CVE-2022-49021

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: phy: fix null-ptr-deref while probe() failed<br /> <br /> I got a null-ptr-deref report as following when doing fault injection test:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000058<br /> Oops: 0000 [#1] PREEMPT SMP KASAN PTI<br /> CPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G B N 6.1.0-rc3+<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014<br /> RIP: 0010:klist_put+0x2d/0xd0<br /> Call Trace:<br /> <br /> klist_remove+0xf1/0x1c0<br /> device_release_driver_internal+0x23e/0x2d0<br /> bus_remove_device+0x1bd/0x240<br /> device_del+0x357/0x770<br /> phy_device_remove+0x11/0x30<br /> mdiobus_unregister+0xa5/0x140<br /> release_nodes+0x6a/0xa0<br /> devres_release_all+0xf8/0x150<br /> device_unbind_cleanup+0x19/0xd0<br /> <br /> //probe path:<br /> phy_device_register()<br /> device_add()<br /> <br /> phy_connect<br /> phy_attach_direct() //set device driver<br /> probe() //it&amp;#39;s failed, driver is not bound<br /> device_bind_driver() // probe failed, it&amp;#39;s not called<br /> <br /> //remove path:<br /> phy_device_remove()<br /> device_del()<br /> device_release_driver_internal()<br /> __device_release_driver() //dev-&gt;drv is not NULL<br /> klist_remove() driver&amp;#39;, probe() fails,<br /> device_bind_driver() is not called, so the knode_driver-&gt;n_klist is not<br /> set, then it causes null-ptr-deref in __device_release_driver() while<br /> deleting device. Fix this by setting dev-&gt;driver to NULL in the error<br /> path in phy_attach_direct().