Description
In the Linux kernel, the following vulnerability has been resolved: most: usb: Fix use-after-free in hdm_disconnect hdm_disconnect() calls most_deregister_interface(), which eventually unregisters the MOST interface device with device_unregister(iface->dev). If that drops the last reference, the device core may call release_mdev() immediately while hdm_disconnect() is still executing. The old code also freed several mdev-owned allocations in hdm_disconnect() and then performed additional put_device() calls. Depending on refcount order, this could lead to use-after-free or double-free when release_mdev() ran (or when unregister paths also performed puts). Fix by moving the frees of mdev-owned allocations into release_mdev(), so they happen exactly once when the device is truly released, and by dropping the extra put_device() calls in hdm_disconnect() that are redundant after device_unregister() and most_deregister_interface(). This addresses the KASAN slab-use-after-free reported by syzbot in hdm_disconnect(). See report and stack traces in the bug link below.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
97a6f772f36b7f52bcfa56a581bbd2470cffe23d to < 5b5c478f09b1b35e7fe6fc9a1786c9bf6030e831affected97a6f772f36b7f52bcfa56a581bbd2470cffe23d to < 578eb18cd111addec94c43f61cd4b4429e454809affected97a6f772f36b7f52bcfa56a581bbd2470cffe23d to < 33daf469f5294b9d07c4fc98216cace9f4f34cc6affected97a6f772f36b7f52bcfa56a581bbd2470cffe23d to < 72427dc6f87523995f4e6ae35a948bb2992cabceaffected97a6f772f36b7f52bcfa56a581bbd2470cffe23d to < f93a84ffb884d761a9d4e869ba29c238711e81f1affected97a6f772f36b7f52bcfa56a581bbd2470cffe23d to < 3a3b8e89c7201c5b3b76ac4a4069d1adde1477d6affected97a6f772f36b7f52bcfa56a581bbd2470cffe23d to < 4b1270902609ef0d935ed2faa2ea6d122bd148f5affected
Linux Linux
Default version status: affected
5.9affected0 to < 5.9unaffected5.10.246 to ≤ 5.10.*unaffected5.15.196 to ≤ 5.15.*unaffected6.1.158 to ≤ 6.1.*unaffected6.6.115 to ≤ 6.6.*unaffected6.12.56 to ≤ 6.12.*unaffected6.17.6 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5b5c478f09b1b35e7fe6fc9a1786c9bf6030e831 ↗
- https://git.kernel.org/stable/c/578eb18cd111addec94c43f61cd4b4429e454809 ↗
- https://git.kernel.org/stable/c/33daf469f5294b9d07c4fc98216cace9f4f34cc6 ↗
- https://git.kernel.org/stable/c/72427dc6f87523995f4e6ae35a948bb2992cabce ↗
- https://git.kernel.org/stable/c/f93a84ffb884d761a9d4e869ba29c238711e81f1 ↗
- https://git.kernel.org/stable/c/3a3b8e89c7201c5b3b76ac4a4069d1adde1477d6 ↗
- https://git.kernel.org/stable/c/4b1270902609ef0d935ed2faa2ea6d122bd148f5 ↗