CVE-2022-48817
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48817
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48817.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-48817
- Downstream
- Related
- Published
- 2024-07-16T11:44:05Z
- Modified
- 2025-10-15T16:51:18.413312Z
- Summary
- net: dsa: ar9331: register the mdiobus under devres
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: dsa: ar9331: register the mdiobus under devres
As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slavemiibus using devres")
mdiobusfree() will panic when called from devmmdiobusfree() <- devresreleaseall() <- _devicereleasedriver(), and that mdiobus was not previously unregistered.
The ar9331 is an MDIO device, so the initial set of constraints that I thought would cause this (I2C or SPI buses which call ->remove on ->shutdown) do not apply. But there is one more which applies here.
If the DSA master itself is on a bus that calls ->remove from ->shutdown (like dpaa2-eth, which is on the fsl-mc bus), there is a device link between the switch and the DSA master, and devicelinksunbind_consumers() will unbind the ar9331 switch driver on shutdown.
So the same treatment must be applied to all DSA switch drivers, which is: either use devres for both the mdiobus allocation and registration, or don't use devres at all.
The ar9331 driver doesn't have a complex code structure for mdiobus removal, so just replace ofmdiobusregister with the devres variant in order to be all-devres and ensure that we don't free a still-registered bus.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/475ce5dcf2d88fd4f3c213a0ac944e3e40702970
- https://git.kernel.org/stable/c/50facd86e9fbc4b93fe02e5fe05776047f45dbfb
- https://git.kernel.org/stable/c/aae1c6a1d3d696fc33b609fb12fe744a556d1dc5
- https://git.kernel.org/stable/c/f1842a8cb71de4d7eb75a86f76e88c7ee739218c
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedac3a68d56651c3dad2c12c7afce065fe15267f44Fixed475ce5dcf2d88fd4f3c213a0ac944e3e40702970
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedac3a68d56651c3dad2c12c7afce065fe15267f44Fixedaae1c6a1d3d696fc33b609fb12fe744a556d1dc5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedac3a68d56651c3dad2c12c7afce065fe15267f44Fixedf1842a8cb71de4d7eb75a86f76e88c7ee739218c
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedac3a68d56651c3dad2c12c7afce065fe15267f44Fixed50facd86e9fbc4b93fe02e5fe05776047f45dbfb