forked from rpms/kernel
i9-aarch64
changed/i9/kernel-5.14.0-427.22.1.el9_4.1
parent
cb71960583
commit
54cd799122
GPG Key ID:
D87CBBC16D2E4A72
@ -0,0 +1,51 @@
|
||||
bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
|
||||
|
||||
device_add shall not be called multiple times as stated in its
|
||||
documentation:
|
||||
|
||||
'Do not call this routine or device_register() more than once for
|
||||
any device structure'
|
||||
|
||||
Syzkaller reports a bug as follows [1]:
|
||||
------------[ cut here ]------------
|
||||
kernel BUG at lib/list_debug.c:33!
|
||||
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
|
||||
[...]
|
||||
Call Trace:
|
||||
<TASK>
|
||||
__list_add include/linux/list.h:69 [inline]
|
||||
list_add_tail include/linux/list.h:102 [inline]
|
||||
kobj_kset_join lib/kobject.c:164 [inline]
|
||||
kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214
|
||||
kobject_add_varg lib/kobject.c:358 [inline]
|
||||
kobject_add+0x150/0x1c0 lib/kobject.c:410
|
||||
device_add+0x368/0x1e90 drivers/base/core.c:3452
|
||||
hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53
|
||||
hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799
|
||||
hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110
|
||||
hci_event_func net/bluetooth/hci_event.c:7440 [inline]
|
||||
hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495
|
||||
hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007
|
||||
process_one_work+0x991/0x1610 kernel/workqueue.c:2289
|
||||
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
|
||||
kthread+0x2e4/0x3a0 kernel/kthread.c:376
|
||||
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
|
||||
</TASK>
|
||||
|
||||
Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a
|
||||
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
|
||||
Tested-by: Hawkins Jiawei <yin31149@gmail.com>
|
||||
---
|
||||
diff -ruN linux-5.14.0-427.18.orig/net/bluetooth/hci_sysfs.c linux-5.14.0-427.18/net/bluetooth/hci_sysfs.c
|
||||
--- linux-5.14.0-427.18.orig/net/bluetooth/hci_sysfs.c
|
||||
+++ linux-5.14.0-427.18/net/bluetooth/hci_sysfs.c
|
||||
@@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
|
||||
|
||||
bt_dev_dbg(hdev, "conn %p", conn);
|
||||
|
||||
+ if (device_is_registered(&conn->dev))
|
||||
+ return;
|
||||
+
|
||||
if (device_is_registered(&conn->dev))
|
||||
return;
|
||||
|
||||
@ -0,0 +1,70 @@
|
||||
can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
|
||||
|
||||
It will trigger UAF for rx_kref of j1939_priv as following.
|
||||
|
||||
cpu0 cpu1
|
||||
j1939_sk_bind(socket0, ndev0, ...)
|
||||
j1939_netdev_start
|
||||
j1939_sk_bind(socket1, ndev0, ...)
|
||||
j1939_netdev_start
|
||||
j1939_priv_set
|
||||
j1939_priv_get_by_ndev_locked
|
||||
j1939_jsk_add
|
||||
.....
|
||||
j1939_netdev_stop
|
||||
kref_put_lock(&priv->rx_kref, ...)
|
||||
kref_get(&priv->rx_kref, ...)
|
||||
REFCOUNT_WARN("addition on 0;...")
|
||||
|
||||
====================================================
|
||||
refcount_t: addition on 0; use-after-free.
|
||||
WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0
|
||||
RIP: 0010:refcount_warn_saturate+0x169/0x1e0
|
||||
Call Trace:
|
||||
j1939_netdev_start+0x68b/0x920
|
||||
j1939_sk_bind+0x426/0xeb0
|
||||
? security_socket_bind+0x83/0xb0
|
||||
|
||||
The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to
|
||||
protect.
|
||||
|
||||
Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol")
|
||||
Link: https://lore.kernel.org/all/20210926104757.2021540-1-william.xuanziyang@huawei.com
|
||||
Cc: stable@vger.kernel.org
|
||||
Reported-by: syzbot+85d9878b19c94f9019ad@syzkaller.appspotmail.com
|
||||
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
|
||||
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
|
||||
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
|
||||
---
|
||||
diff -ruN linux-5.14.0-427.18.orig/net/can/j1939/main.c linux-5.14.0-427.18/net/can/j1939/main.c
|
||||
index 0e9af9075..0cf84b7e5 100644
|
||||
--- linux-5.14.0-427.18.orig/net/can/j1939/main.c
|
||||
+++ linux-5.14.0-427.18/net/can/j1939/main.c
|
||||
@@ -253,11 +253,14 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
|
||||
struct j1939_priv *priv, *priv_new;
|
||||
int ret;
|
||||
|
||||
- priv = j1939_priv_get_by_ndev(ndev);
|
||||
+ spin_lock(&j1939_netdev_lock);
|
||||
+ priv = j1939_priv_get_by_ndev_locked(ndev);
|
||||
if (priv) {
|
||||
kref_get(&priv->rx_kref);
|
||||
+ spin_unlock(&j1939_netdev_lock);
|
||||
return priv;
|
||||
}
|
||||
+ spin_unlock(&j1939_netdev_lock);
|
||||
|
||||
priv = j1939_priv_create(ndev);
|
||||
if (!priv)
|
||||
@@ -273,10 +276,10 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
|
||||
/* Someone was faster than us, use their priv and roll
|
||||
* back our's.
|
||||
*/
|
||||
+ kref_get(&priv_new->rx_kref);
|
||||
spin_unlock(&j1939_netdev_lock);
|
||||
dev_put(ndev);
|
||||
kfree(priv);
|
||||
- kref_get(&priv_new->rx_kref);
|
||||
return priv_new;
|
||||
}
|
||||
j1939_priv_set(ndev, priv);
|
||||
@ -0,0 +1,12 @@
|
||||
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
|
||||
index e8209178d..79ddaf58c 100644
|
||||
--- a/sound/pci/hda/patch_conexant.c
|
||||
+++ b/sound/pci/hda/patch_conexant.c
|
||||
@@ -967,6 +967,7 @@
|
||||
SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE),
|
||||
SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE),
|
||||
SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
|
||||
+ SND_PCI_QUIRK(0x14f1, 0x0226, "Inferit Compact", CXT_FIXUP_HP_GATE_MIC),
|
||||
SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
|
||||
SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
|
||||
SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
|
||||
Loading…
Reference in new issue