linux-cve-announce - CVE-2022-50369: drm/vkms: Fix null-ptr-deref in vkms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091716-CVE-2022-50369-bc92@gregkh>
Date: Wed, 17 Sep 2025 16:56:28 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50369: drm/vkms: Fix null-ptr-deref in vkms_release()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm/vkms: Fix null-ptr-deref in vkms_release()

A null-ptr-deref is triggered when it tries to destroy the workqueue in
vkms->output.composer_workq in vkms_release().

 KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
 CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24
 RIP: 0010:destroy_workqueue+0x2f/0x710
 ...
 Call Trace:
  <TASK>
  ? vkms_config_debugfs_init+0x50/0x50 [vkms]
  __devm_drm_dev_alloc+0x15a/0x1c0 [drm]
  vkms_init+0x245/0x1000 [vkms]
  do_one_initcall+0xd0/0x4f0
  do_init_module+0x1a4/0x680
  load_module+0x6249/0x7110
  __do_sys_finit_module+0x140/0x200
  do_syscall_64+0x35/0x80
  entry_SYSCALL_64_after_hwframe+0x46/0xb0

The reason is that an OOM happened which triggers the destroy of the
workqueue, however, the workqueue is alloced in the later process,
thus a null-ptr-deref happened. A simple call graph is shown as below:

 vkms_init()
  vkms_create()
    devm_drm_dev_alloc()
      __devm_drm_dev_alloc()
        devm_drm_dev_init()
          devm_add_action_or_reset()
            devm_add_action() # an error happened
            devm_drm_dev_init_release()
              drm_dev_put()
                kref_put()
                  drm_dev_release()
                    vkms_release()
                      destroy_workqueue() # null-ptr-deref happened
    vkms_modeset_init()
      vkms_output_init()
        vkms_crtc_init() # where the workqueue get allocated

Fix this by checking if composer_workq is NULL before passing it to
the destroy_workqueue() in vkms_release().

The Linux kernel CVE team has assigned CVE-2022-50369 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.20 with commit 6c234fe37c57627a5baf96f552afa1fae2b67d4d and fixed in 5.10.173 with commit 0b8f390e2251191f1b179cc87f65d54c96565f0d
	Issue introduced in 4.20 with commit 6c234fe37c57627a5baf96f552afa1fae2b67d4d and fixed in 5.15.99 with commit 1f9836f95271e7acf016667eee0aeae3386f9645
	Issue introduced in 4.20 with commit 6c234fe37c57627a5baf96f552afa1fae2b67d4d and fixed in 6.1.16 with commit 596f1ba3987e601e31a5abf1f75ce1d2635aceac
	Issue introduced in 4.20 with commit 6c234fe37c57627a5baf96f552afa1fae2b67d4d and fixed in 6.2.3 with commit 57031c474c3a920ea73afeb5dc352e537f5793ee
	Issue introduced in 4.20 with commit 6c234fe37c57627a5baf96f552afa1fae2b67d4d and fixed in 6.3 with commit 2fe2a8f40c21161ffe7653cc234e7934db5b7cc5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50369
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/vkms/vkms_drv.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0b8f390e2251191f1b179cc87f65d54c96565f0d
	https://git.kernel.org/stable/c/1f9836f95271e7acf016667eee0aeae3386f9645
	https://git.kernel.org/stable/c/596f1ba3987e601e31a5abf1f75ce1d2635aceac
	https://git.kernel.org/stable/c/57031c474c3a920ea73afeb5dc352e537f5793ee
	https://git.kernel.org/stable/c/2fe2a8f40c21161ffe7653cc234e7934db5b7cc5