i9
changed/i9/kernel-5.14.0-427.22.1.el9_4.1
parent
cb71960583
commit
54cd799122
GPG Key ID:
D87CBBC16D2E4A72
@ -0,0 +1,51 @@
|
|||||||
|
bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
|
||||||
|
|
||||||
|
device_add shall not be called multiple times as stated in its
|
||||||
|
documentation:
|
||||||
|
|
||||||
|
'Do not call this routine or device_register() more than once for
|
||||||
|
any device structure'
|
||||||
|
|
||||||
|
Syzkaller reports a bug as follows [1]:
|
||||||
|
------------[ cut here ]------------
|
||||||
|
kernel BUG at lib/list_debug.c:33!
|
||||||
|
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
|
||||||
|
[...]
|
||||||
|
Call Trace:
|
||||||
|
<TASK>
|
||||||
|
__list_add include/linux/list.h:69 [inline]
|
||||||
|
list_add_tail include/linux/list.h:102 [inline]
|
||||||
|
kobj_kset_join lib/kobject.c:164 [inline]
|
||||||
|
kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214
|
||||||
|
kobject_add_varg lib/kobject.c:358 [inline]
|
||||||
|
kobject_add+0x150/0x1c0 lib/kobject.c:410
|
||||||
|
device_add+0x368/0x1e90 drivers/base/core.c:3452
|
||||||
|
hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53
|
||||||
|
hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799
|
||||||
|
hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110
|
||||||
|
hci_event_func net/bluetooth/hci_event.c:7440 [inline]
|
||||||
|
hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495
|
||||||
|
hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007
|
||||||
|
process_one_work+0x991/0x1610 kernel/workqueue.c:2289
|
||||||
|
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
|
||||||
|
kthread+0x2e4/0x3a0 kernel/kthread.c:376
|
||||||
|
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
|
||||||
|
</TASK>
|
||||||
|
|
||||||
|
Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a
|
||||||
|
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
|
||||||
|
Tested-by: Hawkins Jiawei <yin31149@gmail.com>
|
||||||
|
---
|
||||||
|
diff -ruN linux-5.14.0-427.18.orig/net/bluetooth/hci_sysfs.c linux-5.14.0-427.18/net/bluetooth/hci_sysfs.c
|
||||||
|
--- linux-5.14.0-427.18.orig/net/bluetooth/hci_sysfs.c
|
||||||
|
+++ linux-5.14.0-427.18/net/bluetooth/hci_sysfs.c
|
||||||
|
@@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
|
||||||
|
|
||||||
|
bt_dev_dbg(hdev, "conn %p", conn);
|
||||||
|
|
||||||
|
+ if (device_is_registered(&conn->dev))
|
||||||
|
+ return;
|
||||||
|
+
|
||||||
|
if (device_is_registered(&conn->dev))
|
||||||
|
return;
|
||||||
|
|
||||||
@ -0,0 +1,70 @@
|
|||||||
|
can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
|
||||||
|
|
||||||
|
It will trigger UAF for rx_kref of j1939_priv as following.
|
||||||
|
|
||||||
|
cpu0 cpu1
|
||||||
|
j1939_sk_bind(socket0, ndev0, ...)
|
||||||
|
j1939_netdev_start
|
||||||
|
j1939_sk_bind(socket1, ndev0, ...)
|
||||||
|
j1939_netdev_start
|
||||||
|
j1939_priv_set
|
||||||
|
j1939_priv_get_by_ndev_locked
|
||||||
|
j1939_jsk_add
|
||||||
|
.....
|
||||||
|
j1939_netdev_stop
|
||||||
|
kref_put_lock(&priv->rx_kref, ...)
|
||||||
|
kref_get(&priv->rx_kref, ...)
|
||||||
|
REFCOUNT_WARN("addition on 0;...")
|
||||||
|
|
||||||
|
====================================================
|
||||||
|
refcount_t: addition on 0; use-after-free.
|
||||||
|
WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0
|
||||||
|
RIP: 0010:refcount_warn_saturate+0x169/0x1e0
|
||||||
|
Call Trace:
|
||||||
|
j1939_netdev_start+0x68b/0x920
|
||||||
|
j1939_sk_bind+0x426/0xeb0
|
||||||
|
? security_socket_bind+0x83/0xb0
|
||||||
|
|
||||||
|
The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to
|
||||||
|
protect.
|
||||||
|
|
||||||
|
Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol")
|
||||||
|
Link: https://lore.kernel.org/all/20210926104757.2021540-1-william.xuanziyang@huawei.com
|
||||||
|
Cc: stable@vger.kernel.org
|
||||||
|
Reported-by: syzbot+85d9878b19c94f9019ad@syzkaller.appspotmail.com
|
||||||
|
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
|
||||||
|
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
|
||||||
|
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
|
||||||
|
---
|
||||||
|
diff -ruN linux-5.14.0-427.18.orig/net/can/j1939/main.c linux-5.14.0-427.18/net/can/j1939/main.c
|
||||||
|
index 0e9af9075..0cf84b7e5 100644
|
||||||
|
--- linux-5.14.0-427.18.orig/net/can/j1939/main.c
|
||||||
|
+++ linux-5.14.0-427.18/net/can/j1939/main.c
|
||||||
|
@@ -253,11 +253,14 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
|
||||||
|
struct j1939_priv *priv, *priv_new;
|
||||||
|
int ret;
|
||||||
|
|
||||||
|
- priv = j1939_priv_get_by_ndev(ndev);
|
||||||
|
+ spin_lock(&j1939_netdev_lock);
|
||||||
|
+ priv = j1939_priv_get_by_ndev_locked(ndev);
|
||||||
|
if (priv) {
|
||||||
|
kref_get(&priv->rx_kref);
|
||||||
|
+ spin_unlock(&j1939_netdev_lock);
|
||||||
|
return priv;
|
||||||
|
}
|
||||||
|
+ spin_unlock(&j1939_netdev_lock);
|
||||||
|
|
||||||
|
priv = j1939_priv_create(ndev);
|
||||||
|
if (!priv)
|
||||||
|
@@ -273,10 +276,10 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
|
||||||
|
/* Someone was faster than us, use their priv and roll
|
||||||
|
* back our's.
|
||||||
|
*/
|
||||||
|
+ kref_get(&priv_new->rx_kref);
|
||||||
|
spin_unlock(&j1939_netdev_lock);
|
||||||
|
dev_put(ndev);
|
||||||
|
kfree(priv);
|
||||||
|
- kref_get(&priv_new->rx_kref);
|
||||||
|
return priv_new;
|
||||||
|
}
|
||||||
|
j1939_priv_set(ndev, priv);
|
||||||
@ -0,0 +1,12 @@
|
|||||||
|
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
|
||||||
|
index e8209178d..79ddaf58c 100644
|
||||||
|
--- a/sound/pci/hda/patch_conexant.c
|
||||||
|
+++ b/sound/pci/hda/patch_conexant.c
|
||||||
|
@@ -967,6 +967,7 @@
|
||||||
|
SND_PCI_QUIRK(0x103c, 0x8457, "HP Z2 G4 mini", CXT_FIXUP_HP_MIC_NO_PRESENCE),
|
||||||
|
SND_PCI_QUIRK(0x103c, 0x8458, "HP Z2 G4 mini premium", CXT_FIXUP_HP_MIC_NO_PRESENCE),
|
||||||
|
SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
|
||||||
|
+ SND_PCI_QUIRK(0x14f1, 0x0226, "Inferit Compact", CXT_FIXUP_HP_GATE_MIC),
|
||||||
|
SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
|
||||||
|
SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
|
||||||
|
SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
|
||||||
Loading…
Reference in new issue