From patchwork Tue Apr 18 13:58:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Cabaj X-Patchwork-Id: 1770241 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=Xcqc7Q4Z; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Q159x3YRjz23tD for ; Tue, 18 Apr 2023 23:58:44 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1polqs-00070k-74; Tue, 18 Apr 2023 13:58:34 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1polqr-00070V-4l for kernel-team@lists.ubuntu.com; Tue, 18 Apr 2023 13:58:33 +0000 Received: from mail-yb1-f197.google.com (mail-yb1-f197.google.com [209.85.219.197]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 018C23F1AC for ; Tue, 18 Apr 2023 13:58:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1681826312; bh=IRNW/SCfImkY+7s+ojeBqXQVZ2NBCDAOIY4Uzk55ysA=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Xcqc7Q4Z2CICava96XBUiFlqGlgjSOgAKOGH191DFarZxopspd3kEN+IyqnmEmSS1 sAp32Xi7KwOPh7cYetTc89IV9/t7mzJkDyWLaQnZCTW0gMO18zZp8iggpLJQ5UorW8 +HZ8f4lLO2I1WCANXu7hvk5f0Wmw0uwQ6GiTQPz+kyRjfZxI9b407x9FqG/hSxGC1t TXtkOqG3eIUNt/S3be93RNn5vEqM7bu4e/gyKCel58WoEYM3dkhrtac6IvBzhNgpEz gjLSTA4twpDe1e97ZsqZ2a1lP5subO0vUeakDSLEpnJEK/zQT79QvFjip7IuHBV10H 8PdAIpGhUTTvA== Received: by mail-yb1-f197.google.com with SMTP id 85-20020a250d58000000b00b8f380b2bccso16862139ybn.14 for ; Tue, 18 Apr 2023 06:58:31 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1681826310; x=1684418310; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=IRNW/SCfImkY+7s+ojeBqXQVZ2NBCDAOIY4Uzk55ysA=; b=TMNK01R2l9duWdsT0YC4Bx6um7YeaB1ODRHZgujHG594z3t3/yVjPhIpFEcoCWexlP cDPqcZ/D8h+E5QGGqgF4prFCXc+lDn8CLKMZSQlrzZ4gRAjfBfDZ3CtBoP1h2pSjz92a kKSRMOHlVaLg91Rm7GguEhIuxQ7+a2fmCDGo4bEW8AjovJpSa2RLhojbal/8WIrQB3do asiqvzpQ4w2FGReMVfLrwyWdCfAq3kgSfcx0hUbKB4m1AUh90/OimsZw7zv11Y9dmhcK tAacXHxcyQEPNAjm2oZHtv+N3WQq0M9Lk0NBf4cBU6a7wa+X2iw3B2W59qDPvjaeUpyq nArQ== X-Gm-Message-State: AAQBX9drrFGAMmGpFwGnrWGddz+8f6hhIRXao2GAdBKrPBiL+Nu0W7ms BVJRvnfPsP5mor6LGuKujdJ9tG01L2Knw6fE4d9HFewRNIQr6iTzEJxQ5X2gUIeFW0/Y9IoqxX+ 2g4f1WQ5fwdisxFRX48MBQ4GDacG69uyWJGiTT4+Cs53Pz0T4/Q== X-Received: by 2002:a0d:d6d0:0:b0:54f:895e:70f7 with SMTP id y199-20020a0dd6d0000000b0054f895e70f7mr19366717ywd.9.1681826309810; Tue, 18 Apr 2023 06:58:29 -0700 (PDT) X-Google-Smtp-Source: AKy350ZpzsOKERMXYoSqEBwhOfO73a/0jYoUPT0UoLiNgKG4GpZ+U+hfMrG3c/ct3SY6tI7NhBYy2Q== X-Received: by 2002:a0d:d6d0:0:b0:54f:895e:70f7 with SMTP id y199-20020a0dd6d0000000b0054f895e70f7mr19366703ywd.9.1681826309463; Tue, 18 Apr 2023 06:58:29 -0700 (PDT) Received: from smtp.gmail.com (h69-130-246-116.mdtnwi.broadband.dynamic.tds.net. [69.130.246.116]) by smtp.gmail.com with ESMTPSA id dc6-20020a05690c0f0600b0054601bc6ce2sm3827015ywb.118.2023.04.18.06.58.29 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 18 Apr 2023 06:58:29 -0700 (PDT) From: John Cabaj To: kernel-team@lists.ubuntu.com Subject: [SRU][Bionic, Focal, Jammy, Kinetic, OEM-5.14, OEM-5.17, OEM-6.0, OEM-6.1][PATCH 1/1] 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition Date: Tue, 18 Apr 2023 08:58:26 -0500 Message-Id: <20230418135826.1222385-2-john.cabaj@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230418135826.1222385-1-john.cabaj@canonical.com> References: <20230418135826.1222385-1-john.cabaj@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Zheng Wang In xen_9pfs_front_probe, it calls xen_9pfs_front_alloc_dataring to init priv->rings and bound &ring->work with p9_xen_response. When it calls xen_9pfs_front_event_handler to handle IRQ requests, it will finally call schedule_work to start the work. When we call xen_9pfs_front_remove to remove the driver, there may be a sequence as follows: Fix it by finishing the work before cleanup in xen_9pfs_front_free. Note that, this bug is found by static analysis, which might be false positive. CPU0 CPU1 |p9_xen_response xen_9pfs_front_remove| xen_9pfs_front_free| kfree(priv) | //free priv | |p9_tag_lookup |//use priv->client Fixes: 71ebd71921e4 ("xen/9pfs: connect to the backend") Signed-off-by: Zheng Wang Reviewed-by: Michal Swiatkowski Signed-off-by: Eric Van Hensbergen (cherry picked from commit ea4f1009408efb4989a0f139b70fb338e7f687d0) CVE-2023-1859 Signed-off-by: John Cabaj --- net/9p/trans_xen.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c index 4255f2a3bea4..5d518a36fff7 100644 --- a/net/9p/trans_xen.c +++ b/net/9p/trans_xen.c @@ -300,6 +300,10 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) write_unlock(&xen_9pfs_lock); for (i = 0; i < priv->num_rings; i++) { + struct xen_9pfs_dataring *ring = &priv->rings[i]; + + cancel_work_sync(&ring->work); + if (!priv->rings[i].intf) break; if (priv->rings[i].irq > 0)