forked from rpms/kernel
Drop 0102-patch-5.14-can-j1939-j1939_netdev_start-fix-UAF-for-rx_kref-of-.patch as it is already in RHEL upstream
parent
4df70f69f7
commit
cec13d6242
GPG Key ID:
1EC08A25C9DB2503
@ -1,70 +0,0 @@
|
||||
can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
|
||||
|
||||
It will trigger UAF for rx_kref of j1939_priv as following.
|
||||
|
||||
cpu0 cpu1
|
||||
j1939_sk_bind(socket0, ndev0, ...)
|
||||
j1939_netdev_start
|
||||
j1939_sk_bind(socket1, ndev0, ...)
|
||||
j1939_netdev_start
|
||||
j1939_priv_set
|
||||
j1939_priv_get_by_ndev_locked
|
||||
j1939_jsk_add
|
||||
.....
|
||||
j1939_netdev_stop
|
||||
kref_put_lock(&priv->rx_kref, ...)
|
||||
kref_get(&priv->rx_kref, ...)
|
||||
REFCOUNT_WARN("addition on 0;...")
|
||||
|
||||
====================================================
|
||||
refcount_t: addition on 0; use-after-free.
|
||||
WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0
|
||||
RIP: 0010:refcount_warn_saturate+0x169/0x1e0
|
||||
Call Trace:
|
||||
j1939_netdev_start+0x68b/0x920
|
||||
j1939_sk_bind+0x426/0xeb0
|
||||
? security_socket_bind+0x83/0xb0
|
||||
|
||||
The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to
|
||||
protect.
|
||||
|
||||
Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol")
|
||||
Link: https://lore.kernel.org/all/20210926104757.2021540-1-william.xuanziyang@huawei.com
|
||||
Cc: stable@vger.kernel.org
|
||||
Reported-by: syzbot+85d9878b19c94f9019ad@syzkaller.appspotmail.com
|
||||
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
|
||||
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
|
||||
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
|
||||
---
|
||||
diff -ruN linux-5.14.0-427.18.orig/net/can/j1939/main.c linux-5.14.0-427.18/net/can/j1939/main.c
|
||||
index 0e9af9075..0cf84b7e5 100644
|
||||
--- linux-5.14.0-427.18.orig/net/can/j1939/main.c
|
||||
+++ linux-5.14.0-427.18/net/can/j1939/main.c
|
||||
@@ -253,11 +253,14 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
|
||||
struct j1939_priv *priv, *priv_new;
|
||||
int ret;
|
||||
|
||||
- priv = j1939_priv_get_by_ndev(ndev);
|
||||
+ spin_lock(&j1939_netdev_lock);
|
||||
+ priv = j1939_priv_get_by_ndev_locked(ndev);
|
||||
if (priv) {
|
||||
kref_get(&priv->rx_kref);
|
||||
+ spin_unlock(&j1939_netdev_lock);
|
||||
return priv;
|
||||
}
|
||||
+ spin_unlock(&j1939_netdev_lock);
|
||||
|
||||
priv = j1939_priv_create(ndev);
|
||||
if (!priv)
|
||||
@@ -273,10 +276,10 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
|
||||
/* Someone was faster than us, use their priv and roll
|
||||
* back our's.
|
||||
*/
|
||||
+ kref_get(&priv_new->rx_kref);
|
||||
spin_unlock(&j1939_netdev_lock);
|
||||
dev_put(ndev);
|
||||
kfree(priv);
|
||||
- kref_get(&priv_new->rx_kref);
|
||||
return priv_new;
|
||||
}
|
||||
j1939_priv_set(ndev, priv);
|
||||
Loading…
Reference in new issue