From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 19 Jun 2024 12:14:15 +0000 (+0200)
Subject: 5.4-stable patches
X-Git-Tag: v6.1.95~17
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=77d69825fca15f8326757feed46584833d9c6f4b;p=thirdparty%2Fkernel%2Fstable-queue.git

5.4-stable patches

added patches:
	greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
---

diff --git a/queue-5.4/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch b/queue-5.4/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
new file mode 100644
index 00000000000..9dc97e274e3
--- /dev/null
+++ b/queue-5.4/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
@@ -0,0 +1,52 @@
+From 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce Mon Sep 17 00:00:00 2001
+From: Sicong Huang <congei42@163.com>
+Date: Tue, 16 Apr 2024 16:03:13 +0800
+Subject: greybus: Fix use-after-free bug in gb_interface_release due to race condition.
+
+From: Sicong Huang <congei42@163.com>
+
+commit 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce upstream.
+
+In gb_interface_create, &intf->mode_switch_completion is bound with
+gb_interface_mode_switch_work. Then it will be started by
+gb_interface_request_mode_switch. Here is the relevant code.
+if (!queue_work(system_long_wq, &intf->mode_switch_work)) {
+	...
+}
+
+If we call gb_interface_release to make cleanup, there may be an
+unfinished work. This function will call kfree to free the object
+"intf". However, if gb_interface_mode_switch_work is scheduled to
+run after kfree, it may cause use-after-free error as
+gb_interface_mode_switch_work will use the object "intf".
+The possible execution flow that may lead to the issue is as follows:
+
+CPU0                            CPU1
+
+                            |   gb_interface_create
+                            |   gb_interface_request_mode_switch
+gb_interface_release        |
+kfree(intf) (free)          |
+                            |   gb_interface_mode_switch_work
+                            |   mutex_lock(&intf->mutex) (use)
+
+Fix it by canceling the work before kfree.
+
+Signed-off-by: Sicong Huang <congei42@163.com>
+Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com
+Cc: Ronnie Sahlberg <rsahlberg@ciq.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/greybus/interface.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/greybus/interface.c
++++ b/drivers/greybus/interface.c
+@@ -694,6 +694,7 @@ static void gb_interface_release(struct
+ 
+ 	trace_gb_interface_release(intf);
+ 
++	cancel_work_sync(&intf->mode_switch_work);
+ 	kfree(intf);
+ }
+ 
diff --git a/queue-5.4/series b/queue-5.4/series
index a839c0e692c..1a3ef134aaa 100644
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -97,3 +97,4 @@ tick-nohz_full-don-t-abuse-smp_call_function_single-in-tick_setup_device.patch
 hv_utils-drain-the-timesync-packets-on-onchannelcallback.patch
 hugetlb_encode.h-fix-undefined-behaviour-34-26.patch
 netfilter-nftables-exthdr-fix-4-byte-stack-oob-write.patch
+greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch