CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of device resource management, specifically in the Rust implementation, where a race condition can occur between concurrent revocation processes. This may lead to a use-after-free scenario, potentially compromising system stability and security when adjacent resources are improperly accessed. Organizations utilizing Linux in critical environments should prioritize addressing this issue to mitigate risks associated with concurrent resource management.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU. The revoker that does not claim the is_available swap returns immediately, but the revoker that did may still be executing drop_in_place() on the inner data. This can cause a use-after-free when the other revoker's caller proceeds to drop adjacent resources that drop_in_place() still references (e.g., Devres<DmaMappedSgt> racing with SGTable freeing the backing sg_table and pages). Fix this by adding a Completion. The release callback signals the Completion after revoke() finishes, and Devres::drop() waits for it when it loses the is_available swap. This ensures the wrapped object is fully torn down before Devres::drop() returns.