In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
i3c: master: Fix device_register() error path<\/p>\n
When device_register() fails in i3c_master_register_new_i3c_devs(),
\nput_device() is called to drop the reference taken by
\ndevice_register(). That drops the last reference, so the device’s
\nrelease callback i3c_device_release() runs and frees the i3c_device.<\/p>\n
Two problems follow from that:<\/p>\n
i3c_device_release() does WARN_ON(i3cdev->desc), so it warns because
\ndesc->dev->desc still points back at the descriptor. Clear it before
\ncalling put_device().<\/p>\n
After put_device() frees the i3c_device, desc->dev is left pointing at
\nfreed memory, so clear desc->dev as well. That prevents, for example,
\ni3c_master_unregister_i3c_devs() seeing desc->dev as non-NULL and
\ndereferencing it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
i3c: master: Fix device_register() error path<\/p>\n
When device_register() fails in i3c_master_register_new_i3c_devs(),
\nput_device() is <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28547","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28547","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}