In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
platform\/x86\/amd\/pmc: Fix LPS0 and debugfs leaks when STB init fails<\/p>\n
amd_pmc_probe() registers the LPS0 s2idle handler with
\nacpi_register_lps0_dev() and creates the driver’s debugfs directory before
\ncalling amd_stb_s2d_init(), which is the last step in probe that can fail.<\/p>\n
When amd_stb_s2d_init() fails (for example the S2D telemetry region cannot
\nbe ioremapped on a long-running system, or the SMU rejects the S2D setup)
\nthe error path only calls pci_dev_put() and returns. This leaves
\namd_pmc_s2idle_dev_ops on the global lps0_s2idle_devops_head list and leaks
\nthe debugfs directory, while the devm-managed resources backing the handler
\nare torn down.<\/p>\n
Reloading the module then walks the corrupted list in
\nacpi_register_lps0_dev() and hits:<\/p>\n
list_add corruption. next->prev should be prev, but was NULL.
\n kernel BUG at lib\/list_debug.c:29!
\n acpi_register_lps0_dev+0x44\/0x80
\n amd_pmc_probe+0x224\/0x380 [amd_pmc]
\n platform_probe+0x67\/0x90<\/p>\n
Even without a reload, the stale registration means the next s2idle
\ntransition calls into torn-down driver state.<\/p>\n
Unwind the debugfs directory and the LPS0 registration on the
\namd_stb_s2d_init() error path. acpi_unregister_lps0_dev() is safe to call
\nunconditionally here: it is guarded on the same conditions as
\nacpi_register_lps0_dev(), which is exactly what amd_pmc_remove() already
\nrelies on.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
platform\/x86\/amd\/pmc: Fix LPS0 and debugfs leaks when STB init fails<\/p>\n
amd_pmc_probe() registers the LPS0 s2idle handler with
\nacpi_r<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21348","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}