CVE-2023-52468

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> class: fix use-after-free in class_register()<br /> <br /> The lock_class_key is still registered and can be found in<br /> lock_keys_hash hlist after subsys_private is freed in error<br /> handler path.A task who iterate over the lock_keys_hash<br /> later may cause use-after-free.So fix that up and unregister<br /> the lock_class_key before kfree(cp).<br /> <br /> On our platform, a driver fails to kset_register because of<br /> creating duplicate filename &amp;#39;/class/xxx&amp;#39;.With Kasan enabled,<br /> it prints a invalid-access bug report.<br /> <br /> KASAN bug report:<br /> <br /> BUG: KASAN: invalid-access in lockdep_register_key+0x19c/0x1bc<br /> Write of size 8 at addr 15ffff808b8c0368 by task modprobe/252<br /> Pointer tag: [15], memory tag: [fe]<br /> <br /> CPU: 7 PID: 252 Comm: modprobe Tainted: G W<br /> 6.6.0-mainline-maybe-dirty #1<br /> <br /> Call trace:<br /> dump_backtrace+0x1b0/0x1e4<br /> show_stack+0x2c/0x40<br /> dump_stack_lvl+0xac/0xe0<br /> print_report+0x18c/0x4d8<br /> kasan_report+0xe8/0x148<br /> __hwasan_store8_noabort+0x88/0x98<br /> lockdep_register_key+0x19c/0x1bc<br /> class_register+0x94/0x1ec<br /> init_module+0xbc/0xf48 [rfkill]<br /> do_one_initcall+0x17c/0x72c<br /> do_init_module+0x19c/0x3f8<br /> ...<br /> Memory state around the buggy address:<br /> ffffff808b8c0100: 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a 8a<br /> ffffff808b8c0200: 8a 8a 8a 8a 8a 8a 8a 8a fe fe fe fe fe fe fe fe<br /> &gt;ffffff808b8c0300: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe<br /> ^<br /> ffffff808b8c0400: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03<br /> <br /> As CONFIG_KASAN_GENERIC is not set, Kasan reports invalid-access<br /> not use-after-free here.In this case, modprobe is manipulating<br /> the corrupted lock_keys_hash hlish where lock_class_key is already<br /> freed before.<br /> <br /> It&amp;#39;s worth noting that this only can happen if lockdep is enabled,<br /> which is not true for normal system.