CVE-2023-54111

What it actually does

Missing of_node_put() after of_find_node_by_phandle() in rockchip_pinctrl_parse_groups causes a reference count leak on device tree nodes, leading to gradual memory resource exhaustion.

Why it matters to the business

Prolonged operation on affected systems can result in resource depletion, unexpected driver failures, and operational downtime for embedded or Rockchip-based devices.

How an attack unfolds

An attacker with local access or the ability to influence device tree configurations triggers repeated parsing of pin groups, accumulating unreleased node references until memory pressure causes denial of service or system instability.

How to fix it

Update to the fixed commit 13fee9c58706b65893eb6893cb3ef1d34cf6b94b in the wp-erp/wp-erp repository or apply the equivalent upstream kernel patch that adds the missing of_node_put() call.

How to confirm the fix worked

Inspect the source for the presence of of_node_put() immediately after of_find_node_by_phandle() usage in rockchip_pinctrl_parse_groups and confirm the updated commit hash is deployed.

Typical attack path

1. Identify systems using the Rockchip pinctrl driver
2. Trigger or supply a device tree configuration that invokes rockchip_pinctrl_parse_groups multiple times
3. Allow the reference count leak to accumulate over repeated operations
4. Observe memory exhaustion or driver malfunction

How to detect it

Review kernel logs and device tree parsing paths for repeated calls without corresponding reference releases; look for memory leak patterns in pinctrl-related functions.

What your security team should do

• Apply the referenced commit or equivalent patch immediately on all affected kernels
• Monitor memory usage on Rockchip-based systems for unexpected growth
• Prioritize updates on internet-facing or multi-tenant embedded deployments