From: Greg Kroah-Hartman Date: Fri, 18 Apr 2025 14:21:31 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.12.24~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e73a1757a5ef0539057b9948983fe83dec2724eb;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch --- diff --git a/queue-5.15/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch b/queue-5.15/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch new file mode 100644 index 0000000000..ecb6bf5d9f --- /dev/null +++ b/queue-5.15/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch @@ -0,0 +1,49 @@ +From e3f88665a78045fe35c7669d2926b8d97b892c11 Mon Sep 17 00:00:00 2001 +From: Kaixin Wang +Date: Wed, 18 Sep 2024 20:07:50 +0800 +Subject: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition + +From: Kaixin Wang + +commit e3f88665a78045fe35c7669d2926b8d97b892c11 upstream. + +In the ssi_protocol_probe() function, &ssi->work is bound with +ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function +within the ssip_pn_ops structure is capable of starting the +work. + +If we remove the module which will call ssi_protocol_remove() +to make a cleanup, it will free ssi through kfree(ssi), +while the work mentioned above will be used. The sequence +of operations that may lead to a UAF bug is as follows: + +CPU0 CPU1 + + | ssip_xmit_work +ssi_protocol_remove | +kfree(ssi); | + | struct hsi_client *cl = ssi->cl; + | // use ssi + +Fix it by ensuring that the work is canceled before proceeding +with the cleanup in ssi_protocol_remove(). + +Signed-off-by: Kaixin Wang +Acked-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240918120749.1730-1-kxwang23@m.fudan.edu.cn +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hsi/clients/ssi_protocol.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hsi/clients/ssi_protocol.c ++++ b/drivers/hsi/clients/ssi_protocol.c +@@ -403,6 +403,7 @@ static void ssip_reset(struct hsi_client + del_timer(&ssi->rx_wd); + del_timer(&ssi->tx_wd); + del_timer(&ssi->keep_alive); ++ cancel_work_sync(&ssi->work); + ssi->main_state = 0; + ssi->send_state = 0; + ssi->recv_state = 0; diff --git a/queue-5.15/series b/queue-5.15/series index 06a229d421..621c39f65f 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -112,6 +112,7 @@ of-irq-fix-device-node-refcount-leakages-in-of_irq_init.patch pci-brcmstb-fix-missing-of_node_put-in-brcm_pcie_probe.patch pci-fix-reference-leak-in-pci_alloc_child_bus.patch pinctrl-qcom-clear-latched-interrupt-status-when-changing-irq-type.patch +hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch arm64-errata-add-newer-arm-cores-to-the-spectre_bhb_loop_affected-lists.patch acpi-platform-profile-fix-cfi-violation-when-accessing-sysfs-files.patch x86-e820-fix-handling-of-subpage-regions-when-calculating-nosave-ranges-in-e820__register_nosave_regions.patch