linux-cve-announce - CVE-2022-49483: drm/msm/disp/dpu1: avoid clearing hw interrupts if hw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022604-CVE-2022-49483-dd7b@gregkh>
Date: Wed, 26 Feb 2025 03:12:37 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49483: drm/msm/disp/dpu1: avoid clearing hw interrupts if hw_intr is null during drm uninit

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/msm/disp/dpu1: avoid clearing hw interrupts if hw_intr is null during drm uninit

If edp modeset init is failed due to panel being not ready and
probe defers during drm bind, avoid clearing irqs and dereference
hw_intr when hw_intr is null.

BUG: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

Call trace:
 dpu_core_irq_uninstall+0x50/0xb0
 dpu_irq_uninstall+0x18/0x24
 msm_drm_uninit+0xd8/0x16c
 msm_drm_bind+0x580/0x5fc
 try_to_bring_up_master+0x168/0x1c0
 __component_add+0xb4/0x178
 component_add+0x1c/0x28
 dp_display_probe+0x38c/0x400
 platform_probe+0xb0/0xd0
 really_probe+0xcc/0x2c8
 __driver_probe_device+0xbc/0xe8
 driver_probe_device+0x48/0xf0
 __device_attach_driver+0xa0/0xc8
 bus_for_each_drv+0x8c/0xd8
 __device_attach+0xc4/0x150
 device_initial_probe+0x1c/0x28

Changes in V2:
- Update commit message and coreect fixes tag.

Patchwork: https://patchwork.freedesktop.org/patch/484430/

The Linux kernel CVE team has assigned CVE-2022-49483 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.16 with commit f25f656608e3a54ac3e0747be415cf3d4a69cef8 and fixed in 5.17.14 with commit a7ca30c3a8b2e8bda65f2b922d382ac056be8aa4
	Issue introduced in 5.16 with commit f25f656608e3a54ac3e0747be415cf3d4a69cef8 and fixed in 5.18.3 with commit a800701429313149afde18d98821554fbfcb3164
	Issue introduced in 5.16 with commit f25f656608e3a54ac3e0747be415cf3d4a69cef8 and fixed in 5.19 with commit 01013ba9bbddc62f7d011163cebfd7ed06bb698b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49483
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/msm/disp/dpu1/dpu_hw_interrupts.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a7ca30c3a8b2e8bda65f2b922d382ac056be8aa4
	https://git.kernel.org/stable/c/a800701429313149afde18d98821554fbfcb3164
	https://git.kernel.org/stable/c/01013ba9bbddc62f7d011163cebfd7ed06bb698b