From: Greg Kroah-Hartman Date: Wed, 28 Dec 2022 13:41:46 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v5.15.86~25 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dd94c0f948095822ba5f988f04ba80ed8d064025;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: media-dvbdev-fix-refcnt-bug.patch --- diff --git a/queue-4.14/media-dvbdev-fix-refcnt-bug.patch b/queue-4.14/media-dvbdev-fix-refcnt-bug.patch new file mode 100644 index 00000000000..5a9effcd738 --- /dev/null +++ b/queue-4.14/media-dvbdev-fix-refcnt-bug.patch @@ -0,0 +1,63 @@ +From 3a664569b71b0a52be5ffb9fb87cc4f83d29bd71 Mon Sep 17 00:00:00 2001 +From: Lin Ma +Date: Mon, 28 Nov 2022 16:21:59 +0000 +Subject: media: dvbdev: fix refcnt bug + +From: Lin Ma + +commit 3a664569b71b0a52be5ffb9fb87cc4f83d29bd71 upstream. + +Previous commit initialize the dvbdev->ref before the template copy, +which will overwrite the reference and cause refcnt bug. + +refcount_t: addition on 0; use-after-free. +WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25 +Modules linked in: +CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc6-next-20221128-syzkaller #0 +... +RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25 +RSP: 0000:ffffc900000678d0 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +RDX: ffff88813ff58000 RSI: ffffffff81660e7c RDI: fffff5200000cf0c +RBP: ffff888022a45010 R08: 0000000000000005 R09: 0000000000000000 +R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 +FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: ffff88823ffff000 CR3: 000000000c48e000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + __refcount_add include/linux/refcount.h:199 [inline] + __refcount_inc include/linux/refcount.h:250 [inline] + refcount_inc include/linux/refcount.h:267 [inline] + kref_get include/linux/kref.h:45 [inline] + dvb_device_get drivers/media/dvb-core/dvbdev.c:585 [inline] + dvb_register_device+0xe83/0x16e0 drivers/media/dvb-core/dvbdev.c:517 +... + +Just place the kref_init at correct position. + +Reported-by: syzbot+fce48a3dd3368645bd6c@syzkaller.appspotmail.com +Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF") +Signed-off-by: Lin Ma +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/dvb-core/dvbdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -465,8 +465,8 @@ int dvb_register_device(struct dvb_adapt + return -ENOMEM; + } + +- kref_init(&dvbdev->ref); + memcpy(dvbdev, template, sizeof(struct dvb_device)); ++ kref_init(&dvbdev->ref); + dvbdev->type = type; + dvbdev->id = id; + dvbdev->adapter = adap; diff --git a/queue-4.14/series b/queue-4.14/series index 41907618b87..98b86aea983 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -261,3 +261,4 @@ hid-wacom-ensure-bootloader-pid-is-usable-in-hidraw-mode.patch reiserfs-add-missing-calls-to-reiserfs_security_free.patch iio-adc-ad_sigma_delta-do-not-use-internal-iio_dev-lock.patch gcov-add-support-for-checksum-field.patch +media-dvbdev-fix-refcnt-bug.patch