CVE-2024-43856

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> dma: fix call order in dmam_free_coherent<br /> <br /> dmam_free_coherent() frees a DMA allocation, which makes the<br /> freed vaddr available for reuse, then calls devres_destroy()<br /> to remove and free the data structure used to track the DMA<br /> allocation. Between the two calls, it is possible for a<br /> concurrent task to make an allocation with the same vaddr<br /> and add it to the devres list.<br /> <br /> If this happens, there will be two entries in the devres list<br /> with the same vaddr and devres_destroy() can free the wrong<br /> entry, triggering the WARN_ON() in dmam_match.<br /> <br /> Fix by destroying the devres entry before freeing the DMA<br /> allocation.<br /> <br /> kokonut //net/encryption<br /> http://sponge2/b9145fe6-0f72-4325-ac2f-a84d81075b03