CVE-2023-52613 in Linux
要約
〜によって VulDB • 2026年06月11日
Based on the kernel log snippet provided, here is an analysis of the crash and the likely cause.
### **Summary** The kernel has **panicked** (or crashed) during the initialization of the **Loongson 2 thermal driver** (`loongson2_thermal`). The crash occurred in the `strscpy` function, which is called by `thermal_add_hwmon_sysfs`. This typically indicates a **buffer overflow**, **invalid memory access**, or **corrupted data** being passed to the string copy function.
---
### **Detailed Analysis**
#### **1. Crash Location** - **Function:** `strscpy+0xf0/0x160` - `strscpy` is a safe string copy function in the Linux kernel. It copies a string from source to destination, ensuring null-termination and preventing buffer overflows. - The crash at offset `0xf0` suggests it failed during the copy operation, likely due to: - An invalid source pointer (e.g., `NULL` or unmapped memory). - A destination buffer that is too small or invalid. - A source string that is not null-terminated and extends into invalid memory.
#### **2. Call Trace** The call stack shows the sequence of events leading to the crash: 1. `loongson2_thermal_probe+0x128/0x200 [loongson2_thermal]`
- The thermal driver's probe function is running. This is where the driver initializes hardware and registers sysfs entries. 2. `devm_thermal_add_hwmon_sysfs+0x50/0xe0` - The driver is attempting to register a hardware monitoring (hwmon) sysfs interface. 3. `thermal_add_hwmon_sysfs+0x258/0x300` - This function prepares the sysfs name and calls `strscpy` to copy the name into a buffer. 4. `strscpy+0xf0/0x160` - **Crash occurs here.**
#### **3. Likely Cause** The most probable cause is that **`thermal_add_hwmon_sysfs` is receiving an invalid or malformed string** for the hwmon name. This could be due to: - **Missing or incorrect device tree (DT) properties:** The Loongson 2 thermal driver may be reading a name from the device tree that is empty, null, or points to invalid memory. - **Driver bug:** The `loongson2_thermal` driver might be passing an uninitialized or corrupted buffer to `thermal_add_hwmon_sysfs`. - **Kernel version mismatch:** If this is a custom or older kernel, there might be a regression in how the thermal subsystem handles hwmon names.
---
### **How to Debug/Fix**
#### **1. Check Device Tree (DT)** - Inspect the device tree source (`.dts`) for the Loongson 2 thermal node. - Look for properties like `hwmon-name`, `label`, or similar. Ensure they are valid strings. - Example: ```dts thermal-zones {
cpu-thermal {
polling-delay = <1000>; polling-delay-passive = <250>; thermal-sensors = <&thermal_sensor 0>; // Check if there's an invalid or missing name property }; }; ```
#### **2. Add Debug Prints** - Modify the `loongson2_thermal_probe` function to print the values being passed to `thermal_add_hwmon_sysfs`. - Specifically, check the string that is being copied by `strscpy`.
#### **3. Check Kernel Version** - This issue might have been fixed in newer kernel versions. Check if there are patches related to `loongson2_thermal` or `thermal_add_hwmon_sysfs`. - Search for commits related to: - `thermal: fix strscpy crash in thermal_add_hwmon_sysfs` - `loongson2_thermal: fix hwmon name handling`
#### **4. Workaround** - If the hwmon interface is not critical, you can try disabling it in the driver or device tree to avoid the crash. - In the driver, check if the name is valid before calling `thermal_add_hwmon_sysfs`.
---
### **Conclusion** The crash is caused by an invalid string being passed to `strscpy` during the registration of the hwmon sysfs interface in the Loongson 2 thermal driver. The fix likely involves correcting the device tree configuration or patching the driver to handle invalid/missing names gracefully.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.