In the Linux kernel, the following vulnerability has been resolved:
usb: typec: tipd: Free IRQ only if it was requested before
In polling mode, if no IRQ was requested there is no need to free it. Call devmfreeirq() only if client->irq is set. This fixes the warning caused by the tps6598x module removal:
WARNING: CPU: 2 PID: 333 at kernel/irq/devres.c:144 devmfreeirq+0x80/0x8c ... ... Call trace: devmfreeirq+0x80/0x8c tps6598xremove+0x28/0x88 [tps6598x] i2cdeviceremove+0x2c/0x9c deviceremove+0x4c/0x80 devicereleasedriverinternal+0x1cc/0x228 driverdetach+0x50/0x98 busremovedriver+0x6c/0xbc driverunregister+0x30/0x60 i2cdeldriver+0x54/0x64 tps6598xi2cdriverexit+0x18/0xc3c [tps6598x] _arm64sysdeletemodule+0x184/0x264 invokesyscall+0x48/0x110 el0svccommon.constprop.0+0xc8/0xe8 doel0svc+0x20/0x2c el0svc+0x28/0x98 el0t64synchandler+0x13c/0x158 el0t64_sync+0x190/0x194
[ { "signature_type": "Function", "id": "CVE-2024-50057-3a595016", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b72bf5cade51ba4055c8a8998d275e72e6b521ce", "signature_version": "v1", "target": { "function": "tps6598x_remove", "file": "drivers/usb/typec/tipd/core.c" }, "digest": { "function_hash": "42389142832610679045614919487713563948", "length": 212.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50057-5b15c401", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d4b23c119542fbaed2a16794d3801cb4806ea02", "signature_version": "v1", "target": { "function": "tps6598x_remove", "file": "drivers/usb/typec/tipd/core.c" }, "digest": { "function_hash": "312503928214469844088202109062140763715", "length": 342.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50057-80bf3c3b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b72bf5cade51ba4055c8a8998d275e72e6b521ce", "signature_version": "v1", "target": { "file": "drivers/usb/typec/tipd/core.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "154184607412172411686229590420810426171", "324647029406504459097292057410617779388", "18721991937807769032321047247728574200", "304499613489892263664062137908012825968" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50057-a1a1fd09", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d4b23c119542fbaed2a16794d3801cb4806ea02", "signature_version": "v1", "target": { "file": "drivers/usb/typec/tipd/core.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "154184607412172411686229590420810426171", "332212058402785700820611767676618200531", "256932268292276352200535180126520870063", "297261076208157297061864169298893568653", "166186520236970609033715738860059511206" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-50057-b72a4b4c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db63d9868f7f310de44ba7bea584e2454f8b4ed0", "signature_version": "v1", "target": { "function": "tps6598x_remove", "file": "drivers/usb/typec/tipd/core.c" }, "digest": { "function_hash": "312503928214469844088202109062140763715", "length": 342.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-50057-d05c6e42", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db63d9868f7f310de44ba7bea584e2454f8b4ed0", "signature_version": "v1", "target": { "file": "drivers/usb/typec/tipd/core.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "154184607412172411686229590420810426171", "332212058402785700820611767676618200531", "256932268292276352200535180126520870063", "297261076208157297061864169298893568653", "166186520236970609033715738860059511206" ] }, "deprecated": false } ]