From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 19 Jun 2024 12:14:34 +0000 (+0200)
Subject: 5.10-stable patches
X-Git-Tag: v6.1.95~16
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a2e22253ec24e8afe9ac3b1e41d211f610a72305;p=thirdparty%2Fkernel%2Fstable-queue.git

5.10-stable patches

added patches:
	greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
---

diff --git a/queue-5.10/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch b/queue-5.10/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
new file mode 100644
index 00000000000..9dc97e274e3
--- /dev/null
+++ b/queue-5.10/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
@@ -0,0 +1,52 @@
+From 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce Mon Sep 17 00:00:00 2001
+From: Sicong Huang <congei42@163.com>
+Date: Tue, 16 Apr 2024 16:03:13 +0800
+Subject: greybus: Fix use-after-free bug in gb_interface_release due to race condition.
+
+From: Sicong Huang <congei42@163.com>
+
+commit 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce upstream.
+
+In gb_interface_create, &intf->mode_switch_completion is bound with
+gb_interface_mode_switch_work. Then it will be started by
+gb_interface_request_mode_switch. Here is the relevant code.
+if (!queue_work(system_long_wq, &intf->mode_switch_work)) {
+	...
+}
+
+If we call gb_interface_release to make cleanup, there may be an
+unfinished work. This function will call kfree to free the object
+"intf". However, if gb_interface_mode_switch_work is scheduled to
+run after kfree, it may cause use-after-free error as
+gb_interface_mode_switch_work will use the object "intf".
+The possible execution flow that may lead to the issue is as follows:
+
+CPU0                            CPU1
+
+                            |   gb_interface_create
+                            |   gb_interface_request_mode_switch
+gb_interface_release        |
+kfree(intf) (free)          |
+                            |   gb_interface_mode_switch_work
+                            |   mutex_lock(&intf->mutex) (use)
+
+Fix it by canceling the work before kfree.
+
+Signed-off-by: Sicong Huang <congei42@163.com>
+Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com
+Cc: Ronnie Sahlberg <rsahlberg@ciq.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/greybus/interface.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/greybus/interface.c
++++ b/drivers/greybus/interface.c
+@@ -694,6 +694,7 @@ static void gb_interface_release(struct
+ 
+ 	trace_gb_interface_release(intf);
+ 
++	cancel_work_sync(&intf->mode_switch_work);
+ 	kfree(intf);
+ }
+ 
diff --git a/queue-5.10/series b/queue-5.10/series
index 5f958abd40d..9b23fcd871a 100644
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -121,3 +121,4 @@ mptcp-ensure-snd_una-is-properly-initialized-on-connect.patch
 mptcp-pm-inc-rmaddr-mib-counter-once-per-rm_addr-id.patch
 mptcp-pm-update-add_addr-counters-after-connect.patch
 remoteproc-k3-r5-jump-to-error-handling-labels-in-start-stop-errors.patch
+greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch