linux-cve-announce - CVE-2025-21943: gpio: aggregator: protect driver attr handlers against module unload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025040135-CVE-2025-21943-2255@gregkh>
Date: Tue,  1 Apr 2025 16:40:07 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-21943: gpio: aggregator: protect driver attr handlers against module unload

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

gpio: aggregator: protect driver attr handlers against module unload

Both new_device_store and delete_device_store touch module global
resources (e.g. gpio_aggregator_lock). To prevent race conditions with
module unload, a reference needs to be held.

Add try_module_get() in these handlers.

For new_device_store, this eliminates what appears to be the most dangerous
scenario: if an id is allocated from gpio_aggregator_idr but
platform_device_register has not yet been called or completed, a concurrent
module unload could fail to unregister/delete the device, leaving behind a
dangling platform device/GPIO forwarder. This can result in various issues.
The following simple reproducer demonstrates these problems:

  #!/bin/bash
  while :; do
    # note: whether 'gpiochip0 0' exists or not does not matter.
    echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device
  done &
  while :; do
    modprobe gpio-aggregator
    modprobe -r gpio-aggregator
  done &
  wait

  Starting with the following warning, several kinds of warnings will appear
  and the system may become unstable:

  ------------[ cut here ]------------
  list_del corruption, ffff888103e2e980->next is LIST_POISON1 (dead000000000100)
  WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120
  [...]
  RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120
  [...]
  Call Trace:
   <TASK>
   ? __list_del_entry_valid_or_report+0xa3/0x120
   ? __warn.cold+0x93/0xf2
   ? __list_del_entry_valid_or_report+0xa3/0x120
   ? report_bug+0xe6/0x170
   ? __irq_work_queue_local+0x39/0xe0
   ? handle_bug+0x58/0x90
   ? exc_invalid_op+0x13/0x60
   ? asm_exc_invalid_op+0x16/0x20
   ? __list_del_entry_valid_or_report+0xa3/0x120
   gpiod_remove_lookup_table+0x22/0x60
   new_device_store+0x315/0x350 [gpio_aggregator]
   kernfs_fop_write_iter+0x137/0x1f0
   vfs_write+0x262/0x430
   ksys_write+0x60/0xd0
   do_syscall_64+0x6c/0x180
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
   [...]
   </TASK>
  ---[ end trace 0000000000000000 ]---

The Linux kernel CVE team has assigned CVE-2025-21943 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.8 with commit 828546e24280f721350a7a0dcc92416e917b4382 and fixed in 5.10.235 with commit fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117
	Issue introduced in 5.8 with commit 828546e24280f721350a7a0dcc92416e917b4382 and fixed in 5.15.179 with commit 807789018186cf508ceb3a1f8f02935cd195717b
	Issue introduced in 5.8 with commit 828546e24280f721350a7a0dcc92416e917b4382 and fixed in 6.1.131 with commit 9334c88fc2fbc6836b307d269fcc1744c69701c0
	Issue introduced in 5.8 with commit 828546e24280f721350a7a0dcc92416e917b4382 and fixed in 6.6.83 with commit d99dc8f7ea01ee1b21306e0eda8eb18a4af80db6
	Issue introduced in 5.8 with commit 828546e24280f721350a7a0dcc92416e917b4382 and fixed in 6.12.19 with commit 8fb07fb1bba91d45846ed8605c3097fe67a7d54c
	Issue introduced in 5.8 with commit 828546e24280f721350a7a0dcc92416e917b4382 and fixed in 6.13.7 with commit 56281a76b805b5ac61feb5d580139695a22f87f0
	Issue introduced in 5.8 with commit 828546e24280f721350a7a0dcc92416e917b4382 and fixed in 6.14 with commit 12f65d1203507f7db3ba59930fe29a3b8eee9945

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21943
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpio/gpio-aggregator.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fd6aa1f8cbe0979eb66ac32ebc231bf0b10a2117
	https://git.kernel.org/stable/c/807789018186cf508ceb3a1f8f02935cd195717b
	https://git.kernel.org/stable/c/9334c88fc2fbc6836b307d269fcc1744c69701c0
	https://git.kernel.org/stable/c/d99dc8f7ea01ee1b21306e0eda8eb18a4af80db6
	https://git.kernel.org/stable/c/8fb07fb1bba91d45846ed8605c3097fe67a7d54c
	https://git.kernel.org/stable/c/56281a76b805b5ac61feb5d580139695a22f87f0
	https://git.kernel.org/stable/c/12f65d1203507f7db3ba59930fe29a3b8eee9945