In the Linux kernel, the following vulnerability has been resolved:
platform/chrome: crosusbpdnotify: Fix error handling in crosusbpdnotify_init()
The following WARNING message was given when rmmod crosusbpdnotify:
Unexpected driver unregister! WARNING: CPU: 0 PID: 253 at drivers/base/driver.c:270 driverunregister+0x8a/0xb0 Modules linked in: crosusbpdnotify(-) CPU: 0 PID: 253 Comm: rmmod Not tainted 6.1.0-rc3 #24 ... Call Trace: <TASK> crosusbpdnotifyexit+0x11/0x1e [crosusbpdnotify] _x64sysdeletemodule+0x3c7/0x570 ? _ia32sysdeletemodule+0x570/0x570 ? lockisheldtype+0xe3/0x140 ? syscallenterfromusermode+0x17/0x50 ? rcureadlockschedheld+0xa0/0xd0 ? syscallenterfromusermode+0x1c/0x50 dosyscall64+0x37/0x90 entrySYSCALL64after_hwframe+0x63/0xcd RIP: 0033:0x7f333fe9b1b7
The reason is that the crosusbpdnotifyinit() does not check the return value of platformdriverregister(), and the crosusbpdnotify can install successfully even if platformdriver_register() failed.
Fix by checking the return value of platformdriverregister() and unregister crosusbpdnotifyplatdriver when it failed.
[ { "deprecated": false, "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "95650271559034545307808771942837255803", "32559996761118365525936764032003878133", "263832092961053960860173507627791564326", "108925990323853307010736964917524883972" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@751f12696d797e785d2611099fe9f0569d47556e", "signature_version": "v1", "id": "CVE-2022-50468-36540504" }, { "deprecated": false, "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "95650271559034545307808771942837255803", "32559996761118365525936764032003878133", "263832092961053960860173507627791564326", "108925990323853307010736964917524883972" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0cacdd354987f8f5348d16908716f154047890", "signature_version": "v1", "id": "CVE-2022-50468-59391c48" }, { "deprecated": false, "target": { "function": "cros_usbpd_notify_init", "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "signature_type": "Function", "digest": { "function_hash": "159224670634311890346733960709475005361", "length": 214.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@751f12696d797e785d2611099fe9f0569d47556e", "signature_version": "v1", "id": "CVE-2022-50468-64f03845" }, { "deprecated": false, "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "95650271559034545307808771942837255803", "32559996761118365525936764032003878133", "263832092961053960860173507627791564326", "108925990323853307010736964917524883972" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a2d96623670155d94aca72c320c0ac27bdc6bd2", "signature_version": "v1", "id": "CVE-2022-50468-6ee1e476" }, { "deprecated": false, "target": { "function": "cros_usbpd_notify_init", "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "signature_type": "Function", "digest": { "function_hash": "159224670634311890346733960709475005361", "length": 214.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b6ee54995739202b4a0cc01b7e9269f761c573d", "signature_version": "v1", "id": "CVE-2022-50468-6f988217" }, { "deprecated": false, "target": { "function": "cros_usbpd_notify_init", "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "signature_type": "Function", "digest": { "function_hash": "159224670634311890346733960709475005361", "length": 214.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a2d96623670155d94aca72c320c0ac27bdc6bd2", "signature_version": "v1", "id": "CVE-2022-50468-af41293a" }, { "deprecated": false, "target": { "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "95650271559034545307808771942837255803", "32559996761118365525936764032003878133", "263832092961053960860173507627791564326", "108925990323853307010736964917524883972" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b6ee54995739202b4a0cc01b7e9269f761c573d", "signature_version": "v1", "id": "CVE-2022-50468-b71f7c9c" }, { "deprecated": false, "target": { "function": "cros_usbpd_notify_init", "file": "drivers/platform/chrome/cros_usbpd_notify.c" }, "signature_type": "Function", "digest": { "function_hash": "159224670634311890346733960709475005361", "length": 214.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0cacdd354987f8f5348d16908716f154047890", "signature_version": "v1", "id": "CVE-2022-50468-da46b40b" } ]