linux-cve-announce - CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022615-CVE-2022-49188-2a10@gregkh>
Date: Wed, 26 Feb 2025 02:56:33 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49188: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region

The device_node pointer is returned by of_parse_phandle() or
of_get_child_by_name() with refcount incremented.
We should use of_node_put() on it when done.

This function only call of_node_put(node) when of_address_to_resource
succeeds, missing error cases.

The Linux kernel CVE team has assigned CVE-2022-49188 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.8 with commit 051fb70fd4ea40fbc7139186a4890b2fe5cb1e76 and fixed in 5.10.110 with commit f7210ca29a783c94478da02368731e4c9cf7cdb7
	Issue introduced in 4.8 with commit 051fb70fd4ea40fbc7139186a4890b2fe5cb1e76 and fixed in 5.15.33 with commit bd4771ba2cf9e18473a42b5b70175e50d67a64bb
	Issue introduced in 4.8 with commit 051fb70fd4ea40fbc7139186a4890b2fe5cb1e76 and fixed in 5.16.19 with commit a7d988735e757e111f9722de7cf1b40a84a48b1f
	Issue introduced in 4.8 with commit 051fb70fd4ea40fbc7139186a4890b2fe5cb1e76 and fixed in 5.17.2 with commit b9df3007b3cda4936cc50f5a7d2d30505a652828
	Issue introduced in 4.8 with commit 051fb70fd4ea40fbc7139186a4890b2fe5cb1e76 and fixed in 5.18 with commit 07a5dcc4bed9d7cae54adf5aa10ff9f037a3204b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49188
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/remoteproc/qcom_q6v5_mss.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f7210ca29a783c94478da02368731e4c9cf7cdb7
	https://git.kernel.org/stable/c/bd4771ba2cf9e18473a42b5b70175e50d67a64bb
	https://git.kernel.org/stable/c/a7d988735e757e111f9722de7cf1b40a84a48b1f
	https://git.kernel.org/stable/c/b9df3007b3cda4936cc50f5a7d2d30505a652828
	https://git.kernel.org/stable/c/07a5dcc4bed9d7cae54adf5aa10ff9f037a3204b