CVE-2023-53594

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

driver core: fix resource leak in device_add()

When calling kobject_add() failed in device_add(), it will call

cleanup_glue_dir() to free resource. But in kobject_add(),

dev->kobj.parent has been set to NULL. This will cause resource leak.

The process is as follows:

device_add()

get_device_parent()

class_dir_create_and_add()

kobject_add() //kobject_get()

...

dev->kobj.parent = kobj;

...

kobject_add() //failed, but set dev->kobj.parent = NULL

...

glue_dir = get_glue_dir(dev) //glue_dir = NULL, and goto

//"Error" label

...

cleanup_glue_dir() //becaues glue_dir is NULL, not call

//kobject_put()

The preceding problem may cause insmod mac80211_hwsim.ko to failed.

sysfs: cannot create duplicate filename '/devices/virtual/mac80211_hwsim'

Call Trace:

<TASK>

dump_stack_lvl+0x8e/0xd1

sysfs_warn_dup.cold+0x1c/0x29

sysfs_create_dir_ns+0x224/0x280

kobject_add_internal+0x2aa/0x880

kobject_add+0x135/0x1a0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References