In the Linux kernel, the following vulnerability has been resolved:
remoteproc: core: Fix ida_free call while not allocated
In the rprocalloc() function, on error, putdevice(&rproc->dev) is called, leading to the call of the rproctyperelease() function. An error can occurs before ida_alloc is called.
In such case in rproctyperelease(), the condition (rproc->index >= 0) is true as rproc->index has been initialized to 0. idafree() is called reporting a warning: [ 4.181906] WARNING: CPU: 1 PID: 24 at lib/idr.c:525 idafree+0x100/0x164 [ 4.186378] stm32-display-dsi 5a000000.dsi: Fixed dependency cycle(s) with /soc/dsi@5a000000/panel@0 [ 4.188854] idafree called for id=0 which is not allocated. [ 4.198256] mipi-dsi 5a000000.dsi.0: Fixed dependency cycle(s) with /soc/dsi@5a000000 [ 4.203556] Modules linked in: panelorisetechotm8009a dwmipidsistm(+) gpusched dwmipidsi stm32rproc stm32crc32 stm32ipcc(+) optee(+) [ 4.224307] CPU: 1 UID: 0 PID: 24 Comm: kworker/u10:0 Not tainted 6.12.0 #442 [ 4.231481] Hardware name: STM32 (Device Tree Support) [ 4.236627] Workqueue: eventsunbound deferredprobeworkfunc [ 4.242504] Call trace: [ 4.242522] unwindbacktrace from showstack+0x10/0x14 [ 4.250218] showstack from dumpstacklvl+0x50/0x64 [ 4.255274] dumpstacklvl from _warn+0x80/0x12c [ 4.260134] _warn from warnslowpathfmt+0x114/0x188 [ 4.265199] warnslowpathfmt from idafree+0x100/0x164 [ 4.270565] idafree from rproctyperelease+0x38/0x60 [ 4.275832] rproctyperelease from devicerelease+0x30/0xa0 [ 4.281601] devicerelease from kobjectput+0xc4/0x294 [ 4.286762] kobjectput from rprocalloc.part.0+0x208/0x28c [ 4.292430] rprocalloc.part.0 from devmrprocalloc+0x80/0xc4 [ 4.298393] devmrprocalloc from stm32rprocprobe+0xd0/0x844 [stm32rproc] [ 4.305575] stm32rprocprobe [stm32rproc] from platformprobe+0x5c/0xbc
Calling idaalloc earlier in rprocalloc ensures that the rproc->index is properly set.
[
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/remoteproc/remoteproc_core.c",
"function": "rproc_alloc"
},
"digest": {
"length": 1442.0,
"function_hash": "97939712738562187494743553562807318813"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7378aeb664e5ebc396950b36a1f2dedf5aabec20",
"signature_version": "v1",
"id": "CVE-2024-58056-00fa7220"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/remoteproc/remoteproc_core.c",
"function": "rproc_alloc"
},
"digest": {
"length": 1442.0,
"function_hash": "97939712738562187494743553562807318813"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cf54928e7e32362215c69b68a6a53d110323bf3",
"signature_version": "v1",
"id": "CVE-2024-58056-124f60fd"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/remoteproc/remoteproc_core.c"
},
"digest": {
"line_hashes": [
"190991839416730275990996177489084070157",
"83260972633706949606446763377067078844",
"99378532420555730473073301364493085948",
"280259007711941352357028517613166294920",
"66117386663059363179150904176082506525",
"42554813232649314175474243368576916677",
"14303492610700460108993598646935366834",
"76068050058995614013224310196980196051",
"324440108486682872649909357800192976704",
"275578635917874473598629566703006465018",
"289702150916595732839759796896895513351"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9efd9fa4679803fe23188d7b47119cf7bc2de6f",
"signature_version": "v1",
"id": "CVE-2024-58056-13a80e80"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/remoteproc/remoteproc_core.c",
"function": "rproc_alloc"
},
"digest": {
"length": 1442.0,
"function_hash": "97939712738562187494743553562807318813"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9efd9fa4679803fe23188d7b47119cf7bc2de6f",
"signature_version": "v1",
"id": "CVE-2024-58056-3e21d2f6"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/remoteproc/remoteproc_core.c"
},
"digest": {
"line_hashes": [
"190991839416730275990996177489084070157",
"83260972633706949606446763377067078844",
"99378532420555730473073301364493085948",
"280259007711941352357028517613166294920",
"66117386663059363179150904176082506525",
"42554813232649314175474243368576916677",
"14303492610700460108993598646935366834",
"76068050058995614013224310196980196051",
"324440108486682872649909357800192976704",
"275578635917874473598629566703006465018",
"289702150916595732839759796896895513351"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7378aeb664e5ebc396950b36a1f2dedf5aabec20",
"signature_version": "v1",
"id": "CVE-2024-58056-66e38198"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/remoteproc/remoteproc_core.c"
},
"digest": {
"line_hashes": [
"190991839416730275990996177489084070157",
"83260972633706949606446763377067078844",
"99378532420555730473073301364493085948",
"280259007711941352357028517613166294920",
"66117386663059363179150904176082506525",
"42554813232649314175474243368576916677",
"14303492610700460108993598646935366834",
"76068050058995614013224310196980196051",
"324440108486682872649909357800192976704",
"275578635917874473598629566703006465018",
"289702150916595732839759796896895513351"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2cf54928e7e32362215c69b68a6a53d110323bf3",
"signature_version": "v1",
"id": "CVE-2024-58056-c19d9339"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "drivers/remoteproc/remoteproc_core.c"
},
"digest": {
"line_hashes": [
"190991839416730275990996177489084070157",
"83260972633706949606446763377067078844",
"99378532420555730473073301364493085948",
"280259007711941352357028517613166294920",
"66117386663059363179150904176082506525",
"42554813232649314175474243368576916677",
"14303492610700460108993598646935366834",
"76068050058995614013224310196980196051",
"324440108486682872649909357800192976704",
"275578635917874473598629566703006465018",
"289702150916595732839759796896895513351"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b32d60a852bb3952886625d0c3b1c9a88c3ceb7c",
"signature_version": "v1",
"id": "CVE-2024-58056-eae48187"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "drivers/remoteproc/remoteproc_core.c",
"function": "rproc_alloc"
},
"digest": {
"length": 1442.0,
"function_hash": "97939712738562187494743553562807318813"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b32d60a852bb3952886625d0c3b1c9a88c3ceb7c",
"signature_version": "v1",
"id": "CVE-2024-58056-edabaaab"
}
]