CVE-2023-54026

Description

In the Linux kernel, the following vulnerability has been resolved:opp: Fix use-after-free in lazy_opp_tables after probe deferralWhen dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns-EPROBE_DEFER, the opp_table is freed again, to wait until all theinterconnect paths are available.However, if the OPP table is using required-opps then it may alreadyhave been added to the global lazy_opp_tables list. The error pathdoes not remove the opp_table from the list again.This can cause crashes later when the provider of the required-oppsis added, since we will iterate over OPP tables that have already beenfreed. E.g.: Unable to handle kernel null pointer dereference when read CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3 PC is at _of_add_opp_table_v2 (include/linux/of.h:949 drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404 drivers/opp/of.c:1032) -> lazy_link_required_opp_table()Fix this by calling _of_clear_opp_table() to remove the opp_table fromthe list and clear other allocated resources. While at it, also add themissing mutex_destroy() calls in the error path.

Risk Information

Associated Vulnerability

Patch Details

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234