CVE-2023-52492

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: fix NULL pointer in channel unregistration function

__dma_async_device_channel_register() can fail. In case of failure,

chan->local is freed (with free_percpu()), and chan->local is nullified.

When dma_async_device_unregister() is called (because of managed API or

intentionally by DMA controller driver), channels are unconditionally

unregistered, leading to this NULL pointer:

[ 1.318693] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0

[...]

[ 1.484499] Call trace:

[ 1.486930] device_del+0x40/0x394

[ 1.490314] device_unregister+0x20/0x7c

[ 1.494220] __dma_async_device_channel_unregister+0x68/0xc0

Look at dma_async_device_register() function error path, channel device

unregistration is done only if chan->local is not NULL.

Then add the same condition at the beginning of

__dma_async_device_channel_unregister() function, to avoid NULL pointer

issue whate

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References