CVE-2024-58056
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-58056
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-58056.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-58056
- Downstream
- Related
- Published
- 2025-03-06T15:53:59Z
- Modified
- 2025-10-17T21:37:42.557219Z
- Summary
- remoteproc: core: Fix ida_free call while not allocated
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: core: Fix ida_free call while not allocated
In the rprocalloc() function, on error, putdevice(&rproc->dev) is called, leading to the call of the rproctyperelease() function. An error can occurs before ida_alloc is called.
In such case in rproctyperelease(), the condition (rproc->index >= 0) is true as rproc->index has been initialized to 0. idafree() is called reporting a warning: [ 4.181906] WARNING: CPU: 1 PID: 24 at lib/idr.c:525 idafree+0x100/0x164 [ 4.186378] stm32-display-dsi 5a000000.dsi: Fixed dependency cycle(s) with /soc/dsi@5a000000/panel@0 [ 4.188854] idafree called for id=0 which is not allocated. [ 4.198256] mipi-dsi 5a000000.dsi.0: Fixed dependency cycle(s) with /soc/dsi@5a000000 [ 4.203556] Modules linked in: panelorisetechotm8009a dwmipidsistm(+) gpusched dwmipidsi stm32rproc stm32crc32 stm32ipcc(+) optee(+) [ 4.224307] CPU: 1 UID: 0 PID: 24 Comm: kworker/u10:0 Not tainted 6.12.0 #442 [ 4.231481] Hardware name: STM32 (Device Tree Support) [ 4.236627] Workqueue: eventsunbound deferredprobeworkfunc [ 4.242504] Call trace: [ 4.242522] unwindbacktrace from showstack+0x10/0x14 [ 4.250218] showstack from dumpstacklvl+0x50/0x64 [ 4.255274] dumpstacklvl from _warn+0x80/0x12c [ 4.260134] _warn from warnslowpathfmt+0x114/0x188 [ 4.265199] warnslowpathfmt from idafree+0x100/0x164 [ 4.270565] idafree from rproctyperelease+0x38/0x60 [ 4.275832] rproctyperelease from devicerelease+0x30/0xa0 [ 4.281601] devicerelease from kobjectput+0xc4/0x294 [ 4.286762] kobjectput from rprocalloc.part.0+0x208/0x28c [ 4.292430] rprocalloc.part.0 from devmrprocalloc+0x80/0xc4 [ 4.298393] devmrprocalloc from stm32rprocprobe+0xd0/0x844 [stm32rproc] [ 4.305575] stm32rprocprobe [stm32rproc] from platformprobe+0x5c/0xbc
Calling idaalloc earlier in rprocalloc ensures that the rproc->index is properly set.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/2cf54928e7e32362215c69b68a6a53d110323bf3
- https://git.kernel.org/stable/c/7378aeb664e5ebc396950b36a1f2dedf5aabec20
- https://git.kernel.org/stable/c/b32d60a852bb3952886625d0c3b1c9a88c3ceb7c
- https://git.kernel.org/stable/c/e9efd9fa4679803fe23188d7b47119cf7bc2de6f
- https://git.kernel.org/stable/c/f2013d19b7704cd723ab42664b8d9408ea8cc77c
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced08333b911f01862e71e51b7065fb4baca3cd2e67Fixed2cf54928e7e32362215c69b68a6a53d110323bf3
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced08333b911f01862e71e51b7065fb4baca3cd2e67Fixedb32d60a852bb3952886625d0c3b1c9a88c3ceb7c
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced08333b911f01862e71e51b7065fb4baca3cd2e67Fixedf2013d19b7704cd723ab42664b8d9408ea8cc77c
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced08333b911f01862e71e51b7065fb4baca3cd2e67Fixede9efd9fa4679803fe23188d7b47119cf7bc2de6f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced08333b911f01862e71e51b7065fb4baca3cd2e67Fixed7378aeb664e5ebc396950b36a1f2dedf5aabec20