{"id":"CVE-2022-49021","summary":"net: phy: fix null-ptr-deref while probe() failed","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: fix null-ptr-deref while probe() failed\n\nI got a null-ptr-deref report as following when doing fault injection test:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000058\nOops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 1 PID: 253 Comm: 507-spi-dm9051 Tainted: G    B            N 6.1.0-rc3+\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014\nRIP: 0010:klist_put+0x2d/0xd0\nCall Trace:\n \u003cTASK\u003e\n klist_remove+0xf1/0x1c0\n device_release_driver_internal+0x23e/0x2d0\n bus_remove_device+0x1bd/0x240\n device_del+0x357/0x770\n phy_device_remove+0x11/0x30\n mdiobus_unregister+0xa5/0x140\n release_nodes+0x6a/0xa0\n devres_release_all+0xf8/0x150\n device_unbind_cleanup+0x19/0xd0\n\n//probe path:\nphy_device_register()\n  device_add()\n\nphy_connect\n  phy_attach_direct() //set device driver\n    probe() //it's failed, driver is not bound\n    device_bind_driver() // probe failed, it's not called\n\n//remove path:\nphy_device_remove()\n  device_del()\n    device_release_driver_internal()\n      __device_release_driver() //dev-\u003edrv is not NULL\n        klist_remove() \u003c- knode_driver is not added yet, cause null-ptr-deref\n\nIn phy_attach_direct(), after setting the 'dev-\u003edriver', probe() fails,\ndevice_bind_driver() is not called, so the knode_driver-\u003en_klist is not\nset, then it causes null-ptr-deref in __device_release_driver() while\ndeleting device. Fix this by setting dev-\u003edriver to NULL in the error\npath in phy_attach_direct().","modified":"2026-04-02T08:27:14.457287Z","published":"2024-10-21T20:06:28.608Z","related":["SUSE-SU-2024:3983-1","SUSE-SU-2024:3985-1","SUSE-SU-2024:4082-1","SUSE-SU-2024:4100-1","SUSE-SU-2024:4131-1","SUSE-SU-2024:4313-1","SUSE-SU-2024:4317-1","SUSE-SU-2024:4364-1","SUSE-SU-2025:0034-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49021.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0744c7be4de564db03e24527b2e096b7e0e20972"},{"type":"WEB","url":"https://git.kernel.org/stable/c/369eb2c9f1f72adbe91e0ea8efb130f0a2ba11a6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3e21f85d87c836462bb52ef2078ea561260935c1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/51d7f6b20fae8bae64ad1136f1e30d1fd5ba78f7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7730904f50c7187dd16c76949efb56b5fb55cd57"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8aaafe0f71314f46a066382a047ba8bb3840d273"},{"type":"WEB","url":"https://git.kernel.org/stable/c/eaa5722549ac2604ffa56c2e946acc83226f130c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fe6bc99c27c21348f548966118867ed26a9a372c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49021.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49021"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e13934563db047043ccead26412f552375cea90c"},{"fixed":"8aaafe0f71314f46a066382a047ba8bb3840d273"},{"fixed":"51d7f6b20fae8bae64ad1136f1e30d1fd5ba78f7"},{"fixed":"0744c7be4de564db03e24527b2e096b7e0e20972"},{"fixed":"3e21f85d87c836462bb52ef2078ea561260935c1"},{"fixed":"fe6bc99c27c21348f548966118867ed26a9a372c"},{"fixed":"7730904f50c7187dd16c76949efb56b5fb55cd57"},{"fixed":"eaa5722549ac2604ffa56c2e946acc83226f130c"},{"fixed":"369eb2c9f1f72adbe91e0ea8efb130f0a2ba11a6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49021.json"}}],"schema_version":"1.7.5"}