In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero.
dvfsinfo.oppcount may be zero on some platforms during the reboot test, and the kernel will crash after dereferencing the pointer to kcalloc(info->count, sizeof(*opp), GFP_KERNEL).
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 | Mem abort info: | ESR = 0x96000004 | Exception class = DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | Data abort info: | ISV = 0, ISS = 0x00000004 | CM = 0, WnR = 0 | user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000faefa08c | [0000000000000028] pgd=0000000000000000 | Internal error: Oops: 96000004 [#1] SMP | scpi-hwmon: probe of PHYT000D:00 failed with error -110 | Process systemd-udevd (pid: 1701, stack limit = 0x00000000aaede86c) | CPU: 2 PID: 1701 Comm: systemd-udevd Not tainted 4.19.90+ #1 | Hardware name: PHYTIUM LTD Phytium FT2000/4/Phytium FT2000/4, BIOS | pstate: 60000005 (nZCv daif -PAN -UAO) | pc : scpidvfsrecalcrate+0x40/0x58 [clkscpi] | lr : clkregister+0x438/0x720 | Call trace: | scpidvfsrecalcrate+0x40/0x58 [clkscpi] | devmclkhwregister+0x50/0xa0 | scpiclkopsinit.isra.2+0xa0/0x138 [clkscpi] | scpiclocksprobe+0x528/0x70c [clkscpi] | platformdrvprobe+0x58/0xa8 | reallyprobe+0x260/0x3d0 | driverprobedevice+0x12c/0x148 | devicedriverattach+0x74/0x98 | _driverattach+0xb4/0xe8 | busforeachdev+0x88/0xe0 | driverattach+0x30/0x40 | busadddriver+0x178/0x2b0 | driverregister+0x64/0x118 | _platformdriverregister+0x54/0x60 | scpiclocksdriverinit+0x24/0x1000 [clkscpi] | dooneinitcall+0x54/0x220 | doinitmodule+0x54/0x1c8 | loadmodule+0x14a4/0x1668 | _sesysfinitmodule+0xf8/0x110 | _arm64sysfinitmodule+0x24/0x30 | el0svccommon+0x78/0x170 | el0svchandler+0x38/0x78 | el0svc+0x8/0x340 | Code: 937d7c00 a94153f3 a8c27bfd f9400421 (b8606820) | ---[ end trace 06feb22469d89fa8 ]--- | Kernel panic - not syncing: Fatal exception | SMP: stopping secondary CPUs | Kernel Offset: disabled | CPU features: 0x10,a0002008 | Memory Limit: none
[ { "signature_type": "Function", "id": "CVE-2024-53157-22de5d26", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06258e57fee253f4046d3a6a86d7fde09f596eac", "signature_version": "v1", "target": { "function": "scpi_dvfs_get_info", "file": "drivers/firmware/arm_scpi.c" }, "digest": { "function_hash": "159312116229737956954118290693340591761", "length": 1022.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53157-3123fd86", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8be4e51f3ecfb0915e3510b600c4cce0dc68a383", "signature_version": "v1", "target": { "function": "scpi_dvfs_get_info", "file": "drivers/firmware/arm_scpi.c" }, "digest": { "function_hash": "159312116229737956954118290693340591761", "length": 1022.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53157-3d4c0c1c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@380c0e1d96f3b522f3170c18ee5e0f1a28fec5d6", "signature_version": "v1", "target": { "function": "scpi_dvfs_get_info", "file": "drivers/firmware/arm_scpi.c" }, "digest": { "function_hash": "159312116229737956954118290693340591761", "length": 1022.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53157-507a2ad1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@025067eeb945aa17c7dd483a63960125b7efb577", "signature_version": "v1", "target": { "file": "drivers/firmware/arm_scpi.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44748627845521876522575818372478001442", "46982498736334875100061270488732190141", "202690833264108601598235354720938848727" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53157-5611a13b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06258e57fee253f4046d3a6a86d7fde09f596eac", "signature_version": "v1", "target": { "file": "drivers/firmware/arm_scpi.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44748627845521876522575818372478001442", "46982498736334875100061270488732190141", "202690833264108601598235354720938848727" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53157-65d638ea", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@109aa654f85c5141e813b2cd1bd36d90be678407", "signature_version": "v1", "target": { "function": "scpi_dvfs_get_info", "file": "drivers/firmware/arm_scpi.c" }, "digest": { "function_hash": "159312116229737956954118290693340591761", "length": 1022.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53157-6697e19b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfc9c2aa7f04f7db7e7225a5e118a24bf1c3b325", "signature_version": "v1", "target": { "file": "drivers/firmware/arm_scpi.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44748627845521876522575818372478001442", "46982498736334875100061270488732190141", "202690833264108601598235354720938848727" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53157-711eeb0d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@109aa654f85c5141e813b2cd1bd36d90be678407", "signature_version": "v1", "target": { "file": "drivers/firmware/arm_scpi.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44748627845521876522575818372478001442", "46982498736334875100061270488732190141", "202690833264108601598235354720938848727" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53157-741ac4ba", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@025067eeb945aa17c7dd483a63960125b7efb577", "signature_version": "v1", "target": { "function": "scpi_dvfs_get_info", "file": "drivers/firmware/arm_scpi.c" }, "digest": { "function_hash": "159312116229737956954118290693340591761", "length": 1022.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53157-745b3e31", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9beaff47bcea5eec7d4ead98f5043057161fd71a", "signature_version": "v1", "target": { "file": "drivers/firmware/arm_scpi.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44748627845521876522575818372478001442", "46982498736334875100061270488732190141", "202690833264108601598235354720938848727" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53157-75694576", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a5b8de6fcb944f9af0c5fcb30bb0c039705e051", "signature_version": "v1", "target": { "file": "drivers/firmware/arm_scpi.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44748627845521876522575818372478001442", "46982498736334875100061270488732190141", "202690833264108601598235354720938848727" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53157-887b764a", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a5b8de6fcb944f9af0c5fcb30bb0c039705e051", "signature_version": "v1", "target": { "function": "scpi_dvfs_get_info", "file": "drivers/firmware/arm_scpi.c" }, "digest": { "function_hash": "159312116229737956954118290693340591761", "length": 1022.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53157-9532524e", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12e2c520a0a4202575e4a45ea41f06a8e9aa3417", "signature_version": "v1", "target": { "file": "drivers/firmware/arm_scpi.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44748627845521876522575818372478001442", "46982498736334875100061270488732190141", "202690833264108601598235354720938848727" ] }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53157-b2f7e995", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8be4e51f3ecfb0915e3510b600c4cce0dc68a383", "signature_version": "v1", "target": { "file": "drivers/firmware/arm_scpi.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44748627845521876522575818372478001442", "46982498736334875100061270488732190141", "202690833264108601598235354720938848727" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53157-bb5cbe05", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dfc9c2aa7f04f7db7e7225a5e118a24bf1c3b325", "signature_version": "v1", "target": { "function": "scpi_dvfs_get_info", "file": "drivers/firmware/arm_scpi.c" }, "digest": { "function_hash": "159312116229737956954118290693340591761", "length": 1022.0 }, "deprecated": false }, { "signature_type": "Line", "id": "CVE-2024-53157-c391d4de", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@380c0e1d96f3b522f3170c18ee5e0f1a28fec5d6", "signature_version": "v1", "target": { "file": "drivers/firmware/arm_scpi.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "44748627845521876522575818372478001442", "46982498736334875100061270488732190141", "202690833264108601598235354720938848727" ] }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53157-e438cda5", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9beaff47bcea5eec7d4ead98f5043057161fd71a", "signature_version": "v1", "target": { "function": "scpi_dvfs_get_info", "file": "drivers/firmware/arm_scpi.c" }, "digest": { "function_hash": "159312116229737956954118290693340591761", "length": 1022.0 }, "deprecated": false }, { "signature_type": "Function", "id": "CVE-2024-53157-eafd096b", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12e2c520a0a4202575e4a45ea41f06a8e9aa3417", "signature_version": "v1", "target": { "function": "scpi_dvfs_get_info", "file": "drivers/firmware/arm_scpi.c" }, "digest": { "function_hash": "159312116229737956954118290693340591761", "length": 1022.0 }, "deprecated": false } ]