From: Greg Kroah-Hartman Date: Sun, 11 Jun 2023 13:19:02 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.14.318~47 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a7c57abd14430501fd07b6b863565d50573c06c7;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: bluetooth-fix-use-after-free-in-hci_remove_ltk-hci_remove_irk.patch ceph-fix-use-after-free-bug-for-inodes-when-flushing-capsnaps.patch --- diff --git a/queue-4.14/bluetooth-fix-use-after-free-in-hci_remove_ltk-hci_remove_irk.patch b/queue-4.14/bluetooth-fix-use-after-free-in-hci_remove_ltk-hci_remove_irk.patch new file mode 100644 index 00000000000..8074b324849 --- /dev/null +++ b/queue-4.14/bluetooth-fix-use-after-free-in-hci_remove_ltk-hci_remove_irk.patch @@ -0,0 +1,48 @@ +From c5d2b6fa26b5b8386a9cc902cdece3a46bef2bd2 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Tue, 30 May 2023 13:48:44 -0700 +Subject: Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk + +From: Luiz Augusto von Dentz + +commit c5d2b6fa26b5b8386a9cc902cdece3a46bef2bd2 upstream. + +Similar to commit 0f7d9b31ce7a ("netfilter: nf_tables: fix use-after-free +in nft_set_catchall_destroy()"). We can not access k after kfree_rcu() +call. + +Cc: stable@vger.kernel.org +Signed-off-by: Min Li +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -2468,10 +2468,10 @@ int hci_remove_link_key(struct hci_dev * + + int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type) + { +- struct smp_ltk *k; ++ struct smp_ltk *k, *tmp; + int removed = 0; + +- list_for_each_entry_rcu(k, &hdev->long_term_keys, list) { ++ list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) { + if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type) + continue; + +@@ -2487,9 +2487,9 @@ int hci_remove_ltk(struct hci_dev *hdev, + + void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type) + { +- struct smp_irk *k; ++ struct smp_irk *k, *tmp; + +- list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) { ++ list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) { + if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type) + continue; + diff --git a/queue-4.14/ceph-fix-use-after-free-bug-for-inodes-when-flushing-capsnaps.patch b/queue-4.14/ceph-fix-use-after-free-bug-for-inodes-when-flushing-capsnaps.patch new file mode 100644 index 00000000000..20cbcf4988d --- /dev/null +++ b/queue-4.14/ceph-fix-use-after-free-bug-for-inodes-when-flushing-capsnaps.patch @@ -0,0 +1,90 @@ +From 409e873ea3c1fd3079909718bbeb06ac1ec7f38b Mon Sep 17 00:00:00 2001 +From: Xiubo Li +Date: Thu, 1 Jun 2023 08:59:31 +0800 +Subject: ceph: fix use-after-free bug for inodes when flushing capsnaps + +From: Xiubo Li + +commit 409e873ea3c1fd3079909718bbeb06ac1ec7f38b upstream. + +There is a race between capsnaps flush and removing the inode from +'mdsc->snap_flush_list' list: + + == Thread A == == Thread B == +ceph_queue_cap_snap() + -> allocate 'capsnapA' + ->ihold('&ci->vfs_inode') + ->add 'capsnapA' to 'ci->i_cap_snaps' + ->add 'ci' to 'mdsc->snap_flush_list' + ... + == Thread C == +ceph_flush_snaps() + ->__ceph_flush_snaps() + ->__send_flush_snap() + handle_cap_flushsnap_ack() + ->iput('&ci->vfs_inode') + this also will release 'ci' + ... + == Thread D == + ceph_handle_snap() + ->flush_snaps() + ->iterate 'mdsc->snap_flush_list' + ->get the stale 'ci' + ->remove 'ci' from ->ihold(&ci->vfs_inode) this + 'mdsc->snap_flush_list' will WARNING + +To fix this we will increase the inode's i_count ref when adding 'ci' +to the 'mdsc->snap_flush_list' list. + +[ idryomov: need_put int -> bool ] + +Cc: stable@vger.kernel.org +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2209299 +Signed-off-by: Xiubo Li +Reviewed-by: Milind Changire +Reviewed-by: Ilya Dryomov +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/caps.c | 6 ++++++ + fs/ceph/snap.c | 4 +++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -1437,6 +1437,7 @@ void ceph_flush_snaps(struct ceph_inode_ + struct inode *inode = &ci->vfs_inode; + struct ceph_mds_client *mdsc = ceph_inode_to_client(inode)->mdsc; + struct ceph_mds_session *session = NULL; ++ bool need_put = false; + int mds; + + dout("ceph_flush_snaps %p\n", inode); +@@ -1490,8 +1491,13 @@ out: + } + /* we flushed them all; remove this inode from the queue */ + spin_lock(&mdsc->snap_flush_lock); ++ if (!list_empty(&ci->i_snap_flush_item)) ++ need_put = true; + list_del_init(&ci->i_snap_flush_item); + spin_unlock(&mdsc->snap_flush_lock); ++ ++ if (need_put) ++ iput(inode); + } + + /* +--- a/fs/ceph/snap.c ++++ b/fs/ceph/snap.c +@@ -623,8 +623,10 @@ int __ceph_finish_cap_snap(struct ceph_i + capsnap->size); + + spin_lock(&mdsc->snap_flush_lock); +- if (list_empty(&ci->i_snap_flush_item)) ++ if (list_empty(&ci->i_snap_flush_item)) { ++ ihold(inode); + list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list); ++ } + spin_unlock(&mdsc->snap_flush_lock); + return 1; /* caller may want to ceph_flush_snaps */ + } diff --git a/queue-4.14/series b/queue-4.14/series index 05d709c2d78..4a0ca0a9a23 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -12,3 +12,5 @@ batman-adv-broken-sync-while-rescheduling-delayed-work.patch input-xpad-delete-a-razer-deathadder-mouse-vid-pid-entry.patch input-psmouse-fix-oob-access-in-elantech-protocol.patch drm-amdgpu-fix-xclk-freq-on-chip_stoney.patch +ceph-fix-use-after-free-bug-for-inodes-when-flushing-capsnaps.patch +bluetooth-fix-use-after-free-in-hci_remove_ltk-hci_remove_irk.patch