In the Linux kernel, the following vulnerability has been resolved:
clk: mmp2: call pmgenpdinit() only after genpd.name is set
Setting the genpd's struct device's name with devsetname() is happening within pmgenpdinit(). If it remains NULL, things can blow up later, such as when crafting the devfs hierarchy for the power domain:
Unable to handle kernel NULL pointer dereference at virtual address 00000000 when read ... Call trace: strlen from startcreating+0x90/0x138 startcreating from debugfscreatedir+0x20/0x178 debugfscreatedir from genpddebugadd.part.0+0x4c/0x144 genpddebugadd.part.0 from genpddebuginit+0x74/0x90 genpddebuginit from dooneinitcall+0x5c/0x244 dooneinitcall from kernelinitfreeable+0x19c/0x1f4 kernelinitfreeable from kernelinit+0x1c/0x12c kernelinit from retfromfork+0x14/0x28
Bisecting tracks this crash back to commit 899f44531fe6 ("pmdomain: core: Add GENPDFLAGDEVNAMEFW flag"), which exchanges use of genpd->name with devname(&genpd->dev) in genpddebug_add.part().