From patchwork Tue Jun 6 08:58:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thibault Ferrante X-Patchwork-Id: 1790935 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=fOHNQ4O/; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Qb4Bm616xz20WK for ; Tue, 6 Jun 2023 18:58:24 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1q6SW9-00079P-0i; Tue, 06 Jun 2023 08:58:17 +0000 Received: from smtp-relay-canonical-0.internal ([10.131.114.83] helo=smtp-relay-canonical-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1q6SW6-000793-TB for kernel-team@lists.ubuntu.com; Tue, 06 Jun 2023 08:58:14 +0000 Received: from Thibf-fixed.fritz.box (1.general.thibf.uk.vpn [10.172.200.119]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-0.canonical.com (Postfix) with ESMTPSA id 870BA3F8D4 for ; Tue, 6 Jun 2023 08:58:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1686041894; bh=X4hdQqRTId8k2pDTxqLBv6hX8reETWrfhCCrtosAQ3g=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=fOHNQ4O/FP5q/LHNn/zLx8aCGrHKnJNm/dOqQXs1V1rVsn4ZwW3gpu35WBRSBnT9t V5Omh76xYt7JVbMQGLLKRhY4/HyDc/NtCaRyzNkg4lnEIXGcgdqtPF8OSfdtBxp8C2 FL/JuoGt+iCrgtv27azcOwoLFtKeK/n8+T80OuHOQkW5mbUqkZGLOqaIhRzWyKdYcQ bezDKZxQv/gA6Xqr2pZ+bzs0PG7NL1VTaHarEC0PdIsSVf8SraVyKYt1WJemeEl4HM ISRHb3XGBZOig3YD3k4DBlqjwvmTek0KklPOPkezE4PT+zYXSMJ1U6LGFmhz26Lfjk RWbdSr63ZvvgA== From: Thibault Ferrante To: kernel-team@lists.ubuntu.com Subject: [SRU][OEM-5.17][PATCH v2 1/1] atm: idt77252: fix use-after-free bugs caused by tst_timer Date: Tue, 6 Jun 2023 10:58:11 +0200 Message-Id: <20230606085811.178001-2-thibault.ferrante@canonical.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230606085811.178001-1-thibault.ferrante@canonical.com> References: <20230606085811.178001-1-thibault.ferrante@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Duoming Zhou There are use-after-free bugs caused by tst_timer. The root cause is that there are no functions to stop tst_timer in idt77252_exit(). One of the possible race conditions is shown below: (thread 1) | (thread 2) | idt77252_init_one | init_card | fill_tst | mod_timer(&card->tst_timer, ...) idt77252_exit | (wait a time) | tst_timer | | ... kfree(card) // FREE | | card->soft_tst[e] // USE The idt77252_dev is deallocated in idt77252_exit() and used in timer handler. This patch adds del_timer_sync() in idt77252_exit() in order that the timer handler could be stopped before the idt77252_dev is deallocated. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou Link: https://lore.kernel.org/r/20220805070008.18007-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski (cherry picked from commit 3f4093e2bf4673f218c0bf17d8362337c400e77b) CVE-2022-3635 Signed-off-by: Thibault Ferrante --- drivers/atm/idt77252.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c index 81ce81a75fc6..681cb3786794 100644 --- a/drivers/atm/idt77252.c +++ b/drivers/atm/idt77252.c @@ -3752,6 +3752,7 @@ static void __exit idt77252_exit(void) card = idt77252_chain; dev = card->atmdev; idt77252_chain = card->next; + del_timer_sync(&card->tst_timer); if (dev->phy->stop) dev->phy->stop(dev);