CVE-2022-49430

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Input: gpio-keys - cancel delayed work only in case of GPIO

gpio_keys module can either accept gpios or interrupts. The module

initializes delayed work in case of gpios only and is only used if

debounce timer is not used, so make sure cancel_delayed_work_sync()

is called only when its gpio-backed and debounce_use_hrtimer is false.

This fixes the issue seen below when the gpio_keys module is unloaded and

an interrupt pin is used instead of GPIO:

[ 360.297569] ------------[ cut here ]------------

[ 360.302303] WARNING: CPU: 0 PID: 237 at kernel/workqueue.c:3066 __flush_work+0x414/0x470

[ 360.310531] Modules linked in: gpio_keys(-)

[ 360.314797] CPU: 0 PID: 237 Comm: rmmod Not tainted 5.18.0-rc5-arm64-renesas-00116-g73636105874d-dirty #166

[ 360.324662] Hardware name: Renesas SMARC EVK based on r9a07g054l2 (DT)

[ 360.331270] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)

[ 360.338318] pc : __fl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References