linux-cve-announce - CVE-2022-50745: staging: media: tegra-video: fix device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025122450-CVE-2022-50745-af5c@gregkh>
Date: Wed, 24 Dec 2025 14:05:56 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50745: staging: media: tegra-video: fix device_node use after free

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

staging: media: tegra-video: fix device_node use after free

At probe time this code path is followed:

 * tegra_csi_init
   * tegra_csi_channels_alloc
     * for_each_child_of_node(node, channel) -- iterates over channels
       * automatically gets 'channel'
         * tegra_csi_channel_alloc()
           * saves into chan->of_node a pointer to the channel OF node
       * automatically gets and puts 'channel'
       * now the node saved in chan->of_node has refcount 0, can disappear
   * tegra_csi_channels_init
     * iterates over channels
       * tegra_csi_channel_init -- uses chan->of_node

After that, chan->of_node keeps storing the node until the device is
removed.

of_node_get() the node and of_node_put() it during teardown to avoid any
risk.

The Linux kernel CVE team has assigned CVE-2022-50745 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10 with commit 1ebaeb09830f36c1111b72a95420814225bd761c and fixed in 5.10.163 with commit 5451efb2ca30f3c42b9efb8327ce35b62870dbd3
	Issue introduced in 5.10 with commit 1ebaeb09830f36c1111b72a95420814225bd761c and fixed in 5.15.87 with commit ce50c612458091d926ccb05d7db11d9f93532db2
	Issue introduced in 5.10 with commit 1ebaeb09830f36c1111b72a95420814225bd761c and fixed in 6.0.18 with commit 6512c9498fcb97e7c760e3ef86b2272f2c0f765f
	Issue introduced in 5.10 with commit 1ebaeb09830f36c1111b72a95420814225bd761c and fixed in 6.1.4 with commit 0fd003d3c708c80350a815eaf37b8e1114b976cf
	Issue introduced in 5.10 with commit 1ebaeb09830f36c1111b72a95420814225bd761c and fixed in 6.2 with commit c4d344163c3a7f90712525f931a6c016bbb35e18

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50745
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/staging/media/tegra-video/csi.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5451efb2ca30f3c42b9efb8327ce35b62870dbd3
	https://git.kernel.org/stable/c/ce50c612458091d926ccb05d7db11d9f93532db2
	https://git.kernel.org/stable/c/6512c9498fcb97e7c760e3ef86b2272f2c0f765f
	https://git.kernel.org/stable/c/0fd003d3c708c80350a815eaf37b8e1114b976cf
	https://git.kernel.org/stable/c/c4d344163c3a7f90712525f931a6c016bbb35e18