CVE-2022-50453

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> gpiolib: cdev: fix NULL-pointer dereferences<br /> <br /> There are several places where we can crash the kernel by requesting<br /> lines, unbinding the GPIO device, then calling any of the system calls<br /> relevant to the GPIO character device&amp;#39;s annonymous file descriptors:<br /> ioctl(), read(), poll().<br /> <br /> While I observed it with the GPIO simulator, it will also happen for any<br /> of the GPIO devices that can be hot-unplugged - for instance any HID GPIO<br /> expander (e.g. CP2112).<br /> <br /> This affects both v1 and v2 uAPI.<br /> <br /> This fixes it partially by checking if gdev-&gt;chip is not NULL but it<br /> doesn&amp;#39;t entirely remedy the situation as we still have a race condition<br /> in which another thread can remove the device after the check.