In the Linux kernel, the following vulnerability has been resolved:
dma: fix call order in dmamfreecoherent
dmamfreecoherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data structure used to track the DMA allocation. Between the two calls, it is possible for a concurrent task to make an allocation with the same vaddr and add it to the devres list.
If this happens, there will be two entries in the devres list with the same vaddr and devresdestroy() can free the wrong entry, triggering the WARNON() in dmam_match.
Fix by destroying the devres entry before freeing the DMA allocation.
kokonut //net/encryption http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "293314320991032920697982371725865508859",
                "290553730322639931428276061422198880913",
                "204537864763456491529638521668932989024",
                "127848476138478991051918848924689822212",
                "108987341820820475221247387754621884324"
            ]
        },
        "target": {
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-1233ad38",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fe97f68fce1ba24bf823bfb0eb0956003473130",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "69978607725197492933017218337523553027",
            "length": 235.0
        },
        "target": {
            "function": "dmam_free_coherent",
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-129b7fa6",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28e8b7406d3a1f5329a03aa25a43aa28e087cb20",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "69978607725197492933017218337523553027",
            "length": 235.0
        },
        "target": {
            "function": "dmam_free_coherent",
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-2165a25f",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f993a4baf6b622232e4c190d34c220179e5d61eb",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "69978607725197492933017218337523553027",
            "length": 235.0
        },
        "target": {
            "function": "dmam_free_coherent",
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-383da8ba",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe2d246080f035e0af5793cb79067ba125e4fb63",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "293314320991032920697982371725865508859",
                "290553730322639931428276061422198880913",
                "204537864763456491529638521668932989024",
                "127848476138478991051918848924689822212",
                "108987341820820475221247387754621884324"
            ]
        },
        "target": {
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-4cf6ad09",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22094f5f52e7bc16c5bf9613365049383650b02e",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "69978607725197492933017218337523553027",
            "length": 235.0
        },
        "target": {
            "function": "dmam_free_coherent",
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-4e4239e4",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22094f5f52e7bc16c5bf9613365049383650b02e",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "69978607725197492933017218337523553027",
            "length": 235.0
        },
        "target": {
            "function": "dmam_free_coherent",
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-62bf9544",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87b34c8c94e29fa01d744e5147697f592998d954",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "69978607725197492933017218337523553027",
            "length": 235.0
        },
        "target": {
            "function": "dmam_free_coherent",
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-7832803d",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1fe97f68fce1ba24bf823bfb0eb0956003473130",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "293314320991032920697982371725865508859",
                "290553730322639931428276061422198880913",
                "204537864763456491529638521668932989024",
                "127848476138478991051918848924689822212",
                "108987341820820475221247387754621884324"
            ]
        },
        "target": {
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-aa8aff29",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28e8b7406d3a1f5329a03aa25a43aa28e087cb20",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "293314320991032920697982371725865508859",
                "290553730322639931428276061422198880913",
                "204537864763456491529638521668932989024",
                "127848476138478991051918848924689822212",
                "108987341820820475221247387754621884324"
            ]
        },
        "target": {
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-d6b39bff",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe2d246080f035e0af5793cb79067ba125e4fb63",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "function_hash": "69978607725197492933017218337523553027",
            "length": 235.0
        },
        "target": {
            "function": "dmam_free_coherent",
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-da697d0b",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f7bbdc744f2e7051d1cb47c8e082162df1923c9",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "293314320991032920697982371725865508859",
                "290553730322639931428276061422198880913",
                "204537864763456491529638521668932989024",
                "127848476138478991051918848924689822212",
                "108987341820820475221247387754621884324"
            ]
        },
        "target": {
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-eb34e29a",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87b34c8c94e29fa01d744e5147697f592998d954",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "293314320991032920697982371725865508859",
                "290553730322639931428276061422198880913",
                "204537864763456491529638521668932989024",
                "127848476138478991051918848924689822212",
                "108987341820820475221247387754621884324"
            ]
        },
        "target": {
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-ebb514eb",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f7bbdc744f2e7051d1cb47c8e082162df1923c9",
        "signature_type": "Line"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "293314320991032920697982371725865508859",
                "290553730322639931428276061422198880913",
                "204537864763456491529638521668932989024",
                "127848476138478991051918848924689822212",
                "108987341820820475221247387754621884324"
            ]
        },
        "target": {
            "file": "kernel/dma/mapping.c"
        },
        "id": "CVE-2024-43856-f8edbf4d",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f993a4baf6b622232e4c190d34c220179e5d61eb",
        "signature_type": "Line"
    }
]