CVE-2022-50260
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-50260
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-50260.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-50260
- Downstream
- Related
- Published
- 2025-09-15T14:02:50Z
- Modified
- 2025-10-16T08:33:10.677611Z
- Summary
- drm/msm: Make .remove and .shutdown HW shutdown consistent
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: Make .remove and .shutdown HW shutdown consistent
Drivers' .remove and .shutdown callbacks are executed on different code paths. The former is called when a device is removed from the bus, while the latter is called at system shutdown time to quiesce the device.
This means that some overlap exists between the two, because both have to take care of properly shutting down the hardware. But currently the logic used in these two callbacks isn't consistent in msm drivers, which could lead to kernel panic.
For example, on .remove the component is deleted and its .unbind callback leads to the hardware being shutdown but only if the DRM device has been marked as registered.
That check doesn't exist in the .shutdown logic and this can lead to the driver calling drmatomichelper_shutdown() for a DRM device that hasn't been properly initialized.
A situation like this can happen if drivers for expected sub-devices fail to probe, since the .bind callback will never be executed. If that is the case, drmatomichelpershutdown() will attempt to take mutexes that are only initialized if drmmodeconfiginit() is called during a device bind.
This bug was attempted to be fixed in commit 623f279c7781 ("drm/msm: fix shutdown hook in case GPU components failed to bind"), but unfortunately it still happens in some cases as the one mentioned above, i.e:
systemd-shutdown[1]: Powering off. kvm: exiting hardware virtualization platform wifi-firmware.0: Removing from iommu group 12 platform video-firmware.0: Removing from iommu group 10 ------------[ cut here ]------------ WARNING: CPU: 6 PID: 1 at drivers/gpu/drm/drmmodesetlock.c:317 drmmodesetlockallctx+0x3c4/0x3d0 ... Hardware name: Google CoachZ (rev3+) (DT) pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : drmmodesetlockallctx+0x3c4/0x3d0 lr : drmmodesetlockallctx+0x48/0x3d0 sp : ffff80000805bb80 x29: ffff80000805bb80 x28: ffff327c00128000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000001 x24: ffffc95d820ec030 x23: ffff327c00bbd090 x22: ffffc95d8215eca0 x21: ffff327c039c5800 x20: ffff327c039c5988 x19: ffff80000805bbe8 x18: 0000000000000034 x17: 000000040044ffff x16: ffffc95d80cac920 x15: 0000000000000000 x14: 0000000000000315 x13: 0000000000000315 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff80000805bc28 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff327c00128000 x1 : 0000000000000000 x0 : ffff327c039c59b0 Call trace: drmmodesetlockallctx+0x3c4/0x3d0 drmatomichelpershutdown+0x70/0x134 msmdrvshutdown+0x30/0x40 platformshutdown+0x28/0x40 deviceshutdown+0x148/0x350 kernelpoweroff+0x38/0x80 _dosysreboot+0x288/0x2c0 _arm64sysreboot+0x28/0x34 invokesyscall+0x48/0x114 el0svccommon.constprop.0+0x44/0xec doel0svc+0x2c/0xc0 el0svc+0x2c/0x84 el0t64synchandler+0x11c/0x150 el0t64sync+0x18c/0x190 ---[ end trace 0000000000000000 ]--- Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000010eab1000 [0000000000000018] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP ... Hardware name: Google CoachZ (rev3+) (DT) pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : wwmutexlock+0x28/0x32c lr : drmmodesetlockallctx+0x1b0/0x3d0 sp : ffff80000805bb50 x29: ffff80000805bb50 x28: ffff327c00128000 x27: 0000000000000000 x26: 00000 ---truncated---
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9d5cbf5fe46e350715389d89d0c350d83289a102Fixed26f9a766f87b33c50ed400a9500cc1dc9aced953
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9d5cbf5fe46e350715389d89d0c350d83289a102Fixed0e6649a2e31ac157c711d583ec8f5ec59da5de0e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced9d5cbf5fe46e350715389d89d0c350d83289a102Fixed0a58d2ae572adaec8d046f8d35b40c2c32ac7468
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected3d516e369e3a563e7da39c72b06d78c7f1b09b1e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected8bc5c9ba5a1d67aaf6957199b2ab8a24402741a9
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected19583b280801b6ba4a36172113db42413860d1c4
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affected56ed34ea6cd73c2fd5384d03a9034e6f229a390a