linux-cve-announce - CVE-2022-49827: drm: Fix potential null-ptr-deref in drm_vblank_destroy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025050135-CVE-2022-49827-f7bc@gregkh>
Date: Thu,  1 May 2025 16:10:17 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-49827: drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()

drm_vblank_init() call drmm_add_action_or_reset() with
drm_vblank_init_release() as action. If __drmm_add_action() failed, will
directly call drm_vblank_init_release() with the vblank whose worker is
NULL. As the resule, a null-ptr-deref will happen in
kthread_destroy_worker(). Add the NULL check before calling
drm_vblank_destroy_worker().

BUG: null-ptr-deref
KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]
CPU: 5 PID: 961 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf-dirty
RIP: 0010:kthread_destroy_worker+0x25/0xb0
  Call Trace:
    <TASK>
    drm_vblank_init_release+0x124/0x220 [drm]
    ? drm_crtc_vblank_restore+0x8b0/0x8b0 [drm]
    __drmm_add_action_or_reset+0x41/0x50 [drm]
    drm_vblank_init+0x282/0x310 [drm]
    vkms_init+0x35f/0x1000 [vkms]
    ? 0xffffffffc4508000
    ? lock_is_held_type+0xd7/0x130
    ? __kmem_cache_alloc_node+0x1c2/0x2b0
    ? lock_is_held_type+0xd7/0x130
    ? 0xffffffffc4508000
    do_one_initcall+0xd0/0x4f0
    ...
    do_syscall_64+0x35/0x80
    entry_SYSCALL_64_after_hwframe+0x46/0xb0

The Linux kernel CVE team has assigned CVE-2022-49827 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.9 with commit 5e6c2b4f916157e8f10d093d43e88b2a250d1774 and fixed in 5.10.156 with commit 1d160dfb3fdf11ba9447e862c548447f91f4e74a
	Issue introduced in 5.9 with commit 5e6c2b4f916157e8f10d093d43e88b2a250d1774 and fixed in 5.15.80 with commit e884a6c2d49a6c12761e5bed851e9fe93bd923a1
	Issue introduced in 5.9 with commit 5e6c2b4f916157e8f10d093d43e88b2a250d1774 and fixed in 6.0.10 with commit 3acd2016421b2e628acad65495d15493bf7a3bc3
	Issue introduced in 5.9 with commit 5e6c2b4f916157e8f10d093d43e88b2a250d1774 and fixed in 6.1 with commit 4979524f5a2a8210e87fde2f642b0dc060860821

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49827
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/drm_internal.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1d160dfb3fdf11ba9447e862c548447f91f4e74a
	https://git.kernel.org/stable/c/e884a6c2d49a6c12761e5bed851e9fe93bd923a1
	https://git.kernel.org/stable/c/3acd2016421b2e628acad65495d15493bf7a3bc3
	https://git.kernel.org/stable/c/4979524f5a2a8210e87fde2f642b0dc060860821