[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i2c/busses/i2c-piix4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"528d53a1592b0e27c423f7cafc1df85f77fc1163","lessThan":"bfd5e62f9a7ee214661cb6f143a3b40ccc63317f","versionType":"git","status":"affected"},{"version":"528d53a1592b0e27c423f7cafc1df85f77fc1163","lessThan":"d78ccdce662e88f41e87e90cf2bee63c1715d2a5","versionType":"git","status":"affected"},{"version":"528d53a1592b0e27c423f7cafc1df85f77fc1163","lessThan":"fe51636fffc8108c7c4da6aa393010e786530ad9","versionType":"git","status":"affected"},{"version":"528d53a1592b0e27c423f7cafc1df85f77fc1163","lessThan":"569bea74c94d37785682b11bab76f557520477cd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i2c/busses/i2c-piix4.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"5.10.154","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.78","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.0.8","lessThanOrEqual":"6.0.*","versionType":"semver","status":"unaffected"},{"version":"6.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-415

OR
          *cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.78
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.0.8
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4 up to (excluding) 5.10.154

kernel.org: https://git.kernel.org/stable/c/569bea74c94d37785682b11bab76f557520477cd Types: Patch

kernel.org: https://git.kernel.org/stable/c/bfd5e62f9a7ee214661cb6f143a3b40ccc63317f Types: Patch

kernel.org: https://git.kernel.org/stable/c/d78ccdce662e88f41e87e90cf2bee63c1715d2a5 Types: Patch

kernel.org: https://git.kernel.org/stable/c/fe51636fffc8108c7c4da6aa393010e786530ad9 Types: Patch

In the Linux kernel, the following vulnerability has been resolved:

i2c: piix4: Fix adapter not be removed in piix4_remove()

In piix4_probe(), the piix4 adapter will be registered in:

   piix4_probe()
     piix4_add_adapters_sb800() / piix4_add_adapter()
       i2c_add_adapter()

Based on the probed device type, piix4_add_adapters_sb800() or single
piix4_add_adapter() will be called.
For the former case, piix4_adapter_count is set as the number of adapters,
while for antoher case it is not set and kept default *zero*.

When piix4 is removed, piix4_remove() removes the adapters added in
piix4_probe(), basing on the piix4_adapter_count value.
Because the count is zero for the single adapter case, the adapter won't
be removed and makes the sources allocated for adapter leaked, such as
the i2c client and device.

These sources can still be accessed by i2c or bus and cause problems.
An easily reproduced case is that if a new adapter is registered, i2c
will get the leaked adapter and try to call smbus_algorithm, which was
already freed:

Triggered by: rmmod i2c_piix4 && modprobe max31730

 BUG: unable to handle page fault for address: ffffffffc053d860
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 Oops: 0000 [#1] PREEMPT SMP KASAN
 CPU: 0 PID: 3752 Comm: modprobe Tainted: G
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
 RIP: 0010:i2c_default_probe (drivers/i2c/i2c-core-base.c:2259) i2c_core
 RSP: 0018:ffff888107477710 EFLAGS: 00000246
 ...
 <TASK>
  i2c_detect (drivers/i2c/i2c-core-base.c:2302) i2c_core
  __process_new_driver (drivers/i2c/i2c-core-base.c:1336) i2c_core
  bus_for_each_dev (drivers/base/bus.c:301)
  i2c_for_each_dev (drivers/i2c/i2c-core-base.c:1823) i2c_core
  i2c_register_driver (drivers/i2c/i2c-core-base.c:1861) i2c_core
  do_one_initcall (init/main.c:1296)
  do_init_module (kernel/module/main.c:2455)
  ...
 </TASK>
 ---[ end trace 0000000000000000 ]---

Fix this problem by correctly set piix4_adapter_count as 1 for the
single adapter so it can be 

https://git.kernel.org/stable/c/569bea74c94d37785682b11bab76f557520477cd

https://git.kernel.org/stable/c/bfd5e62f9a7ee214661cb6f143a3b40ccc63317f

https://git.kernel.org/stable/c/d78ccdce662e88f41e87e90cf2bee63c1715d2a5

https://git.kernel.org/stable/c/fe51636fffc8108c7c4da6aa393010e786530ad9