CVE-2025-71081: Linux内核ASoC stm32 SAI驱动OF节点泄漏漏洞

// This is a kernel driver vulnerability that requires no user-space PoC // The fix involves adding proper reference cleanup in the probe error path // Vulnerable code pattern (before fix): int stm32_sai_probe(struct platform_device *pdev) { struct device_node *np = pdev->dev.of_node; struct device_node *sync_provider; // Get reference to sync provider OF node - reference count incremented sync_provider = of_parse_phandle(np, "stm32,sai-syncmaster", 0); if (!sync_provider) return -EINVAL; // This reference is only released if set_sync() fails if (set_sync(sync_provider) < 0) { of_node_put(sync_provider); // Reference released here return -EINVAL; } // If probe fails here or driver unbinds, reference is leaked! return 0; } // Fixed code pattern (after fix): int stm32_sai_probe(struct platform_device *pdev) { struct device_node *np = pdev->dev.of_node; struct device_node *sync_provider; int ret; sync_provider = of_parse_phandle(np, "stm32,sai-syncmaster", 0); if (!sync_provider) return -EINVAL; ret = set_sync(sync_provider); if (ret < 0) { of_node_put(sync_provider); // Release on error return ret; } // Store sync_provider reference properly for cleanup // and ensure of_node_put() is called on probe failure or driver unbind return 0; }