CVE-2022-48878

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: hci_qca: Fix driver shutdown on closed serdev<br /> <br /> The driver shutdown callback (which sends EDL_SOC_RESET to the device<br /> over serdev) should not be invoked when HCI device is not open (e.g. if<br /> hci_dev_open_sync() failed), because the serdev and its TTY are not open<br /> either. Also skip this step if device is powered off<br /> (qca_power_shutdown()).<br /> <br /> The shutdown callback causes use-after-free during system reboot with<br /> Qualcomm Atheros Bluetooth:<br /> <br /> Unable to handle kernel paging request at virtual address<br /> 0072662f67726fd7<br /> ...<br /> CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G W<br /> 6.1.0-rt5-00325-g8a5f56bcfcca #8<br /> Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)<br /> Call trace:<br /> tty_driver_flush_buffer+0x4/0x30<br /> serdev_device_write_flush+0x24/0x34<br /> qca_serdev_shutdown+0x80/0x130 [hci_uart]<br /> device_shutdown+0x15c/0x260<br /> kernel_restart+0x48/0xac<br /> <br /> KASAN report:<br /> <br /> BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50<br /> Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1<br /> <br /> CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted<br /> 6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28<br /> Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)<br /> Call trace:<br /> dump_backtrace.part.0+0xdc/0xf0<br /> show_stack+0x18/0x30<br /> dump_stack_lvl+0x68/0x84<br /> print_report+0x188/0x488<br /> kasan_report+0xa4/0xf0<br /> __asan_load8+0x80/0xac<br /> tty_driver_flush_buffer+0x1c/0x50<br /> ttyport_write_flush+0x34/0x44<br /> serdev_device_write_flush+0x48/0x60<br /> qca_serdev_shutdown+0x124/0x274<br /> device_shutdown+0x1e8/0x350<br /> kernel_restart+0x48/0xb0<br /> __do_sys_reboot+0x244/0x2d0<br /> __arm64_sys_reboot+0x54/0x70<br /> invoke_syscall+0x60/0x190<br /> el0_svc_common.constprop.0+0x7c/0x160<br /> do_el0_svc+0x44/0xf0<br /> el0_svc+0x2c/0x6c<br /> el0t_64_sync_handler+0xbc/0x140<br /> el0t_64_sync+0x190/0x194