CVE-2022-50457

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mtd: core: Fix refcount error in del_mtd_device()

del_mtd_device() will call of_node_put() to mtd_get_of_node(mtd), which

is mtd->dev.of_node. However, memset(&mtd->dev, 0) is called before

of_node_put(). As the result, of_node_put() won't do anything in

del_mtd_device(), and causes the refcount leak.

del_mtd_device()

memset(&mtd->dev, 0, sizeof(mtd->dev) # clear mtd->dev

of_node_put()

mtd_get_of_node(mtd) # mtd->dev is cleared, can't locate of_node

# of_node_put(NULL) won't do anything

Fix the error by caching the pointer of the device_node.

OF: ERROR: memory leak, expected refcount 1 instead of 2,

of_node_get()/of_node_put() unbalanced - destroy cset entry: attach

overlay node /spi/spi-sram@0

CPU: 3 PID: 275 Comm: python3 Tainted: G N 6.1.0-rc3+ #54

0d8a1edddf51f172ff5226989a7565c6313b08e2

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS

rel-1.15.0-0-g2

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References