CVE-2024-35879: of: dynamic: Synchronize of_changeset_destroy() with the devlink removals
In the Linux kernel, the following vulnerability has been resolved:
of: dynamic: Synchronize ofchangesetdestroy() with the devlink removals
In the following sequence: 1) ofplatformdepopulate() 2) ofoverlayremove()
During the step 1, devices are destroyed and devlinks are removed. During the step 2, OF nodes are destroyed but ofchangesetentrydestroy() can raise warnings related to missing ofnodeput(): ERROR: memory leak, expected refcount 1 instead of 2 ...
Indeed, during the devlink removals performed at step 1, the removal itself releasing the device (and the attached ofnode) is done by a job queued in a workqueue and so, it is done asynchronously with respect to function calls. When the warning is present, ofnodeput() will be called but wrongly too late from the workqueue job.
In order to be sure that any ongoing devlink removals are done before the ofnode destruction, synchronize the ofchangesetdestroy() with the devlink removals.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
Synchronize of_changeset_destroy() with the devlink removals so that ongoing devlink removal jobs (queued in a workqueue at step 1) complete before the of_node destruction performed during the of_overlay_remove()/__of_changeset_entry_destroy() path.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35879?
The severity of CVE-2024-35879 has been classified as moderate due to potential impacts on system stability.
How do I fix CVE-2024-35879?
To fix CVE-2024-35879, update to the latest version of the linux package, specifically to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.9-1, or 6.12.10-1.
What systems are affected by CVE-2024-35879?
CVE-2024-35879 affects systems running specific versions of the Linux kernel, particularly those versions identified in the affected software list.
Is there a workaround for CVE-2024-35879?
A workaround for CVE-2024-35879 is not recommended; updating the kernel is the advised course of action.
When was CVE-2024-35879 disclosed?
CVE-2024-35879 was disclosed in 2024 as part of a series of Linux kernel vulnerabilities.