In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root<\/p>\n
acpi_pci_root_add() assigns the freshly allocated root to
\ndevice->driver_data before dmar_device_add() and pci_acpi_scan_root().
\nBoth failure paths reach the end: label where root is kfree()’d, but
\nonly the pci_acpi_scan_root() path clears driver_data first.<\/p>\n
When dmar_device_add() fails during a hot-add, root is freed while
\ndevice->driver_data still points at it. The ACPI core does not clear
\ndriver_data on attach failure, so a later acpi_pci_find_root() call may
\ndereference this dangling pointer.<\/p>\n
acpi_pci_root_remove() has the same problem: it frees root without
\nclearing device->driver_data, leaving a dangling pointer behind after
\nthe root bridge is removed.<\/p>\n
Move the NULL assignment to the shared end: label so every error path in
\nacpi_pci_root_add() clears driver_data before freeing root, and clear it
\nin acpi_pci_root_remove() as well, so the object is never left reachable
\nthrough driver_data after being freed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root<\/p>\n
acpi_pci_root_add() assigns the freshly allocated root to
\nde<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25890","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25890","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}