CVE-2022-48814
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48814
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48814.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-48814
- Downstream
- Related
- Published
- 2024-07-16T11:44:03.261Z
- Modified
- 2025-11-28T08:39:16.856255Z
- Summary
- net: dsa: seville: register the mdiobus under devres
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: seville: register the mdiobus under devres
As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slavemiibus using devres")
mdiobusfree() will panic when called from devmmdiobusfree() <- devresreleaseall() <- _devicereleasedriver(), and that mdiobus was not previously unregistered.
The Seville VSC9959 switch is a platform device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here.
If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and devicelinksunbind_consumers() will unbind the seville switch driver on shutdown.
So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all.
The seville driver has a code structure that could accommodate both the mdiobusunregister and mdiobusfree calls, but it has an external dependency upon msccmiimsetup() from mdio-mscc-miim.c, which calls devmmdiobusallocsize() on its behalf. So rather than restructuring that, and exporting yet one more symbol msccmiimteardown(), let's work with devres and replace ofmdiobus_register with the devres variant. When we use all-devres, we can ensure that devres doesn't free a still-registered bus (it either runs both callbacks, or none).
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48814.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0e816362d823cd46c666e64d8bffe329ee22f4cc
- https://git.kernel.org/stable/c/1d13e7221035947c62800c9d3d99b4ed570e27e7
- https://git.kernel.org/stable/c/bd488afc3b39e045ba71aab472233f2a78726e7b
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48814.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-48814
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedac3a68d56651c3dad2c12c7afce065fe15267f44Fixed1d13e7221035947c62800c9d3d99b4ed570e27e7Fixed0e816362d823cd46c666e64d8bffe329ee22f4ccFixedbd488afc3b39e045ba71aab472233f2a78726e7b