git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From e3f88665a78045fe35c7669d2926b8d97b892c11 Mon Sep 17 00:00:00 2001
   2 From: Kaixin Wang <kxwang23@m.fudan.edu.cn>
   3 Date: Wed, 18 Sep 2024 20:07:50 +0800
   4 Subject: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
   5
   6 From: Kaixin Wang <kxwang23@m.fudan.edu.cn>
   7
   8 commit e3f88665a78045fe35c7669d2926b8d97b892c11 upstream.
   9
  10 In the ssi_protocol_probe() function, &ssi->work is bound with
  11 ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function
  12 within the ssip_pn_ops structure is capable of starting the
  13 work.
  14
  15 If we remove the module which will call ssi_protocol_remove()
  16 to make a cleanup, it will free ssi through kfree(ssi),
  17 while the work mentioned above will be used. The sequence
  18 of operations that may lead to a UAF bug is as follows:
  19
  20 CPU0                                    CPU1
  21
  22                         | ssip_xmit_work
  23 ssi_protocol_remove     |
  24 kfree(ssi);             |
  25                         | struct hsi_client *cl = ssi->cl;
  26                         | // use ssi
  27
  28 Fix it by ensuring that the work is canceled before proceeding
  29 with the cleanup in ssi_protocol_remove().
  30
  31 Signed-off-by: Kaixin Wang <kxwang23@m.fudan.edu.cn>
  32 Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
  33 Link: https://lore.kernel.org/r/20240918120749.1730-1-kxwang23@m.fudan.edu.cn
  34 Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
  35 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  36 ---
  37  drivers/hsi/clients/ssi_protocol.c |    1 +
  38  1 file changed, 1 insertion(+)
  39
  40 --- a/drivers/hsi/clients/ssi_protocol.c
  41 +++ b/drivers/hsi/clients/ssi_protocol.c
  42 @@ -403,6 +403,7 @@ static void ssip_reset(struct hsi_client
  43         del_timer(&ssi->rx_wd);
  44         del_timer(&ssi->tx_wd);
  45         del_timer(&ssi->keep_alive);
  46 +       cancel_work_sync(&ssi->work);
  47         ssi->main_state = 0;
  48         ssi->send_state = 0;
  49         ssi->recv_state = 0;