Description
In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix refcount leak in pcs_add_gpio_func() of_parse_phandle_with_args() returns a device_node pointer with refcount incremented in gpiospec.np. The loop iterates through all phandles but never releases the reference, causing a refcount leak on each iteration. Add of_node_put() calls to release the reference after extracting the needed arguments and on the error path when devm_kzalloc() fails. This bug was detected by our static analysis tool and verified by my code review.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a1a277eb76b3507df7c41774048a644aa4dfd096 to < 191bfd5710d6a7f48ba4315d8d3e908dcc15243caffecteda1a277eb76b3507df7c41774048a644aa4dfd096 to < 3e3b28bb0b6ddc521a4fdd1c1ba0d35017a0796baffecteda1a277eb76b3507df7c41774048a644aa4dfd096 to < 456a60d06c09a92680dc35fabca68024badcc28eaffecteda1a277eb76b3507df7c41774048a644aa4dfd096 to < 99cc7352156c65201c675f750e0e77c4c73d93f5affecteda1a277eb76b3507df7c41774048a644aa4dfd096 to < 7814b1431848854b56717086e2b61bea3c59753daffecteda1a277eb76b3507df7c41774048a644aa4dfd096 to < e2e367e56bacb93ce5ac73f0b3297d5c83d38dd4affecteda1a277eb76b3507df7c41774048a644aa4dfd096 to < 5b9e84d27e310f22c4ba45fedbc4f5baf43dd823affecteda1a277eb76b3507df7c41774048a644aa4dfd096 to < 353353309b0f7afa407df29e455f9d15b5acc296affected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected5.10.252 to ≤ 5.10.*unaffected5.15.202 to ≤ 5.15.*unaffected6.1.165 to ≤ 6.1.*unaffected6.6.128 to ≤ 6.6.*unaffected6.12.75 to ≤ 6.12.*unaffected6.18.14 to ≤ 6.18.*unaffected6.19.4 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/191bfd5710d6a7f48ba4315d8d3e908dcc15243c ↗
- https://git.kernel.org/stable/c/3e3b28bb0b6ddc521a4fdd1c1ba0d35017a0796b ↗
- https://git.kernel.org/stable/c/456a60d06c09a92680dc35fabca68024badcc28e ↗
- https://git.kernel.org/stable/c/99cc7352156c65201c675f750e0e77c4c73d93f5 ↗
- https://git.kernel.org/stable/c/7814b1431848854b56717086e2b61bea3c59753d ↗
- https://git.kernel.org/stable/c/e2e367e56bacb93ce5ac73f0b3297d5c83d38dd4 ↗
- https://git.kernel.org/stable/c/5b9e84d27e310f22c4ba45fedbc4f5baf43dd823 ↗
- https://git.kernel.org/stable/c/353353309b0f7afa407df29e455f9d15b5acc296 ↗