CVE-2024-35879
Assigner: Linux
Published: 2024-05-19T08:34:36.450Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

of: dynamic: Synchronize of_changeset_destroy() with the devlink removals

In the following sequence:
  1) of_platform_depopulate()
  2) of_overlay_remove()

During the step 1, devices are destroyed and devlinks are removed.
During the step 2, OF nodes are destroyed but
__of_changeset_entry_destroy() can raise warnings related to missing
of_node_put():
  ERROR: memory leak, expected refcount 1 instead of 2 ...

Indeed, during the devlink removals performed at step 1, the removal
itself releasing the device (and the attached of_node) is done by a job
queued in a workqueue and so, it is done asynchronously with respect to
function calls.
When the warning is present, of_node_put() will be called but wrongly
too late from the workqueue job.

In order to be sure that any ongoing devlink removals are done before
the of_node destruction, synchronize the of_changeset_destroy() with the
devlink removals.
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: d007150b4e15
lessThan: 3127b2ee50c4
status: affected
versionType: git
version: 80dd33cf72d1
lessThan: 3ee242410754
status: affected
versionType: git
version: 80dd33cf72d1
lessThan: 7b6df050c45a
status: affected
versionType: git
version: 80dd33cf72d1
lessThan: 801c8b8ec5bf
status: affected
versionType: git
version: 80dd33cf72d1
lessThan: ae6d76e4f06c
status: affected
versionType: git
version: 80dd33cf72d1
lessThan: 8917e7385346
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 5.13
status: affected
version: 0
lessThan: 5.13
status: unaffected
versionType: custom
version: 5.10.215
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.15.154
lessThanOrEqual: 5.15.*
status: unaffected
versionType: custom
version: 6.1.85
lessThanOrEqual: 6.1.*
status: unaffected
versionType: custom
version: 6.6.26
lessThanOrEqual: 6.6.*
status: unaffected
versionType: custom
version: 6.8.5
lessThanOrEqual: 6.8.*
status: unaffected
versionType: custom
version: 6.9
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
x_generator: engine: bippy-d175d3acf727