From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 19 Jun 2024 12:14:57 +0000 (+0200)
Subject: 6.1-stable patches
X-Git-Tag: v6.1.95~14
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e4480c53331eff151f8a7582a2af7012b79cfee0;p=thirdparty%2Fkernel%2Fstable-queue.git

6.1-stable patches

added patches:
	greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
---

diff --git a/queue-6.1/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch b/queue-6.1/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
new file mode 100644
index 00000000000..9dc97e274e3
--- /dev/null
+++ b/queue-6.1/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch
@@ -0,0 +1,52 @@
+From 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce Mon Sep 17 00:00:00 2001
+From: Sicong Huang <congei42@163.com>
+Date: Tue, 16 Apr 2024 16:03:13 +0800
+Subject: greybus: Fix use-after-free bug in gb_interface_release due to race condition.
+
+From: Sicong Huang <congei42@163.com>
+
+commit 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce upstream.
+
+In gb_interface_create, &intf->mode_switch_completion is bound with
+gb_interface_mode_switch_work. Then it will be started by
+gb_interface_request_mode_switch. Here is the relevant code.
+if (!queue_work(system_long_wq, &intf->mode_switch_work)) {
+	...
+}
+
+If we call gb_interface_release to make cleanup, there may be an
+unfinished work. This function will call kfree to free the object
+"intf". However, if gb_interface_mode_switch_work is scheduled to
+run after kfree, it may cause use-after-free error as
+gb_interface_mode_switch_work will use the object "intf".
+The possible execution flow that may lead to the issue is as follows:
+
+CPU0                            CPU1
+
+                            |   gb_interface_create
+                            |   gb_interface_request_mode_switch
+gb_interface_release        |
+kfree(intf) (free)          |
+                            |   gb_interface_mode_switch_work
+                            |   mutex_lock(&intf->mutex) (use)
+
+Fix it by canceling the work before kfree.
+
+Signed-off-by: Sicong Huang <congei42@163.com>
+Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com
+Cc: Ronnie Sahlberg <rsahlberg@ciq.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/greybus/interface.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/greybus/interface.c
++++ b/drivers/greybus/interface.c
+@@ -694,6 +694,7 @@ static void gb_interface_release(struct
+ 
+ 	trace_gb_interface_release(intf);
+ 
++	cancel_work_sync(&intf->mode_switch_work);
+ 	kfree(intf);
+ }
+ 
diff --git a/queue-6.1/series b/queue-6.1/series
index 280d2a07c8e..694ad8a1c04 100644
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -207,3 +207,4 @@ remoteproc-k3-r5-jump-to-error-handling-labels-in-start-stop-errors.patch
 cachefiles-erofs-fix-null-deref-in-when-cachefiles-is-not-doing-ondemand-mode.patch
 bluetooth-qca-fix-wcn3991-device-address-check.patch
 bluetooth-qca-generalise-device-address-check.patch
+greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch