In the Linux kernel, the following vulnerability has been resolved:
of: dynamic: Synchronize ofchangesetdestroy() with the devlink removals
In the following sequence: 1) ofplatformdepopulate() 2) ofoverlayremove()
During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF nodes are destroyed but _ofchangesetentrydestroy() can raise warnings related to missing ofnodeput(): ERROR: memory leak, expected refcount 1 instead of 2 ...
Indeed, during the devlink removals performed at step 1, the removal itself releasing the device (and the attached ofnode) is done by a job queued in a workqueue and so, it is done asynchronously with respect to function calls. When the warning is present, ofnode_put() will be called but wrongly too late from the workqueue job.
In order to be sure that any ongoing devlink removals are done before the ofnode destruction, synchronize the ofchangeset_destroy() with the devlink removals.
[
{
"target": {
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-01ef9b87",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@801c8b8ec5bfb3519566dff16a5ecd48302fca82",
"digest": {
"line_hashes": [
"35929487171507878257496370709355944385",
"255306333764605957177255934547012323627",
"278233044460836661240508676111095672187",
"181464129244487076882235480485779661549"
],
"threshold": 0.9
}
},
{
"target": {
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-250c7db5",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ee2424107546d882e1ddd75333ca9c32879908c",
"digest": {
"line_hashes": [
"35929487171507878257496370709355944385",
"255306333764605957177255934547012323627",
"278233044460836661240508676111095672187",
"181464129244487076882235480485779661549"
],
"threshold": 0.9
}
},
{
"target": {
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-2571a004",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae6d76e4f06c37a623e357e79d49b17411db6f5c",
"digest": {
"line_hashes": [
"35929487171507878257496370709355944385",
"255306333764605957177255934547012323627",
"278233044460836661240508676111095672187",
"181464129244487076882235480485779661549"
],
"threshold": 0.9
}
},
{
"target": {
"function": "of_changeset_destroy",
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-834cb0b2",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3127b2ee50c424a96eb3559fbb7b43cf0b111c7a",
"digest": {
"function_hash": "102593482343252789574197978852758705928",
"length": 152.0
}
},
{
"target": {
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-84d28584",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3127b2ee50c424a96eb3559fbb7b43cf0b111c7a",
"digest": {
"line_hashes": [
"35929487171507878257496370709355944385",
"255306333764605957177255934547012323627",
"278233044460836661240508676111095672187",
"181464129244487076882235480485779661549"
],
"threshold": 0.9
}
},
{
"target": {
"function": "of_changeset_destroy",
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-9c86840b",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8917e7385346bd6584890ed362985c219fe6ae84",
"digest": {
"function_hash": "102593482343252789574197978852758705928",
"length": 152.0
}
},
{
"target": {
"function": "of_changeset_destroy",
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-b7721c10",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b6df050c45a1ea158fd50bc32a8e1447dd1e951",
"digest": {
"function_hash": "102593482343252789574197978852758705928",
"length": 152.0
}
},
{
"target": {
"function": "of_changeset_destroy",
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-bf5df203",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3ee2424107546d882e1ddd75333ca9c32879908c",
"digest": {
"function_hash": "102593482343252789574197978852758705928",
"length": 152.0
}
},
{
"target": {
"function": "of_changeset_destroy",
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-d6fecfc2",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae6d76e4f06c37a623e357e79d49b17411db6f5c",
"digest": {
"function_hash": "102593482343252789574197978852758705928",
"length": 152.0
}
},
{
"target": {
"function": "of_changeset_destroy",
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-e2152138",
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@801c8b8ec5bfb3519566dff16a5ecd48302fca82",
"digest": {
"function_hash": "102593482343252789574197978852758705928",
"length": 152.0
}
},
{
"target": {
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-fbc7f6f3",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b6df050c45a1ea158fd50bc32a8e1447dd1e951",
"digest": {
"line_hashes": [
"35929487171507878257496370709355944385",
"255306333764605957177255934547012323627",
"278233044460836661240508676111095672187",
"181464129244487076882235480485779661549"
],
"threshold": 0.9
}
},
{
"target": {
"file": "drivers/of/dynamic.c"
},
"id": "CVE-2024-35879-fc66f315",
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8917e7385346bd6584890ed362985c219fe6ae84",
"digest": {
"line_hashes": [
"35929487171507878257496370709355944385",
"255306333764605957177255934547012323627",
"278233044460836661240508676111095672187",
"181464129244487076882235480485779661549"
],
"threshold": 0.9
}
}
]