CVE-2021-47413

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> usb: chipidea: ci_hdrc_imx: Also search for &amp;#39;phys&amp;#39; phandle<br /> <br /> When passing &amp;#39;phys&amp;#39; in the devicetree to describe the USB PHY phandle<br /> (which is the recommended way according to<br /> Documentation/devicetree/bindings/usb/ci-hdrc-usb2.txt) the<br /> following NULL pointer dereference is observed on i.MX7 and i.MX8MM:<br /> <br /> [ 1.489344] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000098<br /> [ 1.498170] Mem abort info:<br /> [ 1.500966] ESR = 0x96000044<br /> [ 1.504030] EC = 0x25: DABT (current EL), IL = 32 bits<br /> [ 1.509356] SET = 0, FnV = 0<br /> [ 1.512416] EA = 0, S1PTW = 0<br /> [ 1.515569] FSC = 0x04: level 0 translation fault<br /> [ 1.520458] Data abort info:<br /> [ 1.523349] ISV = 0, ISS = 0x00000044<br /> [ 1.527196] CM = 0, WnR = 1<br /> [ 1.530176] [0000000000000098] user address but active_mm is swapper<br /> [ 1.536544] Internal error: Oops: 96000044 [#1] PREEMPT SMP<br /> [ 1.542125] Modules linked in:<br /> [ 1.545190] CPU: 3 PID: 7 Comm: kworker/u8:0 Not tainted 5.14.0-dirty #3<br /> [ 1.551901] Hardware name: Kontron i.MX8MM N801X S (DT)<br /> [ 1.557133] Workqueue: events_unbound deferred_probe_work_func<br /> [ 1.562984] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)<br /> [ 1.568998] pc : imx7d_charger_detection+0x3f0/0x510<br /> [ 1.573973] lr : imx7d_charger_detection+0x22c/0x510<br /> <br /> This happens because the charger functions check for the phy presence<br /> inside the imx_usbmisc_data structure (data-&gt;usb_phy), but the chipidea<br /> core populates the usb_phy passed via &amp;#39;phys&amp;#39; inside &amp;#39;struct ci_hdrc&amp;#39;<br /> (ci-&gt;usb_phy) instead.<br /> <br /> This causes the NULL pointer dereference inside imx7d_charger_detection().<br /> <br /> Fix it by also searching for &amp;#39;phys&amp;#39; in case &amp;#39;fsl,usbphy&amp;#39; is not found.<br /> <br /> Tested on a imx7s-warp board.