CVE-2023-54026

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> opp: Fix use-after-free in lazy_opp_tables after probe deferral<br /> <br /> When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns<br /> -EPROBE_DEFER, the opp_table is freed again, to wait until all the<br /> interconnect paths are available.<br /> <br /> However, if the OPP table is using required-opps then it may already<br /> have been added to the global lazy_opp_tables list. The error path<br /> does not remove the opp_table from the list again.<br /> <br /> This can cause crashes later when the provider of the required-opps<br /> is added, since we will iterate over OPP tables that have already been<br /> freed. E.g.:<br /> <br /> Unable to handle kernel NULL pointer dereference when read<br /> CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3<br /> PC is at _of_add_opp_table_v2 (include/linux/of.h:949<br /> drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404<br /> drivers/opp/of.c:1032) -&gt; lazy_link_required_opp_table()<br /> <br /> Fix this by calling _of_clear_opp_table() to remove the opp_table from<br /> the list and clear other allocated resources. While at it, also add the<br /> missing mutex_destroy() calls in the error path.