From 97b09c86aa85e766fded63e7b1ac3771bf10a6d4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 19 Jun 2024 14:14:48 +0200 Subject: [PATCH] 5.15-stable patches added patches: greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch --- ...erface_release-due-to-race-condition.patch | 52 +++++++++++++++++++ queue-5.15/series | 1 + 2 files changed, 53 insertions(+) create mode 100644 queue-5.15/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch diff --git a/queue-5.15/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch b/queue-5.15/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch new file mode 100644 index 00000000000..9dc97e274e3 --- /dev/null +++ b/queue-5.15/greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch @@ -0,0 +1,52 @@ +From 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce Mon Sep 17 00:00:00 2001 +From: Sicong Huang +Date: Tue, 16 Apr 2024 16:03:13 +0800 +Subject: greybus: Fix use-after-free bug in gb_interface_release due to race condition. + +From: Sicong Huang + +commit 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce upstream. + +In gb_interface_create, &intf->mode_switch_completion is bound with +gb_interface_mode_switch_work. Then it will be started by +gb_interface_request_mode_switch. Here is the relevant code. +if (!queue_work(system_long_wq, &intf->mode_switch_work)) { + ... +} + +If we call gb_interface_release to make cleanup, there may be an +unfinished work. This function will call kfree to free the object +"intf". However, if gb_interface_mode_switch_work is scheduled to +run after kfree, it may cause use-after-free error as +gb_interface_mode_switch_work will use the object "intf". +The possible execution flow that may lead to the issue is as follows: + +CPU0 CPU1 + + | gb_interface_create + | gb_interface_request_mode_switch +gb_interface_release | +kfree(intf) (free) | + | gb_interface_mode_switch_work + | mutex_lock(&intf->mutex) (use) + +Fix it by canceling the work before kfree. + +Signed-off-by: Sicong Huang +Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com +Cc: Ronnie Sahlberg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/greybus/interface.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/greybus/interface.c ++++ b/drivers/greybus/interface.c +@@ -694,6 +694,7 @@ static void gb_interface_release(struct + + trace_gb_interface_release(intf); + ++ cancel_work_sync(&intf->mode_switch_work); + kfree(intf); + } + diff --git a/queue-5.15/series b/queue-5.15/series index e47ac0a8146..afb73206a03 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -168,3 +168,4 @@ mptcp-pm-inc-rmaddr-mib-counter-once-per-rm_addr-id.patch mptcp-pm-update-add_addr-counters-after-connect.patch kbuild-remove-support-for-clang-s-thinlto-caching.patch remoteproc-k3-r5-jump-to-error-handling-labels-in-start-stop-errors.patch +greybus-fix-use-after-free-bug-in-gb_interface_release-due-to-race-condition.patch -- 2.47.3