CVE-2022-50214
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-50214
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-50214.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-50214
- Downstream
- Published
- 2025-06-18T11:03:51Z
- Modified
- 2025-10-08T13:40:40.733965Z
- Summary
- coresight: Clear the connection field properly
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
coresight: Clear the connection field properly
coresight devices track their connections (output connections) and hold a reference to the fwnode. When a device goes away, we walk through the devices on the coresight bus and make sure that the references are dropped. This happens both ways: a) For all output connections from the device, drop the reference to the target device via coresightreleaseplatform_data()
b) Iterate over all the devices on the coresight bus and drop the reference to fwnode if this device is the target of the output connection, via coresightremoveconns()->coresightremovematch().
However, the coresightremovematch() doesn't clear the fwnode field, after dropping the reference, this causes use-after-free and additional refcount drops on the fwnode.
e.g., if we have two devices, A and B, with a connection, A -> B. If we remove B first, B would clear the reference on B, from A via coresightremovematch(). But when A is removed, it still has a connection with fwnode still pointing to B. Thus it tries to drops the reference in coresightreleaseplatform_data(), raising the bells like :
[ 91.990153] ------------[ cut here ]------------ [ 91.990163] refcountt: addition on 0; use-after-free. [ 91.990212] WARNING: CPU: 0 PID: 461 at lib/refcount.c:25 refcountwarnsaturate+0xa0/0x144 [ 91.990260] Modules linked in: coresightfunnel coresightreplicator coresightetm4x(-) crct10difce coresight iptables xtables ipv6 [last unloaded: coresightcpudebug] [ 91.990398] CPU: 0 PID: 461 Comm: rmmod Tainted: G W T 5.19.0-rc2+ #53 [ 91.990418] Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Feb 1 2019 [ 91.990434] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 91.990454] pc : refcountwarnsaturate+0xa0/0x144 [ 91.990476] lr : refcountwarnsaturate+0xa0/0x144 [ 91.990496] sp : ffff80000c843640 [ 91.990509] x29: ffff80000c843640 x28: ffff800009957c28 x27: ffff80000c8439a8 [ 91.990560] x26: ffff00097eff1990 x25: ffff8000092b6ad8 x24: ffff00097eff19a8 [ 91.990610] x23: ffff80000c8439a8 x22: 0000000000000000 x21: ffff80000c8439c2 [ 91.990659] x20: 0000000000000000 x19: ffff00097eff1a10 x18: ffff80000ab99c40 [ 91.990708] x17: 0000000000000000 x16: 0000000000000000 x15: ffff80000abf6fa0 [ 91.990756] x14: 000000000000001d x13: 0a2e656572662d72 x12: 657466612d657375 [ 91.990805] x11: 203b30206e6f206e x10: 6f69746964646120 x9 : ffff8000081aba28 [ 91.990854] x8 : 206e6f206e6f6974 x7 : 69646461203a745f x6 : 746e756f63666572 [ 91.990903] x5 : ffff00097648ec58 x4 : 0000000000000000 x3 : 0000000000000027 [ 91.990952] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00080260ba00 [ 91.991000] Call trace: [ 91.991012] refcountwarnsaturate+0xa0/0x144 [ 91.991034] kobjectget+0xac/0xb0 [ 91.991055] ofnodeget+0x2c/0x40 [ 91.991076] offwnodeget+0x40/0x60 [ 91.991094] fwnodehandleget+0x3c/0x60 [ 91.991116] fwnodegetnthparent+0xf4/0x110 [ 91.991137] fwnodefullnamestring+0x48/0xc0 [ 91.991158] devicenodestring+0x41c/0x530 [ 91.991178] pointer+0x320/0x3ec [ 91.991198] vsnprintf+0x23c/0x750 [ 91.991217] vprintkstore+0x104/0x4b0 [ 91.991238] vprintkemit+0x8c/0x360 [ 91.991257] vprintkdefault+0x44/0x50 [ 91.991276] vprintk+0xcc/0xf0 [ 91.991295] _printk+0x68/0x90 [ 91.991315] ofnoderelease+0x13c/0x14c [ 91.991334] kobjectput+0x98/0x114 [ 91.991354] ofnodeput+0x24/0x34 [ 91.991372] offwnodeput+0x40/0x5c [ 91.991390] fwnodehandleput+0x38/0x50 [ 91.991411] coresightreleaseplatformdata+0x74/0xb0 [coresight] [ 91.991472] coresightunregister+0x64/0xcc [coresight] [ 91.991525] etm4removedev+0x64/0x78 [coresightetm4x] [ 91.991563] etm4removeamba+0x1c/0x2c [coresightetm4x] [ 91.991598] amba_remove+0x3c/0x19c ---truncated---
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/2af89ebacf299b7fba5f3087d35e8a286ec33706
- https://git.kernel.org/stable/c/847b9273dd61567fb77617eabc5fa002594db062
- https://git.kernel.org/stable/c/b49b29ee113a87997bcca0bb0585bb46582846c1
- https://git.kernel.org/stable/c/bc57850fcb7e4cb91b6321d0ce83357cefd55c54
- https://git.kernel.org/stable/c/d43e967963c4d1b2b49f894d2f1b12865f87b098
- https://git.kernel.org/stable/c/e9205d8dd1cafb7cff689ef9ddf06276a68f54a4
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced37ea1ffddffa63c920ce826786fe610c78f57842Fixede9205d8dd1cafb7cff689ef9ddf06276a68f54a4
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced37ea1ffddffa63c920ce826786fe610c78f57842Fixed847b9273dd61567fb77617eabc5fa002594db062
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced37ea1ffddffa63c920ce826786fe610c78f57842Fixedb49b29ee113a87997bcca0bb0585bb46582846c1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced37ea1ffddffa63c920ce826786fe610c78f57842Fixedd43e967963c4d1b2b49f894d2f1b12865f87b098
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced37ea1ffddffa63c920ce826786fe610c78f57842Fixedbc57850fcb7e4cb91b6321d0ce83357cefd55c54
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced37ea1ffddffa63c920ce826786fe610c78f57842Fixed2af89ebacf299b7fba5f3087d35e8a286ec33706
Affected versions
v5.*
Database specific
{
"vanir_signatures": [
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@847b9273dd61567fb77617eabc5fa002594db062",
"target": {
"file": "drivers/hwtracing/coresight/coresight-core.c"
},
"id": "CVE-2022-50214-0d26551e",
"digest": {
"line_hashes": [
"303925884261321749258169686060115618947",
"150610056593904267617202787423707750541",
"238150910733934521293556814459729612050",
"309165137723367198945019780829275872478"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9205d8dd1cafb7cff689ef9ddf06276a68f54a4",
"target": {
"file": "drivers/hwtracing/coresight/coresight.c",
"function": "coresight_remove_match"
},
"id": "CVE-2022-50214-267581bf",
"digest": {
"length": 483.0,
"function_hash": "64321899737904921811702070170183656055"
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2af89ebacf299b7fba5f3087d35e8a286ec33706",
"target": {
"file": "drivers/hwtracing/coresight/coresight-core.c",
"function": "coresight_remove_match"
},
"id": "CVE-2022-50214-2b17168d",
"digest": {
"length": 513.0,
"function_hash": "191296272523840399045447508100527725364"
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc57850fcb7e4cb91b6321d0ce83357cefd55c54",
"target": {
"file": "drivers/hwtracing/coresight/coresight-core.c"
},
"id": "CVE-2022-50214-45efe9cb",
"digest": {
"line_hashes": [
"303925884261321749258169686060115618947",
"150610056593904267617202787423707750541",
"238150910733934521293556814459729612050",
"309165137723367198945019780829275872478"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d43e967963c4d1b2b49f894d2f1b12865f87b098",
"target": {
"file": "drivers/hwtracing/coresight/coresight-core.c",
"function": "coresight_remove_match"
},
"id": "CVE-2022-50214-6735b7aa",
"digest": {
"length": 513.0,
"function_hash": "191296272523840399045447508100527725364"
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@847b9273dd61567fb77617eabc5fa002594db062",
"target": {
"file": "drivers/hwtracing/coresight/coresight-core.c",
"function": "coresight_remove_match"
},
"id": "CVE-2022-50214-6b16fb7a",
"digest": {
"length": 513.0,
"function_hash": "191296272523840399045447508100527725364"
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d43e967963c4d1b2b49f894d2f1b12865f87b098",
"target": {
"file": "drivers/hwtracing/coresight/coresight-core.c"
},
"id": "CVE-2022-50214-7c0e7ede",
"digest": {
"line_hashes": [
"303925884261321749258169686060115618947",
"150610056593904267617202787423707750541",
"238150910733934521293556814459729612050",
"309165137723367198945019780829275872478"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9205d8dd1cafb7cff689ef9ddf06276a68f54a4",
"target": {
"file": "drivers/hwtracing/coresight/coresight.c"
},
"id": "CVE-2022-50214-97d8ff7d",
"digest": {
"line_hashes": [
"108731055274607953007805209194363146139",
"237765896775630806062630130705920614665",
"26479966790351258572426235328737087927",
"309165137723367198945019780829275872478"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b49b29ee113a87997bcca0bb0585bb46582846c1",
"target": {
"file": "drivers/hwtracing/coresight/coresight-core.c"
},
"id": "CVE-2022-50214-9ec56edc",
"digest": {
"line_hashes": [
"303925884261321749258169686060115618947",
"150610056593904267617202787423707750541",
"238150910733934521293556814459729612050",
"309165137723367198945019780829275872478"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b49b29ee113a87997bcca0bb0585bb46582846c1",
"target": {
"file": "drivers/hwtracing/coresight/coresight-core.c",
"function": "coresight_remove_match"
},
"id": "CVE-2022-50214-a1f4641d",
"digest": {
"length": 513.0,
"function_hash": "191296272523840399045447508100527725364"
},
"signature_version": "v1"
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2af89ebacf299b7fba5f3087d35e8a286ec33706",
"target": {
"file": "drivers/hwtracing/coresight/coresight-core.c"
},
"id": "CVE-2022-50214-aeca6c48",
"digest": {
"line_hashes": [
"303925884261321749258169686060115618947",
"150610056593904267617202787423707750541",
"238150910733934521293556814459729612050",
"309165137723367198945019780829275872478"
],
"threshold": 0.9
},
"signature_version": "v1"
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bc57850fcb7e4cb91b6321d0ce83357cefd55c54",
"target": {
"file": "drivers/hwtracing/coresight/coresight-core.c",
"function": "coresight_remove_match"
},
"id": "CVE-2022-50214-c215a02c",
"digest": {
"length": 513.0,
"function_hash": "191296272523840399045447508100527725364"
},
"signature_version": "v1"
}
]
}