From patchwork Mon Apr 17 18:08:06 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Cabaj X-Patchwork-Id: 1769771 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=Jf3bs+Zq; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Q0ZmT4037z1yZr for ; Tue, 18 Apr 2023 04:08:24 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1poTGy-0006rt-AJ; Mon, 17 Apr 2023 18:08:16 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1poTGt-0006rN-DC for kernel-team@lists.ubuntu.com; Mon, 17 Apr 2023 18:08:11 +0000 Received: from mail-yb1-f198.google.com (mail-yb1-f198.google.com [209.85.219.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 3CFE83F19A for ; Mon, 17 Apr 2023 18:08:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1681754891; bh=//VAyfKcE2SH2jyQEF6b8pf3DC/jmdETe2cguNp5qy8=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Jf3bs+ZqE4MfL348Nl9lk3y6wtZnyzGT7TCYTibOtBoamof88yfLpPXeaPIF+b0sx Hg0D3312CkOnM99yZFc0AhzSB/ML2t0OA51E8vrkJo9AULqlutZ6/OUHOMSJ8FcX1l vt4WDg1/CpNL4PLTqbNyKMii13DPkq+7q0DddfqEE4CqzBU8dEbZjCfNe8x9T//mp2 BhKkou5/8tQHVyt16Bxuz9G9wLT9ORNc4Bxoz2Lid+zMdp0yvz8X87lc18mwBQGZn4 v+niHMV74PilXEh2sbrq3dRMJnnpi7pjxcrthSbY1/BPA4+2tEcj913b8gZN6vdOMc /tW0zy+m39wfg== Received: by mail-yb1-f198.google.com with SMTP id d14-20020a25e60e000000b00b8f65697946so9232600ybh.2 for ; Mon, 17 Apr 2023 11:08:11 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1681754888; x=1684346888; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=//VAyfKcE2SH2jyQEF6b8pf3DC/jmdETe2cguNp5qy8=; b=aE57R/FL8+nxVfq4j+Ivz9iHZIN0QP8pz0I1wsIJAgrbsqFq+P8Ek1mA5eFL4hS7jo s14yWTH/erku2pKXtIvXoYPZI7I4ntfTmgTlyhO579TGag9+Fu6IWRRwD4N6bs/C/wc6 71XkpYEvEfP14GOhqswpV1C7YVe9PdF/k6XuBTrhnvMh71Ywja/3bofIetqKyoiFx9e7 qiXEULLv+UKi88rEFlp0TH6GZeTYM1S5hiaDC6PKX9s96emmwWaSQ76pTiFLYeY9MxtG Us0mJkdTTw6fMaFzsDChoOcWfqnn6okoY0483kh/pzRH9G1BxbQorv1AxhoWb6Wi/G9O R/RQ== X-Gm-Message-State: AAQBX9dzqZrDl8smS/CLtaozqd9y8TWSch+gwCUuRwo1Mfj9rzlqc92d gkkzF0ztgBEBv4O7T1i8CA6jHXd+kxWMLp8XZGfj3DpLcMFZHTR7o0NFNkzIiTERVSwLyZCKdjr yuasr9bLgjBxJ4n8d+ntbCfARs9MWX7VOZfCmXduWsCFDQJgWgA== X-Received: by 2002:a81:4645:0:b0:541:9b48:523a with SMTP id t66-20020a814645000000b005419b48523amr14555228ywa.15.1681754888637; Mon, 17 Apr 2023 11:08:08 -0700 (PDT) X-Google-Smtp-Source: AKy350ZdSwA6bodumhLK1TUmLP+gsjzpZywwQJOJiQFtNYMN+CO959zNThKqCfQ5aJtKbXLhxeLV/g== X-Received: by 2002:a81:4645:0:b0:541:9b48:523a with SMTP id t66-20020a814645000000b005419b48523amr14555218ywa.15.1681754888323; Mon, 17 Apr 2023 11:08:08 -0700 (PDT) Received: from smtp.gmail.com (h69-130-246-116.mdtnwi.broadband.dynamic.tds.net. [69.130.246.116]) by smtp.gmail.com with ESMTPSA id i75-20020a816d4e000000b00545a0818471sm3260298ywc.1.2023.04.17.11.08.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Apr 2023 11:08:07 -0700 (PDT) From: John Cabaj To: kernel-team@lists.ubuntu.com Subject: [SRU][Bionic, Focal, Jammy, Kinetic, OEM-5.14, OEM-5.17, OEM-6.0, OEM-6.1][PATCH 1/1] 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition Date: Mon, 17 Apr 2023 13:08:06 -0500 Message-Id: <20230417180806.1195248-2-john.cabaj@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230417180806.1195248-1-john.cabaj@canonical.com> References: <20230417180806.1195248-1-john.cabaj@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Zheng Wang In xen_9pfs_front_probe, it calls xen_9pfs_front_alloc_dataring to init priv->rings and bound &ring->work with p9_xen_response. When it calls xen_9pfs_front_event_handler to handle IRQ requests, it will finally call schedule_work to start the work. When we call xen_9pfs_front_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in xen_9pfs_front_free. Note that, this bug is found by static analysis, which might be false positive. CPU0 CPU1 |p9_xen_response xen_9pfs_front_remove| xen_9pfs_front_free| kfree(priv) | //free priv | |p9_tag_lookup |//use priv->client Fixes: 71ebd71921e4 ("xen/9pfs: connect to the backend") Signed-off-by: Zheng Wang Reviewed-by: Michal Swiatkowski Signed-off-by: Eric Van Hensbergen (cherry picked from commit ea4f1009408efb4989a0f139b70fb338e7f687d0) Signed-off-by: John Cabaj --- net/9p/trans_xen.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 4255f2a3bea4..5d518a36fff7 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -300,6 +300,10 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) write_unlock(&xen_9pfs_lock); for (i = 0; i < priv->num_rings; i++) { + struct xen_9pfs_dataring *ring = &priv->rings[i]; + + cancel_work_sync(&ring->work); + if (!priv->rings[i].intf) break; if (priv->rings[i].irq > 0)