From: Greg Kroah-Hartman Date: Fri, 18 Apr 2025 14:21:47 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.12.24~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=eaf913f0142c830ed0577ad7d9213e51f326919e;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch --- diff --git a/queue-6.6/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch b/queue-6.6/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch new file mode 100644 index 0000000000..adb5ef880f --- /dev/null +++ b/queue-6.6/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch @@ -0,0 +1,49 @@ +From e3f88665a78045fe35c7669d2926b8d97b892c11 Mon Sep 17 00:00:00 2001 +From: Kaixin Wang +Date: Wed, 18 Sep 2024 20:07:50 +0800 +Subject: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition + +From: Kaixin Wang + +commit e3f88665a78045fe35c7669d2926b8d97b892c11 upstream. + +In the ssi_protocol_probe() function, &ssi->work is bound with +ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function +within the ssip_pn_ops structure is capable of starting the +work. + +If we remove the module which will call ssi_protocol_remove() +to make a cleanup, it will free ssi through kfree(ssi), +while the work mentioned above will be used. The sequence +of operations that may lead to a UAF bug is as follows: + +CPU0 CPU1 + + | ssip_xmit_work +ssi_protocol_remove | +kfree(ssi); | + | struct hsi_client *cl = ssi->cl; + | // use ssi + +Fix it by ensuring that the work is canceled before proceeding +with the cleanup in ssi_protocol_remove(). + +Signed-off-by: Kaixin Wang +Acked-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240918120749.1730-1-kxwang23@m.fudan.edu.cn +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hsi/clients/ssi_protocol.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hsi/clients/ssi_protocol.c ++++ b/drivers/hsi/clients/ssi_protocol.c +@@ -401,6 +401,7 @@ static void ssip_reset(struct hsi_client + del_timer(&ssi->rx_wd); + del_timer(&ssi->tx_wd); + del_timer(&ssi->keep_alive); ++ cancel_work_sync(&ssi->work); + ssi->main_state = 0; + ssi->send_state = 0; + ssi->recv_state = 0; diff --git a/queue-6.6/series b/queue-6.6/series index 7fb83695cd..9d34d63d11 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -236,3 +236,4 @@ iommufd-fail-replace-if-device-has-not-been-attached.patch x86-e820-fix-handling-of-subpage-regions-when-calculating-nosave-ranges-in-e820__register_nosave_regions.patch media-mediatek-vcodec-mark-vdec_vp9_slice_map_counts_eob_coef-noinline.patch bluetooth-hci_uart-fix-another-race-during-initialization.patch +hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch