In the Linux kernel, the following vulnerability has been resolved:
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
A PCI device hot removal may occur while stdev->cdev is held open. The call to stdevrelease() then happens during close or exit, at a point way past switchtecpciremove(). Otherwise the last ref would vanish with the trailing putdevice(), just before return.
At that later point in time, the devm cleanup has already removed the stdev->mmiomrpc mapping. Also, the stdev->pdev reference was not a counted one. Therefore, in DMA mode, the iowrite32() in stdevrelease() will cause a fatal page fault, and the subsequent dmafreecoherent(), if reached, would pass a stale &stdev->pdev->dev pointer.
Fix by moving MRPC DMA shutdown into switchtecpciremove(), after stdev_kill(). Counting the stdev->pdev ref is now optional, but may prevent future accidents.
Reproducible via the script at https://lore.kernel.org/r/20231113212150.96410-1-dns@arista.com
[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8c293549946ee5078ed0ab77793cec365559355",
        "target": {
            "function": "stdev_release",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-178da23c",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 355.0,
            "function_hash": "110998826186471696627643621735550562184"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a5d0528cf19dbf060313dffbe047bc11c90c24c",
        "target": {
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-1d94855b",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "76568077293536928251263387727570604374",
                "5249218589935536933750265607204149921",
                "130104282996839860813107438965670899274",
                "175476673829494595165118783467897305850",
                "335910186963356402377315925260549824839",
                "5679066464076109729029535223760888686",
                "84095708887641616568991997721387509704",
                "119584231835487084753310871838398779188",
                "318777874208103608606511743712057151782",
                "65444308328409026140512903930094511945",
                "278657848002487287029151175658077465179",
                "207151188205283749693458908771940547150",
                "120117507430998728018459521879657344315",
                "290276625441283421274684554820166836090",
                "269412699303782720561143298561501283712",
                "150408257788216622217213657655923676715",
                "204532995104573566089020819689490136886",
                "268419473899720708562328687199565742915",
                "60897117315773415388666597129171362655",
                "114886309097386661041113695244241628314",
                "299230552727788334927226133530222746861",
                "304638562440692254468448026940277588409",
                "319241579192563312028246819167746494732",
                "89450555842076454873903418304716044602",
                "333394659869149684550520476574873626217"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a5d0528cf19dbf060313dffbe047bc11c90c24c",
        "target": {
            "function": "stdev_release",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-1f1ce995",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 355.0,
            "function_hash": "110998826186471696627643621735550562184"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d83c85922647758c1f1e4806a4c5c3cf591a20a",
        "target": {
            "function": "stdev_create",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-236c2c8a",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 1164.0,
            "function_hash": "116041555433460733386272408621373733346"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e129c7fa7070fbce57feb0bfc5eaa65eef44b693",
        "target": {
            "function": "stdev_release",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-236e1dbd",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 355.0,
            "function_hash": "110998826186471696627643621735550562184"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d83c85922647758c1f1e4806a4c5c3cf591a20a",
        "target": {
            "function": "stdev_release",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-2943ff90",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 355.0,
            "function_hash": "110998826186471696627643621735550562184"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df25461119d987b8c81d232cfe4411e91dcabe66",
        "target": {
            "function": "switchtec_pci_remove",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-299d9c0f",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 315.0,
            "function_hash": "110802628666932201378315187064408695218"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df25461119d987b8c81d232cfe4411e91dcabe66",
        "target": {
            "function": "stdev_create",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-29f3a06d",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 1164.0,
            "function_hash": "116041555433460733386272408621373733346"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df25461119d987b8c81d232cfe4411e91dcabe66",
        "target": {
            "function": "stdev_release",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-4f153d3a",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 355.0,
            "function_hash": "110998826186471696627643621735550562184"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8c293549946ee5078ed0ab77793cec365559355",
        "target": {
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-635d8b05",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "76568077293536928251263387727570604374",
                "5249218589935536933750265607204149921",
                "130104282996839860813107438965670899274",
                "175476673829494595165118783467897305850",
                "335910186963356402377315925260549824839",
                "5679066464076109729029535223760888686",
                "84095708887641616568991997721387509704",
                "119584231835487084753310871838398779188",
                "318777874208103608606511743712057151782",
                "65444308328409026140512903930094511945",
                "278657848002487287029151175658077465179",
                "207151188205283749693458908771940547150",
                "120117507430998728018459521879657344315",
                "290276625441283421274684554820166836090",
                "269412699303782720561143298561501283712",
                "150408257788216622217213657655923676715",
                "204532995104573566089020819689490136886",
                "268419473899720708562328687199565742915",
                "60897117315773415388666597129171362655",
                "114886309097386661041113695244241628314",
                "299230552727788334927226133530222746861",
                "304638562440692254468448026940277588409",
                "319241579192563312028246819167746494732",
                "89450555842076454873903418304716044602",
                "333394659869149684550520476574873626217"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d83c85922647758c1f1e4806a4c5c3cf591a20a",
        "target": {
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-6f66a664",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "76568077293536928251263387727570604374",
                "5249218589935536933750265607204149921",
                "130104282996839860813107438965670899274",
                "175476673829494595165118783467897305850",
                "335910186963356402377315925260549824839",
                "5679066464076109729029535223760888686",
                "84095708887641616568991997721387509704",
                "119584231835487084753310871838398779188",
                "318777874208103608606511743712057151782",
                "65444308328409026140512903930094511945",
                "278657848002487287029151175658077465179",
                "207151188205283749693458908771940547150",
                "120117507430998728018459521879657344315",
                "290276625441283421274684554820166836090",
                "269412699303782720561143298561501283712",
                "150408257788216622217213657655923676715",
                "204532995104573566089020819689490136886",
                "268419473899720708562328687199565742915",
                "60897117315773415388666597129171362655",
                "114886309097386661041113695244241628314",
                "299230552727788334927226133530222746861",
                "7752000439030186737246108155584148551",
                "257959344840681508116322836658663569922",
                "89450555842076454873903418304716044602",
                "333394659869149684550520476574873626217"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df25461119d987b8c81d232cfe4411e91dcabe66",
        "target": {
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-7675d806",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "76568077293536928251263387727570604374",
                "5249218589935536933750265607204149921",
                "130104282996839860813107438965670899274",
                "175476673829494595165118783467897305850",
                "335910186963356402377315925260549824839",
                "5679066464076109729029535223760888686",
                "84095708887641616568991997721387509704",
                "119584231835487084753310871838398779188",
                "318777874208103608606511743712057151782",
                "65444308328409026140512903930094511945",
                "278657848002487287029151175658077465179",
                "207151188205283749693458908771940547150",
                "120117507430998728018459521879657344315",
                "290276625441283421274684554820166836090",
                "269412699303782720561143298561501283712",
                "150408257788216622217213657655923676715",
                "204532995104573566089020819689490136886",
                "268419473899720708562328687199565742915",
                "60897117315773415388666597129171362655",
                "114886309097386661041113695244241628314",
                "299230552727788334927226133530222746861",
                "7752000439030186737246108155584148551",
                "257959344840681508116322836658663569922",
                "89450555842076454873903418304716044602",
                "333394659869149684550520476574873626217"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0233b836312e39a3c763fb53512b3fa455b473b3",
        "target": {
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-7a43af04",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "76568077293536928251263387727570604374",
                "5249218589935536933750265607204149921",
                "130104282996839860813107438965670899274",
                "175476673829494595165118783467897305850",
                "335910186963356402377315925260549824839",
                "5679066464076109729029535223760888686",
                "84095708887641616568991997721387509704",
                "119584231835487084753310871838398779188",
                "318777874208103608606511743712057151782",
                "65444308328409026140512903930094511945",
                "278657848002487287029151175658077465179",
                "207151188205283749693458908771940547150",
                "120117507430998728018459521879657344315",
                "290276625441283421274684554820166836090",
                "269412699303782720561143298561501283712",
                "150408257788216622217213657655923676715",
                "204532995104573566089020819689490136886",
                "268419473899720708562328687199565742915",
                "60897117315773415388666597129171362655",
                "114886309097386661041113695244241628314",
                "299230552727788334927226133530222746861",
                "7752000439030186737246108155584148551",
                "257959344840681508116322836658663569922",
                "89450555842076454873903418304716044602",
                "333394659869149684550520476574873626217"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e129c7fa7070fbce57feb0bfc5eaa65eef44b693",
        "target": {
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-af640ac7",
        "signature_version": "v1",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "76568077293536928251263387727570604374",
                "5249218589935536933750265607204149921",
                "130104282996839860813107438965670899274",
                "175476673829494595165118783467897305850",
                "335910186963356402377315925260549824839",
                "5679066464076109729029535223760888686",
                "84095708887641616568991997721387509704",
                "119584231835487084753310871838398779188",
                "318777874208103608606511743712057151782",
                "65444308328409026140512903930094511945",
                "278657848002487287029151175658077465179",
                "207151188205283749693458908771940547150",
                "120117507430998728018459521879657344315",
                "290276625441283421274684554820166836090",
                "269412699303782720561143298561501283712",
                "150408257788216622217213657655923676715",
                "204532995104573566089020819689490136886",
                "268419473899720708562328687199565742915",
                "60897117315773415388666597129171362655",
                "114886309097386661041113695244241628314",
                "299230552727788334927226133530222746861",
                "7752000439030186737246108155584148551",
                "257959344840681508116322836658663569922",
                "89450555842076454873903418304716044602",
                "333394659869149684550520476574873626217"
            ]
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0233b836312e39a3c763fb53512b3fa455b473b3",
        "target": {
            "function": "switchtec_pci_remove",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-b8369f93",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 315.0,
            "function_hash": "110802628666932201378315187064408695218"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8c293549946ee5078ed0ab77793cec365559355",
        "target": {
            "function": "stdev_create",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-bff9b2ca",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 1172.0,
            "function_hash": "107871814067871803064493033648730379159"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e129c7fa7070fbce57feb0bfc5eaa65eef44b693",
        "target": {
            "function": "stdev_create",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-d201db4e",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 1164.0,
            "function_hash": "116041555433460733386272408621373733346"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d8c293549946ee5078ed0ab77793cec365559355",
        "target": {
            "function": "switchtec_pci_remove",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-dff37085",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 315.0,
            "function_hash": "110802628666932201378315187064408695218"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1d83c85922647758c1f1e4806a4c5c3cf591a20a",
        "target": {
            "function": "switchtec_pci_remove",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-ecbfb34f",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 315.0,
            "function_hash": "110802628666932201378315187064408695218"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e129c7fa7070fbce57feb0bfc5eaa65eef44b693",
        "target": {
            "function": "switchtec_pci_remove",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-eddceef0",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 315.0,
            "function_hash": "110802628666932201378315187064408695218"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a5d0528cf19dbf060313dffbe047bc11c90c24c",
        "target": {
            "function": "stdev_create",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-ef2407ba",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 1172.0,
            "function_hash": "107871814067871803064493033648730379159"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a5d0528cf19dbf060313dffbe047bc11c90c24c",
        "target": {
            "function": "switchtec_pci_remove",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-f6335a66",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 315.0,
            "function_hash": "110802628666932201378315187064408695218"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0233b836312e39a3c763fb53512b3fa455b473b3",
        "target": {
            "function": "stdev_create",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-f84598d3",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 1164.0,
            "function_hash": "116041555433460733386272408621373733346"
        }
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0233b836312e39a3c763fb53512b3fa455b473b3",
        "target": {
            "function": "stdev_release",
            "file": "drivers/pci/switch/switchtec.c"
        },
        "deprecated": false,
        "id": "CVE-2023-52617-f96c8fe2",
        "signature_version": "v1",
        "signature_type": "Function",
        "digest": {
            "length": 355.0,
            "function_hash": "110998826186471696627643621735550562184"
        }
    }
]