CVE-2024-38385

In the Linux kernel, the following vulnerability has been resolved:

genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()

irq_find_at_or_after() dereferences the interrupt descriptor which is

returned by mt_find() while neither holding sparse_irq_lock nor RCU read

lock, which means the descriptor can be freed between mt_find() and the

dereference:

CPU0 CPU1

desc = mt_find()

delayed_free_desc(desc)

irq_desc_get_irq(desc)

The use-after-free is reported by KASAN:

Call trace:

irq_get_next_irq+0x58/0x84

show_stat+0x638/0x824

seq_read_iter+0x158/0x4ec

proc_reg_read_iter+0x94/0x12c

vfs_read+0x1e0/0x2c8

Freed by task 4471:

slab_free_freelist_hook+0x174/0x1e0

__kmem_cache_free+0xa4/0x1dc

kfree+0x64/0x128

irq_kobj_release+0x28/0x3c

kobject_put+0xcc/0x1e0

delayed_free_desc+0x14/0x2c

rcu_do_batch+0x214/0x720

Guard the access with a RCU read lock section.