CVE-2022-49827

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()<br /> <br /> drm_vblank_init() call drmm_add_action_or_reset() with<br /> drm_vblank_init_release() as action. If __drmm_add_action() failed, will<br /> directly call drm_vblank_init_release() with the vblank whose worker is<br /> NULL. As the resule, a null-ptr-deref will happen in<br /> kthread_destroy_worker(). Add the NULL check before calling<br /> drm_vblank_destroy_worker().<br /> <br /> BUG: null-ptr-deref<br /> KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f]<br /> CPU: 5 PID: 961 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf-dirty<br /> RIP: 0010:kthread_destroy_worker+0x25/0xb0<br /> Call Trace:<br /> <br /> drm_vblank_init_release+0x124/0x220 [drm]<br /> ? drm_crtc_vblank_restore+0x8b0/0x8b0 [drm]<br /> __drmm_add_action_or_reset+0x41/0x50 [drm]<br /> drm_vblank_init+0x282/0x310 [drm]<br /> vkms_init+0x35f/0x1000 [vkms]<br /> ? 0xffffffffc4508000<br /> ? lock_is_held_type+0xd7/0x130<br /> ? __kmem_cache_alloc_node+0x1c2/0x2b0<br /> ? lock_is_held_type+0xd7/0x130<br /> ? 0xffffffffc4508000<br /> do_one_initcall+0xd0/0x4f0<br /> ...<br /> do_syscall_64+0x35/0x80<br /> entry_SYSCALL_64_after_hwframe+0x46/0xb0