Description
In the Linux kernel, the following vulnerability has been resolved: cxl/port: Hold port reference until decoder release KASAN + DEBUG_KOBJECT_RELEASE reports a potential use-after-free in cxl_decoder_release() where it goes to reference its parent, a cxl_port, to free its id back to port->decoder_ida. BUG: KASAN: use-after-free in to_cxl_port+0x18/0x90 [cxl_core] Read of size 8 at addr ffff888119270908 by task kworker/35:2/379 CPU: 35 PID: 379 Comm: kworker/35:2 Tainted: G OE 5.17.0-rc2+ #198 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Workqueue: events kobject_delayed_cleanup Call Trace: <TASK> dump_stack_lvl+0x59/0x73 print_address_description.constprop.0+0x1f/0x150 ? to_cxl_port+0x18/0x90 [cxl_core] kasan_report.cold+0x83/0xdf ? to_cxl_port+0x18/0x90 [cxl_core] to_cxl_port+0x18/0x90 [cxl_core] cxl_decoder_release+0x2a/0x60 [cxl_core] device_release+0x5f/0x100 kobject_cleanup+0x80/0x1c0 The device core only guarantees parent lifetime until all children are unregistered. If a child needs a parent to complete its ->release() callback that child needs to hold a reference to extend the lifetime of the parent.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
40ba17afdfabb01688c61565dbe02a916241bc05 to < 518bb96367123062b48b0a9842f2864249b565f6affected40ba17afdfabb01688c61565dbe02a916241bc05 to < b0022ca445d5fc4d0c89d15dcd0f855977b22c1daffected40ba17afdfabb01688c61565dbe02a916241bc05 to < 49f2dab77a5e1354f5da6ccdc9346a8212697be2affected40ba17afdfabb01688c61565dbe02a916241bc05 to < 74be98774dfbc5b8b795db726bd772e735d2edd4affected
Linux Linux
Default version status: affected
5.14affected0 to < 5.14unaffected5.15.54 to ≤ 5.15.*unaffected5.16.19 to ≤ 5.16.*unaffected5.17.2 to ≤ 5.17.*unaffected5.18 to ≤ *unaffected