ff  ..o.....`X......
    10 40 51 12 81 88 ff ff 10 40 51 12 81 88 ff ff  .@.......@......
  backtrace:
    [<000000009e5931da>] kmalloc_trace+0x21/0x110
    [<000000002f839ccb>] mmc_alloc_card+0x38/0xb0 [mmc_core]
    [<0000000004adcbf6>] mmc_sdio_init_card+0xde/0x170 [mmc_core]
    [<000000007538fea0>] mmc_attach_sdio+0xcb/0x1b0 [mmc_core]
    [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core]

unreferenced object 0xffff888112511000 (size 2048):
  comm "kworker/3:2", pid 65, jiffies 4294741623 (age 124.766s)
  hex dump (first 32 bytes):
    00 40 51 12 81 88 ff ff e0 58 8d 06 81 88 ff ff  .@.......X......
    10 10 51 12 81 88 ff ff 10 10 51 12 81 88 ff ff  ..Q.......Q.....
  backtrace:
    [<000000009e5931da>] kmalloc_trace+0x21/0x110
    [<00000000fcbe706c>] sdio_alloc_func+0x35/0x100 [mmc_core]
    [<00000000c68f4b50>] mmc_attach_sdio.cold.18+0xb1/0x395 [mmc_core]
    [<00000000d4fdeba7>] mmc_rescan+0x54a/0x640 [mmc_core]

The Linux kernel CVE team has assigned CVE-2023-52730 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.33 with commit 3d10a1ba0d37 and fixed in 4.14.306 with commit 92ff03c2563c
	Issue introduced in 2.6.33 with commit 3d10a1ba0d37 and fixed in 4.19.273 with commit 5c7858adada3
	Issue introduced in 2.6.33 with commit 3d10a1ba0d37 and fixed in 5.4.232 with commit 761db46b29b4
	Issue introduced in 2.6.33 with commit 3d10a1ba0d37 and fixed in 5.10.169 with commit 30716d9f0fa1
	Issue introduced in 2.6.33 with commit 3d10a1ba0d37 and fixed in 5.15.95 with commit 1e06cf04239e
	Issue introduced in 2.6.33 with commit 3d10a1ba0d37 and fixed in 6.1.13 with commit f855d31bb38d
	Issue introduced in 2.6.33 with commit 3d10a1ba0d37 and fixed in 6.2 with commit 605d9fb9556f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52730
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/mmc/core/sdio_bus.c
	drivers/mmc/core/sdio_cis.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/92ff03c2563c9b57a027c744750f3b7d2f261c58
	https://git.kernel.org/stable/c/5c7858adada31dbed042448cff6997dd6efc472a
	https://git.kernel.org/stable/c/761db46b29b496946046d8cb33c7ea6de6bef36e
	https://git.kernel.org/stable/c/30716d9f0fa1766e522cf24c8a456244e4fc9931
	https://git.kernel.org/stable/c/1e06cf04239e202248c8fa356bf11449dc73cfbd
	https://git.kernel.org/stable/c/f855d31bb38d663c3ba672345d7cce9324ba3b72
	https://git.kernel.org/stable/c/605d9fb9556f8f5fb4566f4df1480f280f308ded