In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tipd: Free IRQ only if it was requested before
In polling mode, if no IRQ was requested there is no need to free it. Call devmfreeirq() only if client->irq is set. This fixes the warning caused by the tps6598x module removal:
WARNING: CPU: 2 PID: 333 at kernel/irq/devres.c:144 devmfreeirq+0x80/0x8c ... ... Call trace: devmfreeirq+0x80/0x8c tps6598xremove+0x28/0x88 [tps6598x] i2cdeviceremove+0x2c/0x9c deviceremove+0x4c/0x80 devicereleasedriverinternal+0x1cc/0x228 driverdetach+0x50/0x98 busremovedriver+0x6c/0xbc driverunregister+0x30/0x60 i2cdeldriver+0x54/0x64 tps6598xi2cdriverexit+0x18/0xc3c [tps6598x] _arm64sysdeletemodule+0x184/0x264 invokesyscall+0x48/0x110 el0svccommon.constprop.0+0xc8/0xe8 doel0svc+0x20/0x2c el0svc+0x28/0x98 el0t64synchandler+0x13c/0x158 el0t64_sync+0x190/0x194
[
{
"id": "CVE-2024-50057-3a595016",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b72bf5cade51ba4055c8a8998d275e72e6b521ce",
"target": {
"file": "drivers/usb/typec/tipd/core.c",
"function": "tps6598x_remove"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 212.0,
"function_hash": "42389142832610679045614919487713563948"
}
},
{
"id": "CVE-2024-50057-5b15c401",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d4b23c119542fbaed2a16794d3801cb4806ea02",
"target": {
"file": "drivers/usb/typec/tipd/core.c",
"function": "tps6598x_remove"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 342.0,
"function_hash": "312503928214469844088202109062140763715"
}
},
{
"id": "CVE-2024-50057-80bf3c3b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b72bf5cade51ba4055c8a8998d275e72e6b521ce",
"target": {
"file": "drivers/usb/typec/tipd/core.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"154184607412172411686229590420810426171",
"324647029406504459097292057410617779388",
"18721991937807769032321047247728574200",
"304499613489892263664062137908012825968"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-50057-a1a1fd09",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d4b23c119542fbaed2a16794d3801cb4806ea02",
"target": {
"file": "drivers/usb/typec/tipd/core.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"154184607412172411686229590420810426171",
"332212058402785700820611767676618200531",
"256932268292276352200535180126520870063",
"297261076208157297061864169298893568653",
"166186520236970609033715738860059511206"
],
"threshold": 0.9
}
},
{
"id": "CVE-2024-50057-b72a4b4c",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db63d9868f7f310de44ba7bea584e2454f8b4ed0",
"target": {
"file": "drivers/usb/typec/tipd/core.c",
"function": "tps6598x_remove"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 342.0,
"function_hash": "312503928214469844088202109062140763715"
}
},
{
"id": "CVE-2024-50057-d05c6e42",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db63d9868f7f310de44ba7bea584e2454f8b4ed0",
"target": {
"file": "drivers/usb/typec/tipd/core.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"154184607412172411686229590420810426171",
"332212058402785700820611767676618200531",
"256932268292276352200535180126520870063",
"297261076208157297061864169298893568653",
"166186520236970609033715738860059511206"
],
"threshold": 0.9
}
}
]