--- /dev/null
+From b4a90b543d9f62d3ac34ec1ab97fc5334b048565 Mon Sep 17 00:00:00 2001
+From: robelin <robelin@nvidia.com>
+Date: Fri, 23 Aug 2024 14:43:41 +0000
+Subject: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
+
+From: robelin <robelin@nvidia.com>
+
+commit b4a90b543d9f62d3ac34ec1ab97fc5334b048565 upstream.
+
+When using kernel with the following extra config,
+
+ - CONFIG_KASAN=y
+ - CONFIG_KASAN_GENERIC=y
+ - CONFIG_KASAN_INLINE=y
+ - CONFIG_KASAN_VMALLOC=y
+ - CONFIG_FRAME_WARN=4096
+
+kernel detects that snd_pcm_suspend_all() access a freed
+'snd_soc_pcm_runtime' object when the system is suspended, which
+leads to a use-after-free bug:
+
+[ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270
+[ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330
+
+[ 52.047785] Call trace:
+[ 52.047787] dump_backtrace+0x0/0x3c0
+[ 52.047794] show_stack+0x34/0x50
+[ 52.047797] dump_stack_lvl+0x68/0x8c
+[ 52.047802] print_address_description.constprop.0+0x74/0x2c0
+[ 52.047809] kasan_report+0x210/0x230
+[ 52.047815] __asan_report_load1_noabort+0x3c/0x50
+[ 52.047820] snd_pcm_suspend_all+0x1a8/0x270
+[ 52.047824] snd_soc_suspend+0x19c/0x4e0
+
+The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before
+making any access. So we need to always set 'substream->runtime' to NULL
+everytime we kfree() it.
+
+Fixes: a72706ed8208 ("ASoC: codec2codec: remove ephemeral variables")
+Signed-off-by: robelin <robelin@nvidia.com>
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Link: https://patch.msgid.link/20240823144342.4123814-2-spujar@nvidia.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/soc-dapm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -4018,6 +4018,7 @@ static int snd_soc_dai_link_event(struct
+
+ case SND_SOC_DAPM_POST_PMD:
+ kfree(substream->runtime);
++ substream->runtime = NULL;
+ break;
+
+ default:
--- /dev/null
+From 4bcdd831d9d01e0fb64faea50732b59b2ee88da1 Mon Sep 17 00:00:00 2001
+From: Sean Christopherson <seanjc@google.com>
+Date: Tue, 23 Jul 2024 16:20:55 -0700
+Subject: KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS
+
+From: Sean Christopherson <seanjc@google.com>
+
+commit 4bcdd831d9d01e0fb64faea50732b59b2ee88da1 upstream.
+
+Grab kvm->srcu when processing KVM_SET_VCPU_EVENTS, as KVM will forcibly
+leave nested VMX/SVM if SMM mode is being toggled, and leaving nested VMX
+reads guest memory.
+
+Note, kvm_vcpu_ioctl_x86_set_vcpu_events() can also be called from KVM_RUN
+via sync_regs(), which already holds SRCU. I.e. trying to precisely use
+kvm_vcpu_srcu_read_lock() around the problematic SMM code would cause
+problems. Acquiring SRCU isn't all that expensive, so for simplicity,
+grab it unconditionally for KVM_SET_VCPU_EVENTS.
+
+ =============================
+ WARNING: suspicious RCU usage
+ 6.10.0-rc7-332d2c1d713e-next-vm #552 Not tainted
+ -----------------------------
+ include/linux/kvm_host.h:1027 suspicious rcu_dereference_check() usage!
+
+ other info that might help us debug this:
+
+ rcu_scheduler_active = 2, debug_locks = 1
+ 1 lock held by repro/1071:
+ #0: ffff88811e424430 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x7d/0x970 [kvm]
+
+ stack backtrace:
+ CPU: 15 PID: 1071 Comm: repro Not tainted 6.10.0-rc7-332d2c1d713e-next-vm #552
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
+ Call Trace:
+ <TASK>
+ dump_stack_lvl+0x7f/0x90
+ lockdep_rcu_suspicious+0x13f/0x1a0
+ kvm_vcpu_gfn_to_memslot+0x168/0x190 [kvm]
+ kvm_vcpu_read_guest+0x3e/0x90 [kvm]
+ nested_vmx_load_msr+0x6b/0x1d0 [kvm_intel]
+ load_vmcs12_host_state+0x432/0xb40 [kvm_intel]
+ vmx_leave_nested+0x30/0x40 [kvm_intel]
+ kvm_vcpu_ioctl_x86_set_vcpu_events+0x15d/0x2b0 [kvm]
+ kvm_arch_vcpu_ioctl+0x1107/0x1750 [kvm]
+ ? mark_held_locks+0x49/0x70
+ ? kvm_vcpu_ioctl+0x7d/0x970 [kvm]
+ ? kvm_vcpu_ioctl+0x497/0x970 [kvm]
+ kvm_vcpu_ioctl+0x497/0x970 [kvm]
+ ? lock_acquire+0xba/0x2d0
+ ? find_held_lock+0x2b/0x80
+ ? do_user_addr_fault+0x40c/0x6f0
+ ? lock_release+0xb7/0x270
+ __x64_sys_ioctl+0x82/0xb0
+ do_syscall_64+0x6c/0x170
+ entry_SYSCALL_64_after_hwframe+0x4b/0x53
+ RIP: 0033:0x7ff11eb1b539
+ </TASK>
+
+Fixes: f7e570780efc ("KVM: x86: Forcibly leave nested virt when SMM state is toggled")
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20240723232055.3643811-1-seanjc@google.com
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/x86.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -5829,7 +5829,9 @@ long kvm_arch_vcpu_ioctl(struct file *fi
+ if (copy_from_user(&events, argp, sizeof(struct kvm_vcpu_events)))
+ break;
+
++ kvm_vcpu_srcu_read_lock(vcpu);
+ r = kvm_vcpu_ioctl_x86_set_vcpu_events(vcpu, &events);
++ kvm_vcpu_srcu_read_unlock(vcpu);
+ break;
+ }
+ case KVM_GET_DEBUGREGS: {
--- /dev/null
+From a3c1e45156ad39f225cd7ddae0f81230a3b1e657 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jens=20Emil=20Schulz=20=C3=98stergaard?=
+ <jensemil.schulzostergaard@microchip.com>
+Date: Thu, 29 Aug 2024 11:52:54 +0200
+Subject: net: microchip: vcap: Fix use-after-free error in kunit test
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jens Emil Schulz Østergaard <jensemil.schulzostergaard@microchip.com>
+
+commit a3c1e45156ad39f225cd7ddae0f81230a3b1e657 upstream.
+
+This is a clear use-after-free error. We remove it, and rely on checking
+the return code of vcap_del_rule.
+
+Reported-by: Dan Carpenter <error27@gmail.com>
+Closes: https://lore.kernel.org/kernel-janitors/7bffefc6-219a-4f71-baa0-ad4526e5c198@kili.mountain/
+Fixes: c956b9b318d9 ("net: microchip: sparx5: Adding KUNIT tests of key/action values in VCAP API")
+Signed-off-by: Jens Emil Schulz Østergaard <jensemil.schulzostergaard@microchip.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
++++ b/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
+@@ -1442,18 +1442,8 @@ static void vcap_api_encode_rule_test(st
+ vcap_enable_lookups(&test_vctrl, &test_netdev, 0, 0,
+ rule->cookie, false);
+
+- vcap_free_rule(rule);
+-
+- /* Check that the rule has been freed: tricky to access since this
+- * memory should not be accessible anymore
+- */
+- KUNIT_EXPECT_PTR_NE(test, NULL, rule);
+- ret = list_empty(&rule->keyfields);
+- KUNIT_EXPECT_EQ(test, true, ret);
+- ret = list_empty(&rule->actionfields);
+- KUNIT_EXPECT_EQ(test, true, ret);
+-
+- vcap_del_rule(&test_vctrl, &test_netdev, id);
++ ret = vcap_del_rule(&test_vctrl, &test_netdev, id);
++ KUNIT_EXPECT_EQ(test, 0, ret);
+ }
+
+ static void vcap_api_set_rule_counter_test(struct kunit *test)
sch-netem-fix-use-after-free-in-netem_dequeue.patch
+net-microchip-vcap-fix-use-after-free-error-in-kunit-test.patch
+asoc-dapm-fix-uaf-for-snd_soc_pcm_runtime-object.patch
+kvm-x86-acquire-kvm-srcu-when-handling-kvm_set_vcpu_events.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
