CVE-2021-47483

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

regmap: Fix possible double-free in regcache_rbtree_exit()

In regcache_rbtree_insert_to_block(), when 'present' realloc failed,

the 'blk' which is supposed to assign to 'rbnode->block' will be freed,

so 'rbnode->block' points a freed memory, in the error handling path of

regcache_rbtree_init(), 'rbnode->block' will be freed again in

regcache_rbtree_exit(), KASAN will report double-free as follows:

BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390

Call Trace:

slab_free_freelist_hook+0x10d/0x240

kfree+0xce/0x390

regcache_rbtree_exit+0x15d/0x1a0

regcache_rbtree_init+0x224/0x2c0

regcache_init+0x88d/0x1310

__regmap_init+0x3151/0x4a80

__devm_regmap_init+0x7d/0x100

madera_spi_probe+0x10f/0x333 [madera_spi]

spi_probe+0x183/0x210

really_probe+0x285/0xc30

To fix this, moving up the assignment of rbnode->block to immediately after

the reallocation has succeeded so that the data structure stays valid even

i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References