6.6-stable patches

added patches:
	hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch

diff --git a/queue-6.6/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch b/queue-6.6/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch
new file mode 100644 (file)
index 0000000..adb5ef8
--- /dev/null
+++ b/queue-6.6/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch
@@ -0,0 +1,49 @@
+From e3f88665a78045fe35c7669d2926b8d97b892c11 Mon Sep 17 00:00:00 2001
+From: Kaixin Wang <kxwang23@m.fudan.edu.cn>
+Date: Wed, 18 Sep 2024 20:07:50 +0800
+Subject: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
+
+From: Kaixin Wang <kxwang23@m.fudan.edu.cn>
+
+commit e3f88665a78045fe35c7669d2926b8d97b892c11 upstream.
+
+In the ssi_protocol_probe() function, &ssi->work is bound with
+ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function
+within the ssip_pn_ops structure is capable of starting the
+work.
+
+If we remove the module which will call ssi_protocol_remove()
+to make a cleanup, it will free ssi through kfree(ssi),
+while the work mentioned above will be used. The sequence
+of operations that may lead to a UAF bug is as follows:
+
+CPU0                                    CPU1
+
+                        | ssip_xmit_work
+ssi_protocol_remove     |
+kfree(ssi);             |
+                        | struct hsi_client *cl = ssi->cl;
+                        | // use ssi
+
+Fix it by ensuring that the work is canceled before proceeding
+with the cleanup in ssi_protocol_remove().
+
+Signed-off-by: Kaixin Wang <kxwang23@m.fudan.edu.cn>
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20240918120749.1730-1-kxwang23@m.fudan.edu.cn
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hsi/clients/ssi_protocol.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hsi/clients/ssi_protocol.c
++++ b/drivers/hsi/clients/ssi_protocol.c
+@@ -401,6 +401,7 @@ static void ssip_reset(struct hsi_client
+       del_timer(&ssi->rx_wd);
+       del_timer(&ssi->tx_wd);
+       del_timer(&ssi->keep_alive);
++      cancel_work_sync(&ssi->work);
+       ssi->main_state = 0;
+       ssi->send_state = 0;
+       ssi->recv_state = 0;

diff --git a/queue-6.6/series b/queue-6.6/series
index 7fb83695cdb4b02f8bbfec29b84492fe1512a31f..9d34d63d11c438a4982b1fa0cf9f6decf3677055 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -236,3 +236,4 @@ iommufd-fail-replace-if-device-has-not-been-attached.patch
 x86-e820-fix-handling-of-subpage-regions-when-calculating-nosave-ranges-in-e820__register_nosave_regions.patch
 media-mediatek-vcodec-mark-vdec_vp9_slice_map_counts_eob_coef-noinline.patch
 bluetooth-hci_uart-fix-another-race-during-initialization.patch
+hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch