From: Greg Kroah-Hartman Date: Wed, 4 Oct 2023 14:12:24 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v6.5.6~27 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=80565eeddba6407e4902e9dd4ed35570fec98998;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: nilfs2-fix-potential-use-after-free-in-nilfs_gccache_submit_read_data.patch revert-tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch serial-8250_port-check-irq-data-before-use.patch --- diff --git a/queue-5.10/nilfs2-fix-potential-use-after-free-in-nilfs_gccache_submit_read_data.patch b/queue-5.10/nilfs2-fix-potential-use-after-free-in-nilfs_gccache_submit_read_data.patch new file mode 100644 index 00000000000..095d33a0d7a --- /dev/null +++ b/queue-5.10/nilfs2-fix-potential-use-after-free-in-nilfs_gccache_submit_read_data.patch @@ -0,0 +1,61 @@ +From 7ee29facd8a9c5a26079148e36bcf07141b3a6bc Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Thu, 21 Sep 2023 23:17:31 +0900 +Subject: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() + +From: Pan Bian + +commit 7ee29facd8a9c5a26079148e36bcf07141b3a6bc upstream. + +In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the +reference count of bh when the call to nilfs_dat_translate() fails. If +the reference count hits 0 and its owner page gets unlocked, bh may be +freed. However, bh->b_page is dereferenced to put the page after that, +which may result in a use-after-free bug. This patch moves the release +operation after unlocking and putting the page. + +NOTE: The function in question is only called in GC, and in combination +with current userland tools, address translation using DAT does not occur +in that function, so the code path that causes this issue will not be +executed. However, it is possible to run that code path by intentionally +modifying the userland GC library or by calling the GC ioctl directly. + +[konishi.ryusuke@gmail.com: NOTE added to the commit log] +Link: https://lkml.kernel.org/r/1543201709-53191-1-git-send-email-bianpan2016@163.com +Link: https://lkml.kernel.org/r/20230921141731.10073-1-konishi.ryusuke@gmail.com +Fixes: a3d93f709e89 ("nilfs2: block cache for garbage collection") +Signed-off-by: Pan Bian +Reported-by: Ferry Meng +Closes: https://lkml.kernel.org/r/20230818092022.111054-1-mengferry@linux.alibaba.com +Signed-off-by: Ryusuke Konishi +Tested-by: Ryusuke Konishi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/gcinode.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/nilfs2/gcinode.c ++++ b/fs/nilfs2/gcinode.c +@@ -73,10 +73,8 @@ int nilfs_gccache_submit_read_data(struc + struct the_nilfs *nilfs = inode->i_sb->s_fs_info; + + err = nilfs_dat_translate(nilfs->ns_dat, vbn, &pbn); +- if (unlikely(err)) { /* -EIO, -ENOMEM, -ENOENT */ +- brelse(bh); ++ if (unlikely(err)) /* -EIO, -ENOMEM, -ENOENT */ + goto failed; +- } + } + + lock_buffer(bh); +@@ -102,6 +100,8 @@ int nilfs_gccache_submit_read_data(struc + failed: + unlock_page(bh->b_page); + put_page(bh->b_page); ++ if (unlikely(err)) ++ brelse(bh); + return err; + } + diff --git a/queue-5.10/revert-tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch b/queue-5.10/revert-tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch new file mode 100644 index 00000000000..7b078a663cd --- /dev/null +++ b/queue-5.10/revert-tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch @@ -0,0 +1,68 @@ +From 29346e217b8ab8a52889b88f00b268278d6b7668 Mon Sep 17 00:00:00 2001 +From: Daniel Starke +Date: Thu, 14 Sep 2023 07:15:07 +0200 +Subject: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" + +From: Daniel Starke + +commit 29346e217b8ab8a52889b88f00b268278d6b7668 upstream. + +This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239. + +The commit above is reverted as it did not solve the original issue. + +gsm_cleanup_mux() tries to free up the virtual ttys by calling +gsm_dlci_release() for each available DLCI. There, dlci_put() is called to +decrease the reference counter for the DLCI via tty_port_put() which +finally calls gsm_dlci_free(). This already clears the pointer which is +being checked in gsm_cleanup_mux() before calling gsm_dlci_release(). +Therefore, it is not necessary to clear this pointer in gsm_cleanup_mux() +as done in the reverted commit. The commit introduces a null pointer +dereference: + + ? __die+0x1f/0x70 + ? page_fault_oops+0x156/0x420 + ? search_exception_tables+0x37/0x50 + ? fixup_exception+0x21/0x310 + ? exc_page_fault+0x69/0x150 + ? asm_exc_page_fault+0x26/0x30 + ? tty_port_put+0x19/0xa0 + gsmtty_cleanup+0x29/0x80 [n_gsm] + release_one_tty+0x37/0xe0 + process_one_work+0x1e6/0x3e0 + worker_thread+0x4c/0x3d0 + ? __pfx_worker_thread+0x10/0x10 + kthread+0xe1/0x110 + ? __pfx_kthread+0x10/0x10 + ret_from_fork+0x2f/0x50 + ? __pfx_kthread+0x10/0x10 + ret_from_fork_asm+0x1b/0x30 + + +The actual issue is that nothing guards dlci_put() from being called +multiple times while the tty driver was triggered but did not yet finished +calling gsm_dlci_free(). + +Fixes: 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux") +Cc: stable +Signed-off-by: Daniel Starke +Link: https://lore.kernel.org/r/20230914051507.3240-1-daniel.starke@siemens.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/n_gsm.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -2179,10 +2179,8 @@ static void gsm_cleanup_mux(struct gsm_m + + /* Free up any link layer users and finally the control channel */ + for (i = NUM_DLCI - 1; i >= 0; i--) +- if (gsm->dlci[i]) { ++ if (gsm->dlci[i]) + gsm_dlci_release(gsm->dlci[i]); +- gsm->dlci[i] = NULL; +- } + mutex_unlock(&gsm->mutex); + /* Now wipe the queues */ + tty_ldisc_flush(gsm->tty); diff --git a/queue-5.10/serial-8250_port-check-irq-data-before-use.patch b/queue-5.10/serial-8250_port-check-irq-data-before-use.patch new file mode 100644 index 00000000000..dc991898b97 --- /dev/null +++ b/queue-5.10/serial-8250_port-check-irq-data-before-use.patch @@ -0,0 +1,49 @@ +From cce7fc8b29961b64fadb1ce398dc5ff32a79643b Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Fri, 1 Sep 2023 01:25:55 +0300 +Subject: serial: 8250_port: Check IRQ data before use + +From: Andy Shevchenko + +commit cce7fc8b29961b64fadb1ce398dc5ff32a79643b upstream. + +In case the leaf driver wants to use IRQ polling (irq = 0) and +IIR register shows that an interrupt happened in the 8250 hardware +the IRQ data can be NULL. In such a case we need to skip the wake +event as we came to this path from the timer interrupt and quite +likely system is already awake. + +Without this fix we have got an Oops: + + serial8250: ttyS0 at I/O 0x3f8 (irq = 0, base_baud = 115200) is a 16550A + ... + BUG: kernel NULL pointer dereference, address: 0000000000000010 + RIP: 0010:serial8250_handle_irq+0x7c/0x240 + Call Trace: + ? serial8250_handle_irq+0x7c/0x240 + ? __pfx_serial8250_timeout+0x10/0x10 + +Fixes: 0ba9e3a13c6a ("serial: 8250: Add missing wakeup event reporting") +Cc: stable +Signed-off-by: Andy Shevchenko +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230831222555.614426-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_port.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1914,7 +1914,10 @@ int serial8250_handle_irq(struct uart_po + skip_rx = true; + + if (status & (UART_LSR_DR | UART_LSR_BI) && !skip_rx) { +- if (irqd_is_wakeup_set(irq_get_irq_data(port->irq))) ++ struct irq_data *d; ++ ++ d = irq_get_irq_data(port->irq); ++ if (d && irqd_is_wakeup_set(d)) + pm_wakeup_event(tport->tty->dev, 0); + if (!up->dma || handle_rx_dma(up, iir)) + status = serial8250_rx_chars(up, status); diff --git a/queue-5.10/series b/queue-5.10/series index b7e158ab6be..15bd4a14db6 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -146,3 +146,6 @@ nvme-pci-always-return-an-err_ptr-from-nvme_pci_allo.patch smack-record-transmuting-in-smk_transmuted.patch smack-retrieve-transmuting-information-in-smack_inod.patch smack-use-overlay-inode-label-in-smack_inode_copy_up.patch +revert-tty-n_gsm-fix-uaf-in-gsm_cleanup_mux.patch +serial-8250_port-check-irq-data-before-use.patch +nilfs2-fix-potential-use-after-free-in-nilfs_gccache_submit_read_data.patch