In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rtc: ac100: Fix clock provider use-after-free on probe failure<\/p>\n
ac100_rtc_register_clks() registers the RTC-32k clock with
\nclk_hw_register_fixed_rate() and the clock provider with
\nof_clk_add_hw_provider(). Neither is device managed, and both are
\nreleased only from ac100_rtc_remove(). The driver core does not call
\nremove() when probe() fails: really_probe() reaches probe_failed below
\nthe device_remove() call and goes straight to releasing the device’s
\nmanaged resources.<\/p>\n
ac100_rtc_probe() ends with<\/p>\n
\treturn devm_rtc_register_device(chip->rtc);<\/p>\n
so if that fails after the clocks have been registered, the provider is
\nleft on the global of_clk_providers list holding chip->clk_data, which
\nwas allocated with devm_kzalloc() and is freed while probe() unwinds. A
\nlater lookup on this device tree node then reads freed memory in
\nof_clk_hw_onecell_get(). Consumers that do exactly that exist in tree:
\nthe wifi power sequence nodes on sun8i-a83t-bananapi-m3 and
\nsun8i-a83t-cubietruck-plus take , and the sun9i-a80 boards
\nroute osc32k through . The window is narrow, as
\ndevm_rtc_register_device() can only fail with -ENOMEM here, but the
\nprovider is left dangling whenever it does.<\/p>\n
The RTC-32k clock is leaked on the same path. Since clk_core_lookup()
\nsearches a global list that is not scoped per device, __clk_register()
\nrejects the duplicate name with -EEXIST, so the leak also makes a later
\nprobe of the same device fail.<\/p>\n
The error path that returns -EINVAL when the ADDA 4M parent clock cannot
\nbe found leaks the RTC-32k clock in the same way. No provider has been
\nregistered at that point, so that one is a leak rather than a
\nuse-after-free.<\/p>\n
Register both with devm_clk_hw_register_fixed_rate() and
\ndevm_of_clk_add_hw_provider() so that they are released whenever the
\ndevice goes away, on a failed probe as well as on unbind. Devres
\nreleases in reverse order of acquisition, so the provider is removed
\nbefore chip->clk_data is freed, and the clkout children are now
\nunregistered before their parent rather than after it.
\nac100_rtc_unregister_clks() and the remove callback then have nothing
\nleft to do and are removed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rtc: ac100: Fix clock provider use-after-free on probe failure<\/p>\n
ac100_rtc_register_clks() registers the RTC-32k clock with
\nclk_hw_r<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41298","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41298","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41298"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41298"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41298"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}