CVE-2022-49808

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: don't leak tagger-owned storage on switch driver unbind

In the initial commit dc452a471dba ("net: dsa: introduce tagger-owned

storage for private and shared data"), we had a call to

tag_ops->disconnect(dst) issued from dsa_tree_free(), which is called at

tree teardown time.

There were problems with connecting to a switch tree as a whole, so this

got reworked to connecting to individual switches within the tree. In

this process, tag_ops->disconnect(ds) was made to be called only from

switch.c (cross-chip notifiers emitted as a result of dynamic tag proto

changes), but the normal driver teardown code path wasn't replaced with

anything.

Solve this problem by adding a function that does the opposite of

dsa_switch_setup_tag_protocol(), which is called from the equivalent

spot in dsa_switch_teardown(). The positioning here also ensures that we

won't have any use-after-free in tagging protocol (*rcv) ops, since

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References