From 0ca2c85be4e7e8f6a56931d93fc37d46c09732b9 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 18 Apr 2025 16:21:09 +0200 Subject: [PATCH] 5.4-stable patches added patches: hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch --- ...rotocol-driver-due-to-race-condition.patch | 49 +++++++++++++++++++ queue-5.4/series | 1 + 2 files changed, 50 insertions(+) create mode 100644 queue-5.4/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch diff --git a/queue-5.4/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch b/queue-5.4/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch new file mode 100644 index 0000000000..ecb6bf5d9f --- /dev/null +++ b/queue-5.4/hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch @@ -0,0 +1,49 @@ +From e3f88665a78045fe35c7669d2926b8d97b892c11 Mon Sep 17 00:00:00 2001 +From: Kaixin Wang +Date: Wed, 18 Sep 2024 20:07:50 +0800 +Subject: HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition + +From: Kaixin Wang + +commit e3f88665a78045fe35c7669d2926b8d97b892c11 upstream. + +In the ssi_protocol_probe() function, &ssi->work is bound with +ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function +within the ssip_pn_ops structure is capable of starting the +work. + +If we remove the module which will call ssi_protocol_remove() +to make a cleanup, it will free ssi through kfree(ssi), +while the work mentioned above will be used. The sequence +of operations that may lead to a UAF bug is as follows: + +CPU0 CPU1 + + | ssip_xmit_work +ssi_protocol_remove | +kfree(ssi); | + | struct hsi_client *cl = ssi->cl; + | // use ssi + +Fix it by ensuring that the work is canceled before proceeding +with the cleanup in ssi_protocol_remove(). + +Signed-off-by: Kaixin Wang +Acked-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20240918120749.1730-1-kxwang23@m.fudan.edu.cn +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hsi/clients/ssi_protocol.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hsi/clients/ssi_protocol.c ++++ b/drivers/hsi/clients/ssi_protocol.c +@@ -403,6 +403,7 @@ static void ssip_reset(struct hsi_client + del_timer(&ssi->rx_wd); + del_timer(&ssi->tx_wd); + del_timer(&ssi->keep_alive); ++ cancel_work_sync(&ssi->work); + ssi->main_state = 0; + ssi->send_state = 0; + ssi->recv_state = 0; diff --git a/queue-5.4/series b/queue-5.4/series index 9346d20179..42e1116732 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -79,3 +79,4 @@ pci-fix-reference-leak-in-pci_alloc_child_bus.patch x86-e820-fix-handling-of-subpage-regions-when-calculating-nosave-ranges-in-e820__register_nosave_regions.patch bluetooth-hci_uart-fix-another-race-during-initialization.patch pwm-mediatek-always-use-bus-clock-for-pwm-on-mt7622.patch +hsi-ssi_protocol-fix-use-after-free-vulnerability-in-ssi_protocol-driver-due-to-race-condition.patch -- 2.47.3