5.15-stable patches

added patches:
	greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch

diff --git a/queue-5.15/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch b/queue-5.15/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
new file mode 100644 (file)
index 0000000..9dc97e2
--- /dev/null
+++ b/queue-5.15/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
@@ -0,0 +1,52 @@
+From 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce Mon Sep 17 00:00:00 2001
+From: Sicong Huang <congei42@163.com>
+Date: Tue, 16 Apr 2024 16:03:13 +0800
+Subject: greybus: Fix use-after-free bug in gb_interface_release due to race condition.
+
+From: Sicong Huang <congei42@163.com>
+
+commit 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce upstream.
+
+In gb_interface_create, &intf->mode_switch_completion is bound with
+gb_interface_mode_switch_work. Then it will be started by
+gb_interface_request_mode_switch. Here is the relevant code.
+if (!queue_work(system_long_wq, &intf->mode_switch_work)) {
+       ...
+}
+
+If we call gb_interface_release to make cleanup, there may be an
+unfinished work. This function will call kfree to free the object
+"intf". However, if gb_interface_mode_switch_work is scheduled to
+run after kfree, it may cause use-after-free error as
+gb_interface_mode_switch_work will use the object "intf".
+The possible execution flow that may lead to the issue is as follows:
+
+CPU0                            CPU1
+
+                            |   gb_interface_create
+                            |   gb_interface_request_mode_switch
+gb_interface_release        |
+kfree(intf) (free)          |
+                            |   gb_interface_mode_switch_work
+                            |   mutex_lock(&intf->mutex) (use)
+
+Fix it by canceling the work before kfree.
+
+Signed-off-by: Sicong Huang <congei42@163.com>
+Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com
+Cc: Ronnie Sahlberg <rsahlberg@ciq.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/greybus/interface.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/greybus/interface.c
++++ b/drivers/greybus/interface.c
+@@ -694,6 +694,7 @@ static void gb_interface_release(struct
+ 
+       trace_gb_interface_release(intf);
+ 
++      cancel_work_sync(&intf->mode_switch_work);
+       kfree(intf);
+ }
+ 

diff --git a/queue-5.15/series b/queue-5.15/series
index e47ac0a81462c3f94f5b9afc1f1a2b8dcd957334..afb73206a03526c58a19b463dd17f5a797a30963 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -168,3 +168,4 @@ mptcp-pm-inc-rmaddr-mib-counter-once-per-rm_addr-id.patch
 mptcp-pm-update-add_addr-counters-after-connect.patch
 kbuild-remove-support-for-clang-s-thinlto-caching.patch
 remoteproc-k3-r5-jump-to-error-handling-labels-in-start-stop-errors.patch
+greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch