5.11-stable patches

added patches:
	net-qrtr-avoid-potential-use-after-free-in-mhi-send.patch

diff --git a/queue-5.11/net-qrtr-avoid-potential-use-after-free-in-mhi-send.patch b/queue-5.11/net-qrtr-avoid-potential-use-after-free-in-mhi-send.patch
new file mode 100644 (file)
index 0000000..d74ede3
--- /dev/null
+++ b/queue-5.11/net-qrtr-avoid-potential-use-after-free-in-mhi-send.patch
@@ -0,0 +1,53 @@
+From 47a017f33943278570c072bc71681809b2567b3a Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Wed, 21 Apr 2021 10:40:07 -0700
+Subject: net: qrtr: Avoid potential use after free in MHI send
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+commit 47a017f33943278570c072bc71681809b2567b3a upstream.
+
+It is possible that the MHI ul_callback will be invoked immediately
+following the queueing of the skb for transmission, leading to the
+callback decrementing the refcount of the associated sk and freeing the
+skb.
+
+As such the dereference of skb and the increment of the sk refcount must
+happen before the skb is queued, to avoid the skb to be used after free
+and potentially the sk to drop its last refcount..
+
+Fixes: 6e728f321393 ("net: qrtr: Add MHI transport layer")
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/qrtr/mhi.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/net/qrtr/mhi.c
++++ b/net/qrtr/mhi.c
+@@ -50,6 +50,9 @@ static int qcom_mhi_qrtr_send(struct qrt
+       struct qrtr_mhi_dev *qdev = container_of(ep, struct qrtr_mhi_dev, ep);
+       int rc;
+ 
++      if (skb->sk)
++              sock_hold(skb->sk);
++
+       rc = skb_linearize(skb);
+       if (rc)
+               goto free_skb;
+@@ -59,12 +62,11 @@ static int qcom_mhi_qrtr_send(struct qrt
+       if (rc)
+               goto free_skb;
+ 
+-      if (skb->sk)
+-              sock_hold(skb->sk);
+-
+       return rc;
+ 
+ free_skb:
++      if (skb->sk)
++              sock_put(skb->sk);
+       kfree_skb(skb);
+ 
+       return rc;

diff --git a/queue-5.11/series b/queue-5.11/series
index 13973ddbe68273d60ab278a29d27b8caefbd9e23..4fb4b4b89baa9ac17717b8ad1d0cf1e729addaa7 100644 (file)
--- a/queue-5.11/series
+++ b/queue-5.11/series
@@ -5,3 +5,4 @@ drm-i915-disable-runtime-power-management-during-shutdown.patch
 igb-enable-rss-for-intel-i211-ethernet-controller.patch
 bpf-fix-masking-negation-logic-upon-negative-dst-register.patch
 bpf-fix-leakage-of-uninitialized-bpf-stack-under-speculation.patch
+net-qrtr-avoid-potential-use-after-free-in-mhi-send.patch