CVE-2022-49900

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> i2c: piix4: Fix adapter not be removed in piix4_remove()<br /> <br /> In piix4_probe(), the piix4 adapter will be registered in:<br /> <br /> piix4_probe()<br /> piix4_add_adapters_sb800() / piix4_add_adapter()<br /> i2c_add_adapter()<br /> <br /> Based on the probed device type, piix4_add_adapters_sb800() or single<br /> piix4_add_adapter() will be called.<br /> For the former case, piix4_adapter_count is set as the number of adapters,<br /> while for antoher case it is not set and kept default *zero*.<br /> <br /> When piix4 is removed, piix4_remove() removes the adapters added in<br /> piix4_probe(), basing on the piix4_adapter_count value.<br /> Because the count is zero for the single adapter case, the adapter won&amp;#39;t<br /> be removed and makes the sources allocated for adapter leaked, such as<br /> the i2c client and device.<br /> <br /> These sources can still be accessed by i2c or bus and cause problems.<br /> An easily reproduced case is that if a new adapter is registered, i2c<br /> will get the leaked adapter and try to call smbus_algorithm, which was<br /> already freed:<br /> <br /> Triggered by: rmmod i2c_piix4 &amp;&amp; modprobe max31730<br /> <br /> BUG: unable to handle page fault for address: ffffffffc053d860<br /> #PF: supervisor read access in kernel mode<br /> #PF: error_code(0x0000) - not-present page<br /> Oops: 0000 [#1] PREEMPT SMP KASAN<br /> CPU: 0 PID: 3752 Comm: modprobe Tainted: G<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)<br /> RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core<br /> RSP: 0018:ffff888107477710 EFLAGS: 00000246<br /> ...<br /> <br /> i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core<br /> __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core<br /> bus_for_each_dev (drivers/base/bus.c:301)<br /> i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core<br /> i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core<br /> do_one_initcall (init/main.c:1296)<br /> do_init_module (kernel/module/main.c:2455)<br /> ...<br /> <br /> ---[ end trace 0000000000000000 ]---<br /> <br /> Fix this problem by correctly set piix4_adapter_count as 1 for the<br /> single adapter so it can be normally removed.