CVE-2023-54026

In the Linux kernel, the following vulnerability has been resolved:

opp: Fix use-after-free in lazyopptables after probe deferral

When devpmoppoffindiccpaths() in allocateopptable() returns -EPROBEDEFER, the opp_table is freed again, to wait until all the interconnect paths are available.

However, if the OPP table is using required-opps then it may already have been added to the global lazyopptables list. The error path does not remove the opp_table from the list again.

This can cause crashes later when the provider of the required-opps is added, since we will iterate over OPP tables that have already been freed. E.g.:

Unable to handle kernel NULL pointer dereference when read CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3 PC is at ofaddopptablev2 (include/linux/of.h:949 drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404 drivers/opp/of.c:1032) -> lazylinkrequiredopp_table()

Fix this by calling ofclearopptable() to remove the opptable from the list and clear other allocated resources. While at it, also add the missing mutexdestroy() calls in the error path.