Message-ID: <2024052228-CVE-2021-47472-bd55@gregkh>
Date: Wed, 22 May 2024 08:23:38 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2021-47472: net: mdiobus: Fix memory leak in __mdiobus_register

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: mdiobus: Fix memory leak in __mdiobus_register

Once device_register() failed, we should call put_device() to
decrement reference count for cleanup. Or it will cause memory
leak.

BUG: memory leak
unreferenced object 0xffff888114032e00 (size 256):
  comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff  ................
    08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff  .........ve.....
  backtrace:
    [<ffffffff8265cfab>] kmalloc include/linux/slab.h:591 [inline]
    [<ffffffff8265cfab>] kzalloc include/linux/slab.h:721 [inline]
    [<ffffffff8265cfab>] device_private_init drivers/base/core.c:3203 [inline]
    [<ffffffff8265cfab>] device_add+0x89b/0xdf0 drivers/base/core.c:3253
    [<ffffffff828dd643>] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537
    [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
    [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
    [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
    [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
    [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
    [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
    [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
    [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
    [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
    [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
    [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
    [<ffffffff82660916>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
    [<ffffffff8265cd0b>] device_add+0x5fb/0xdf0 drivers/base/core.c:3359
    [<ffffffff82c343b9>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170
    [<ffffffff82c4473c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238

BUG: memory leak
unreferenced object 0xffff888116f06900 (size 32):
  comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s)
  hex dump (first 32 bytes):
    75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00  usb-001:003.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81484516>] kstrdup+0x36/0x70 mm/util.c:60
    [<ffffffff814845a3>] kstrdup_const+0x53/0x80 mm/util.c:83
    [<ffffffff82296ba2>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
    [<ffffffff82358d4b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
    [<ffffffff826575f3>] dev_set_name+0x63/0x90 drivers/base/core.c:3147
    [<ffffffff828dd63b>] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535
    [<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
    [<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
    [<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
    [<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
    [<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
    [<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
    [<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
    [<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
    [<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
    [<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
    [<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
    [<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969

The Linux kernel CVE team has assigned CVE-2021-47472 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.4.290 with commit fd2400dd4f1b
	Fixed in 4.4.291 with commit b89f4537d7fd
	Fixed in 4.9.288 with commit bc5f2f3431ce
	Fixed in 4.9.289 with commit 2bc10dca9432
	Fixed in 4.14.253 with commit 4ec0f9abc512
	Fixed in 4.14.254 with commit fdbffd95c4ce
	Fixed in 4.19.214 with commit a9831afa2dc8
	Fixed in 4.19.215 with commit 8121d0d4fd10
	Fixed in 5.4.156 with commit b0feaa8376f5
	Fixed in 5.4.157 with commit 6a18d155d5b3
	Fixed in 5.10.76 with commit 3a0dc2e35a5d
	Fixed in 5.10.77 with commit c828115a14ea
	Fixed in 5.14.15 with commit 0c4e87ba11eb
	Fixed in 5.14.16 with commit 8ba94a7f7b9f
	Fixed in 5.15 with commit ab609f25d198

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47472
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/phy/mdio_bus.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fd2400dd4f1b8bd7a309b1b424d9e0d188151b01
	https://git.kernel.org/stable/c/b89f4537d7fdbd0bafb6d8a66a484e0bc99871a4
	https://git.kernel.org/stable/c/bc5f2f3431ced08300e4cb3aff35f1da14c26433
	https://git.kernel.org/stable/c/2bc10dca9432fadb09e45127e258fc7127fd346d
	https://git.kernel.org/stable/c/4ec0f9abc512cc02fb04daa89ccf6697e80ab417
	https://git.kernel.org/stable/c/fdbffd95c4ce94d2197c504008eaac46b16bc5a4
	https://git.kernel.org/stable/c/a9831afa2dc8a18205403907c41aa4e0950ac611
	https://git.kernel.org/stable/c/8121d0d4fd108280f5cd7b7fe8c6592adaa37be9
	https://git.kernel.org/stable/c/b0feaa8376f52357bf2fd020d0c471713a859728
	https://git.kernel.org/stable/c/6a18d155d5b35ad50c8fac2be091212487ae58ec
	https://git.kernel.org/stable/c/3a0dc2e35a5d6546b1db87fe985582dadc64fe7b
	https://git.kernel.org/stable/c/c828115a14eacbf42042770fd68543f134e89efa
	https://git.kernel.org/stable/c/0c4e87ba11eb331dca2315d484d08441b8c13193
	https://git.kernel.org/stable/c/8ba94a7f7b9fc2a2b808ccceb99b77135deae21a
	https://git.kernel.org/stable/c/ab609f25d19858513919369ff3d9a63c02cd9e2e

Powered by blists - more mailing lists