linux-cve-announce - CVE-2022-50556: drm: Fix potential null-ptr-deref due to drmm_mode_config

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025102203-CVE-2022-50556-bbe2@gregkh>
Date: Wed, 22 Oct 2025 15:24:04 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50556: drm: Fix potential null-ptr-deref due to drmm_mode_config_init()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

drm: Fix potential null-ptr-deref due to drmm_mode_config_init()

drmm_mode_config_init() will call drm_mode_create_standard_properties()
and won't check the ret value. When drm_mode_create_standard_properties()
failed due to alloc, property will be a NULL pointer and may causes the
null-ptr-deref. Fix the null-ptr-deref by adding the ret value check.

Found null-ptr-deref while testing insert module bochs:
general protection fault, probably for non-canonical address
    0xdffffc000000000c: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 3 PID: 249 Comm: modprobe Not tainted 6.1.0-rc1+ #364
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
RIP: 0010:drm_object_attach_property+0x73/0x3c0 [drm]
Call Trace:
 <TASK>
 __drm_connector_init+0xb6c/0x1100 [drm]
 bochs_pci_probe.cold.11+0x4cb/0x7fe [bochs]
 pci_device_probe+0x17d/0x340
 really_probe+0x1db/0x5d0
 __driver_probe_device+0x1e7/0x250
 driver_probe_device+0x4a/0x120
 __driver_attach+0xcd/0x2c0
 bus_for_each_dev+0x11a/0x1b0
 bus_add_driver+0x3d7/0x500
 driver_register+0x18e/0x320
 do_one_initcall+0xc4/0x3e0
 do_init_module+0x1b4/0x630
 load_module+0x5dca/0x7230
 __do_sys_finit_module+0x100/0x170
 do_syscall_64+0x3f/0x90
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7ff65af9f839

The Linux kernel CVE team has assigned CVE-2022-50556 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.0 with commit 6b4959f43a04e12d39c5700607727f2cbcfeac31 and fixed in 5.10.173 with commit 5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0
	Issue introduced in 4.0 with commit 6b4959f43a04e12d39c5700607727f2cbcfeac31 and fixed in 5.15.99 with commit d06e827a65a6bcd2e329045d891d0739cec1cf4a
	Issue introduced in 4.0 with commit 6b4959f43a04e12d39c5700607727f2cbcfeac31 and fixed in 6.1.16 with commit b14147464251f66e38fa39f0aae9780466db8610
	Issue introduced in 4.0 with commit 6b4959f43a04e12d39c5700607727f2cbcfeac31 and fixed in 6.2.3 with commit 961620ad67611a7320a49f4b6f3c5e2906833a03
	Issue introduced in 4.0 with commit 6b4959f43a04e12d39c5700607727f2cbcfeac31 and fixed in 6.3 with commit 834c23e4f798dcdc8af251b3c428ceef94741991

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50556
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/gpu/drm/drm_mode_config.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5ae70041a6d7de62a0cdb2bbcfe0c9cf753035d0
	https://git.kernel.org/stable/c/d06e827a65a6bcd2e329045d891d0739cec1cf4a
	https://git.kernel.org/stable/c/b14147464251f66e38fa39f0aae9780466db8610
	https://git.kernel.org/stable/c/961620ad67611a7320a49f4b6f3c5e2906833a03
	https://git.kernel.org/stable/c/834c23e4f798dcdc8af251b3c428ceef94741991