From patchwork Mon Apr 17 18:08:05 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Cabaj X-Patchwork-Id: 1769772 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=nxeR01r4; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Q0ZmT45W2z1yb4 for ; Tue, 18 Apr 2023 04:08:24 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1poTGv-0006rV-4y; Mon, 17 Apr 2023 18:08:13 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1poTGt-0006rG-27 for kernel-team@lists.ubuntu.com; Mon, 17 Apr 2023 18:08:11 +0000 Received: from mail-yw1-f197.google.com (mail-yw1-f197.google.com [209.85.128.197]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id A976F3F19A for ; Mon, 17 Apr 2023 18:08:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1681754888; bh=6QeVcQQSRc3i5VYo4nCu7fWnWRGcwpX+BMhuVketNbU=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=nxeR01r4a9mtH882KtmWetNNCE9Z+MyCc0xcUzWJC2dHUOxfM7J8e1KNu+7oNrR+s ughgmnKKAx17Qn+wLYGS5ckQJqk38P0mLt2qA8Rsx/yiQ9DHQKPXDOKJcx59asjmLt e/7oIQnU2v3pdbtUsB8MTB8fC5zAAEk2ICW9uG92iwVEz7cqvlvAX//IiK8bO01x1n kz9DliAt3ZaGBNs0WzBdS/Ro9J2cQYnOFcijBPwW1FY1Map/hxNCMvdDG2FnRA+Tm9 MmHX5+UFvnyZ+GjRw+rnha0E7VTcpo6d7bQStbR6sBsU3JxRhQkZt3CAtG2fitbj3D Y/RlB6KCUEuXw== Received: by mail-yw1-f197.google.com with SMTP id 00721157ae682-54f97aac3d0so138343377b3.15 for ; Mon, 17 Apr 2023 11:08:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1681754888; x=1684346888; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=6QeVcQQSRc3i5VYo4nCu7fWnWRGcwpX+BMhuVketNbU=; b=DurpNOEtjHzfTphtIzvMb1jVMXoQktgFu5G6UsYy6pIlCvv/3gyYfUePg5Vsth9cXg 1BcBUAsCfM86jv9gjXI+zTuhEAo+bad234Aqud2En9MedT7yfBXLiVqHvJFiprbUW+k4 siqQuuVHK0/N7fj9Tibxk9cJdQ9uWY1Nk2pMh3xHf1hKCHhh2lDgU56pEiTD1YuFTZKK oOdvHig/N6GHZD6x90BrFKVUiEJZARa+tDFHQuX2TGbVN/27gw/i242Z/riRwuzbv0oF mLPf2FGFRQfshdkgPDfQzhTHkgaCMqXhXcknWUrchLn9Y73ANYtKXx9KNm4/ZDMN6GS4 7N0Q== X-Gm-Message-State: AAQBX9dNLniv0JPrkh1+TVtD5zqAoB82mTiHOhsArV2B1gkJ+nGSkUan 891QaAQH8M1MJ1SRtiLS2HGrggKyaAbiVU7Nht253Y75x0B+r1PP6HPO/UIU0zMDY16GbnHx1cf n+JdS8BSUaYunquXqRGWNuIdG9JSX4XJZgmkdl/Kq8wVy4hHQKg== X-Received: by 2002:a81:8449:0:b0:54f:b615:ab5d with SMTP id u70-20020a818449000000b0054fb615ab5dmr16700450ywf.14.1681754888154; Mon, 17 Apr 2023 11:08:08 -0700 (PDT) X-Google-Smtp-Source: AKy350bRq0rwoK9PezTYTOxTyvwceFkBAcGLuQ0I0dfcmNtrCct1HFmacFj7OYbhGIJFIRsXLK5qHQ== X-Received: by 2002:a81:8449:0:b0:54f:b615:ab5d with SMTP id u70-20020a818449000000b0054fb615ab5dmr16700426ywf.14.1681754887635; Mon, 17 Apr 2023 11:08:07 -0700 (PDT) Received: from smtp.gmail.com (h69-130-246-116.mdtnwi.broadband.dynamic.tds.net. [69.130.246.116]) by smtp.gmail.com with ESMTPSA id i75-20020a816d4e000000b00545a0818471sm3260298ywc.1.2023.04.17.11.08.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Apr 2023 11:08:07 -0700 (PDT) From: John Cabaj To: kernel-team@lists.ubuntu.com Subject: [SRU][Bionic, Focal, Jammy, Kinetic, OEM-5.14, OEM-5.17, OEM-6.0, OEM-6.1][PATCH 0/1] CVE-2023-1859 Date: Mon, 17 Apr 2023 13:08:05 -0500 Message-Id: <20230417180806.1195248-1-john.cabaj@canonical.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" [Impact] * A use-after-free vulnerability could exist in xen/9pfs, whereupon after removal of a xen_9pfs device, an attempt to service a response could access a struct that has been freed. * Perform requisite clean-up upon removal so further requests cannot be serviced. [Fix] * Clean cherry-picks for all affected kernels [Test Case] * Compile tested * Boot tested [Potential regression] * Low risk. Potentially could take longer to remove xen_9pfs device as cancel waits for work to finish. Zheng Wang (1): 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition net/9p/trans_xen.c | 4 ++++ 1 file changed, 4 insertions(+) Acked-by: Stefan Bader