CVE-2021-46959

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> spi: Fix use-after-free with devm_spi_alloc_*<br /> <br /> We can&amp;#39;t rely on the contents of the devres list during<br /> spi_unregister_controller(), as the list is already torn down at the<br /> time we perform devres_find() for devm_spi_release_controller. This<br /> causes devices registered with devm_spi_alloc_{master,slave}() to be<br /> mistakenly identified as legacy, non-devm managed devices and have their<br /> reference counters decremented below 0.<br /> <br /> ------------[ cut here ]------------<br /> WARNING: CPU: 1 PID: 660 at lib/refcount.c:28 refcount_warn_saturate+0x108/0x174<br /> [] (refcount_warn_saturate) from [] (kobject_put+0x90/0x98)<br /> [] (kobject_put) from [] (put_device+0x20/0x24)<br /> r4:b6700140<br /> [] (put_device) from [] (devm_spi_release_controller+0x3c/0x40)<br /> [] (devm_spi_release_controller) from [] (release_nodes+0x84/0xc4)<br /> r5:b6700180 r4:b6700100<br /> [] (release_nodes) from [] (devres_release_all+0x5c/0x60)<br /> r8:b1638c54 r7:b117ad94 r6:b1638c10 r5:b117ad94 r4:b163dc10<br /> [] (devres_release_all) from [] (__device_release_driver+0x144/0x1ec)<br /> r5:b117ad94 r4:b163dc10<br /> [] (__device_release_driver) from [] (device_driver_detach+0x84/0xa0)<br /> r9:00000000 r8:00000000 r7:b117ad94 r6:b163dc54 r5:b1638c10 r4:b163dc10<br /> [] (device_driver_detach) from [] (unbind_store+0xe4/0xf8)<br /> <br /> Instead, determine the devm allocation state as a flag on the<br /> controller which is guaranteed to be stable during cleanup.