From patchwork Fri Jul 12 16:29:33 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1959965 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4WLHB95WDrz1xqy for ; Sat, 13 Jul 2024 02:29:52 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1sSJ9P-0001bM-Oa; Fri, 12 Jul 2024 16:29:39 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1sSJ9O-0001b8-7g for kernel-team@lists.ubuntu.com; Fri, 12 Jul 2024 16:29:38 +0000 Received: from mail-io1-f69.google.com (mail-io1-f69.google.com [209.85.166.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id CB2853F0E9 for ; Fri, 12 Jul 2024 16:29:37 +0000 (UTC) Received: by mail-io1-f69.google.com with SMTP id ca18e2360f4ac-802d5953345so236185739f.3 for ; Fri, 12 Jul 2024 09:29:37 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720801776; x=1721406576; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=2jfUKYcUld9ed/WrvP6hTVt7TG6FaqDPgu68PmQtvAU=; b=aEH1xOxEjtFrGH53oJIiWmEFGGGzBIoqzYd8lATeABevcRn7dbBd8ATcbu9/nK4Gpx DER3VeNcOqPHO9uT0fwF94phRXeLYU545Nb4t2D33MfsvH48SRqo7zPN3Qkh3fXG85Nk i3zlFmLbGPWXE3lsUpWYx/HSHMbanTfPFAdexiG569t13ZKFunHw09w5GcCHW8lNkEFx Cx7dGrlQYqtmlDDEcwvBiexVkGaCeXGZg8Ob45mq631B07z1Quyo1q76mXIXZ6VwnUqb FXLZ5GtN3f3u4gBpte81QLvI0qI8wZX2qTXwzts5qtshCfdWjOF0acjENb+lHf62oEgc P8dA== X-Gm-Message-State: AOJu0YxI3s6im0mdVas3A3xyvhXBQr7wx2fs6trVjKi0NsGeUpbWptrR mXk05SuuNwKl+Px+QLtCBz0ZbLP4GIDW6QEsqDt12QxtsKUR/MhM92zn9u6afHnongYJOzp7YBh cjU5dKWJM24QsDfUVdnJP7AX2jevQP/Lc82mzxs7Oic1naTbdONk1py38JAAyPOLJbnZR+jp19p vS5Wx98l8FLg== X-Received: by 2002:a6b:d606:0:b0:803:8353:a89b with SMTP id ca18e2360f4ac-8038353aaefmr1113734139f.12.1720801776418; Fri, 12 Jul 2024 09:29:36 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHCjGI51hoVdkzVdQBQIT8aIGmky4U0EY7NfBsmw9Do5ji1iajrlTKB7Mwh1L9L53vTWLTLzw== X-Received: by 2002:a6b:d606:0:b0:803:8353:a89b with SMTP id ca18e2360f4ac-8038353aaefmr1113730239f.12.1720801775977; Fri, 12 Jul 2024 09:29:35 -0700 (PDT) Received: from smtp.gmail.com (167-248-51-36.oa02.lnk04.ne.dynamic.allophone.net. [167.248.51.36]) by smtp.gmail.com with ESMTPSA id 8926c6da1cb9f-4c0b1c162f5sm2546818173.143.2024.07.12.09.29.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Jul 2024 09:29:35 -0700 (PDT) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][N/J][PATCH 0/1] CVE-2024-39292 Date: Fri, 12 Jul 2024 11:29:33 -0500 Message-Id: <20240712162934.9725-1-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" [Impact] um: Add winch to winch_handlers before registering winch IRQ Registering a winch IRQ is racy, an interrupt may occur before the winch is added to the winch_handlers list. If that happens, register_winch_irq() adds to that list a winch that is scheduled to be (or has already been) freed, causing a panic later in winch_cleanup(). Avoid the race by adding the winch to the winch_handlers list before registering the IRQ, and rolling back if um_request_irq() fails. [Fix] Noble: Clean cherry-pick from linux-6.9.y Jammy: Noble patch applied cleanly Focal: pending (5.4.0-192.212) Bionic: fix sent to esm ML Xenial: fix sent to esm ML Trusty: not going to be fixed by us [Test Case] Compile and boot tested. [Where problems could occur] This fix affects those who use User-Mode Linux, an issue with this fix would be visible to the user via unpredicted system behavior. Roberto Sassu (1): um: Add winch to winch_handlers before registering winch IRQ arch/um/drivers/line.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) Acked-by: Manuel Diewald Acked-by: Kevin Becker