In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
OPP: Fix race between OPP addition and lookup<\/p>\n
A race exists between dev_pm_opp_add_dynamic() and
\ndev_pm_opp_find_freq_exact():<\/p>\n
CPU0 (add) CPU1 (lookup)
\n ——————————- ——————————
\n _opp_add()
\n mutex_lock()
\n list_add(&new_opp->node, head)
\n mutex_unlock() _opp_table_find_key()
\n mutex_lock()
\n dev_pm_opp_get(opp)
\n kref_get()
\n mutex_unlock()
\n kref_init(&new_opp->kref)
\n dev_pm_opp_put()
\n kref_put_mutex()<\/p>\n
The newly added OPP is inserted into the list before its kref is
\ninitialized. A concurrent lookup can find this OPP and increment its
\nreference count while it is still uninitialized, leading to refcount
\ncorruption and a potential premature free.<\/p>\n
Fix this by initializing ->kref and ->opp_table before making the OPP
\nvisible via list_add(). This ensures any concurrent lookup observes a
\nfully initialized object.<\/p>\n
[ Viresh: Updated commit log ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
OPP: Fix race between OPP addition and lookup<\/p>\n
A race exists between dev_pm_opp_add_dynamic() and
\ndev_pm_opp_find_freq_exact():<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-8640","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/8640","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8640"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8640"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8640"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}