Description
In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Update uart_driver_registered on driver removal The removal of the last MAX3100 device triggers the removal of the driver. However, code doesn't update the respective global variable and after insmod — rmmod — insmod cycle the kernel oopses: max3100 spi-PRP0001:01: max3100_probe: adding port 0 BUG: kernel NULL pointer dereference, address: 0000000000000408 ... RIP: 0010:serial_core_register_port+0xa0/0x840 ... max3100_probe+0x1b6/0x280 [max3100] spi_probe+0x8d/0xb0 Update the actual state so next time UART driver will be registered again. Hugo also noticed, that the error path in the probe also affected by having the variable set, and not cleared. Instead of clearing it move the assignment after the successfull uart_register_driver() call.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7831d56b0a3544cbb6f82f76c34ca95e24d5b676 to < 21a61a7fbcfdd3493cede43ebc7c4dfae2147a8baffected7831d56b0a3544cbb6f82f76c34ca95e24d5b676 to < 9db4222ed8cd3e50b81c8b910ae74c26427a4003affected7831d56b0a3544cbb6f82f76c34ca95e24d5b676 to < e8e2a4339decad7e59425b594a98613402652d72affected7831d56b0a3544cbb6f82f76c34ca95e24d5b676 to < 361a92c9038e8c8c3996f8eeaa14522a8ad90752affected7831d56b0a3544cbb6f82f76c34ca95e24d5b676 to < b6eb7aff23e05f362e8c9b560f6ac5e727b70e00affected7831d56b0a3544cbb6f82f76c34ca95e24d5b676 to < e8a10089eddba40d4b2080c9d3fc2d2b2488f762affected7831d56b0a3544cbb6f82f76c34ca95e24d5b676 to < fa84ca78b048dfb00df0ef446f5c35e0a98ca6a0affected7831d56b0a3544cbb6f82f76c34ca95e24d5b676 to < 712a1fcb38dc7cac6da63ee79a88708fbf9c45ecaffected
Linux Linux
Default version status: affected
2.6.30affected0 to < 2.6.30unaffected4.19.316 to ≤ 4.19.*unaffected5.4.278 to ≤ 5.4.*unaffected5.10.219 to ≤ 5.10.*unaffected5.15.161 to ≤ 5.15.*unaffected6.1.93 to ≤ 6.1.*unaffected6.6.33 to ≤ 6.6.*unaffected6.9.4 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/21a61a7fbcfdd3493cede43ebc7c4dfae2147a8b ↗
- https://git.kernel.org/stable/c/9db4222ed8cd3e50b81c8b910ae74c26427a4003 ↗
- https://git.kernel.org/stable/c/e8e2a4339decad7e59425b594a98613402652d72 ↗
- https://git.kernel.org/stable/c/361a92c9038e8c8c3996f8eeaa14522a8ad90752 ↗
- https://git.kernel.org/stable/c/b6eb7aff23e05f362e8c9b560f6ac5e727b70e00 ↗
- https://git.kernel.org/stable/c/e8a10089eddba40d4b2080c9d3fc2d2b2488f762 ↗
- https://git.kernel.org/stable/c/fa84ca78b048dfb00df0ef446f5c35e0a98ca6a0 ↗
- https://git.kernel.org/stable/c/712a1fcb38dc7cac6da63ee79a88708fbf9c45ec ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗