CVE-2022-50144

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

soundwire: revisit driver bind/unbind and callbacks

In the SoundWire probe, we store a pointer from the driver ops into

the 'slave' structure. This can lead to kernel oopses when unbinding

codec drivers, e.g. with the following sequence to remove machine

driver and codec driver.

/sbin/modprobe -r snd_soc_sof_sdw

/sbin/modprobe -r snd_soc_rt711

The full details can be found in the BugLink below, for reference the

two following examples show different cases of driver ops/callbacks

being invoked after the driver .remove().

kernel: BUG: kernel NULL pointer dereference, address: 0000000000000150

kernel: Workqueue: events cdns_update_slave_status_work [soundwire_cadence]

kernel: RIP: 0010:mutex_lock+0x19/0x30

kernel: Call Trace:

kernel: ? sdw_handle_slave_status+0x426/0xe00 [soundwire_bus 94ff184bf398570c3f8ff7efe9e32529f532e4ae]

kernel: ? newidle_balance+0x26a/0x400

kernel: ? cdns_update_slave_status_work+0x1e9/0x20

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References