linux-cve-announce - CVE-2022-50317: drm/bridge: megachips: Fix a null pointer dereference bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091552-CVE-2022-50317-6b3b@gregkh>
Date: Mon, 15 Sep 2025 16:48:54 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50317: drm/bridge: megachips: Fix a null pointer dereference bug

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: megachips: Fix a null pointer dereference bug

When removing the module we will get the following warning:

[   31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered
[   31.912484] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI
[   31.913338] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
[   31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130
[   31.921825] Call Trace:
[   31.922533]  stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw]
[   31.923139]  i2c_device_remove+0x181/0x1f0

The two bridges (stdp2690, stdp4028) do not probe at the same time, so
the driver does not call ge_b850v3_resgiter() when probing, causing the
driver to try to remove the object that has not been initialized.

Fix this by checking whether both the bridges are probed.

The Linux kernel CVE team has assigned CVE-2022-50317 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.14.263 with commit 7649972d97fb98578fbc4a351416cf72895e7c4d and fixed in 4.14.296 with commit aaa512ad1e59f2edf8a9e4f2b167a44b24670679
	Issue introduced in 4.19.226 with commit 16e3827904932eccfba0915f0c93b519de3536ac and fixed in 4.19.262 with commit 5bc20bafcd87ba0858ab772cefc7047cb51bc249
	Issue introduced in 5.4.174 with commit 50ad94f8654a53ec9ca3604a7a23cbaf166e0119 and fixed in 5.4.220 with commit 1daf69228e310938177119c4eadcd30fc75c81e0
	Issue introduced in 5.10.94 with commit b8d10f601f226f055df8b5368d7ea7f369136cd5 and fixed in 5.10.150 with commit 877e92e9b1bdeb580b31a46061005936be902cd4
	Issue introduced in 5.15.17 with commit 405856460d3e7aefb7c1aef047ec88fc4ef2e2a5 and fixed in 5.15.75 with commit 4610e7a4111fa3f3ce27c09d6d94008c55f1cd31
	Issue introduced in 5.17 with commit 11632d4aa2b3f126790e81a4415d6c23103cf8bb and fixed in 5.19.17 with commit 21764467ab396d9f08921e0a5ffa1214244e1ad9
	Issue introduced in 5.17 with commit 11632d4aa2b3f126790e81a4415d6c23103cf8bb and fixed in 6.0.3 with commit 7371fad5cfe6eada6bb5523c895fd6074b15c2b9
	Issue introduced in 5.17 with commit 11632d4aa2b3f126790e81a4415d6c23103cf8bb and fixed in 6.1 with commit 1ff673333d46d2c1b053ebd0c1c7c7c79e36943e
	Issue introduced in 5.16.3 with commit e449461989f0674f188d30494ffd3f5ba74c1a05

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50317
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/aaa512ad1e59f2edf8a9e4f2b167a44b24670679
	https://git.kernel.org/stable/c/5bc20bafcd87ba0858ab772cefc7047cb51bc249
	https://git.kernel.org/stable/c/1daf69228e310938177119c4eadcd30fc75c81e0
	https://git.kernel.org/stable/c/877e92e9b1bdeb580b31a46061005936be902cd4
	https://git.kernel.org/stable/c/4610e7a4111fa3f3ce27c09d6d94008c55f1cd31
	https://git.kernel.org/stable/c/21764467ab396d9f08921e0a5ffa1214244e1ad9
	https://git.kernel.org/stable/c/7371fad5cfe6eada6bb5523c895fd6074b15c2b9
	https://git.kernel.org/stable/c/1ff673333d46d2c1b053ebd0c1c7c7c79e36943e