In the Linux kernel, the following vulnerability has been resolved:
spmi: Add a check for remove callback when removing a SPMI driver
When removing a SPMI driver, there can be a crash due to NULL pointer dereference if it does not have a remove callback defined. This is one such call trace observed when removing the QCOM SPMI PMIC driver:
dumpbacktrace.cfijt+0x0/0x8 dumpstacklvl+0xd8/0x16c panic+0x188/0x498 _cfislowpath+0x0/0x214 _cfislowpath+0x1dc/0x214 spmidrvremove+0x16c/0x1e0 devicereleasedriverinternal+0x468/0x79c driverdetach+0x11c/0x1a0 busremovedriver+0xc4/0x124 driverunregister+0x58/0x84 cleanupmodule+0x1c/0xc24 [qcomspmipmic] _dosysdeletemodule+0x3ec/0x53c _arm64sysdeletemodule+0x18/0x28 el0svccommon+0xdc/0x294 el0svc+0x38/0x9c el0synchandler+0x8c/0xf0 el0sync+0x1b4/0x1c0
If a driver has all its resources allocated through devm_() APIs and does not need any other explicit cleanup, it would not require a remove callback to be defined. Hence, add a check for remove callback presence before calling it when removing a SPMI driver.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/54xxx/CVE-2023-54044.json",
"cna_assigner": "Linux"
}