CVE-2021-47205

What it actually does

The flaw leaves clock and reset providers registered after the CCU driver's MMIO region is unmapped on unbind, creating dangling references that trigger page faults on later clock operations.

Why it matters to the business

Systems using affected hardware may experience unexpected kernel crashes or instability during driver unload or hotplug events, leading to service disruption and potential data loss until reboot.

How an attack unfolds

An attacker triggers unbinding of the CCU driver to leave clocks registered against unmapped memory, then induces a subsequent clock operation that dereferences the freed region and faults the kernel.

How to fix it

Apply the upstream fix that separates CCU initialization from memory allocation and registers a devres callback to unregister clocks and resets on unbind; update to a patched kernel release.

How to confirm the fix worked

Confirm the sunxi-ng probe path contains the devres-registered unregistration callback and that early OF providers remain exempt as documented in the commit.

Typical attack path

1. Locate a system exposing the sunxi-ng CCU driver
2. Force driver unbind via module removal or device hotplug
3. Trigger a clock or reset consumer operation
4. Access unmapped MMIO causing kernel page fault

How to detect it

Search kernel logs and dmesg for page faults or oops mentioning sunxi-ng clock or reset operations immediately following CCU driver unbind attempts.

What your security team should do

• Prioritize kernel updates for affected distributions
• Monitor kernel logs for sunxi clock-related oops after driver unbind events
• Limit unprivileged module unload or device removal where feasible