diff --git a/SOURCES/0102-patch-5.14-can-j1939-j1939_netdev_start-fix-UAF-for-rx_kref-of-.patch b/SOURCES/0102-patch-5.14-can-j1939-j1939_netdev_start-fix-UAF-for-rx_kref-of-.patch deleted file mode 100644 index 5a97bd9..0000000 --- a/SOURCES/0102-patch-5.14-can-j1939-j1939_netdev_start-fix-UAF-for-rx_kref-of-.patch +++ /dev/null @@ -1,70 +0,0 @@ -can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv - -It will trigger UAF for rx_kref of j1939_priv as following. - - cpu0 cpu1 -j1939_sk_bind(socket0, ndev0, ...) -j1939_netdev_start - j1939_sk_bind(socket1, ndev0, ...) - j1939_netdev_start -j1939_priv_set - j1939_priv_get_by_ndev_locked -j1939_jsk_add -..... -j1939_netdev_stop -kref_put_lock(&priv->rx_kref, ...) - kref_get(&priv->rx_kref, ...) - REFCOUNT_WARN("addition on 0;...") - -==================================================== -refcount_t: addition on 0; use-after-free. -WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 -RIP: 0010:refcount_warn_saturate+0x169/0x1e0 -Call Trace: - j1939_netdev_start+0x68b/0x920 - j1939_sk_bind+0x426/0xeb0 - ? security_socket_bind+0x83/0xb0 - -The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to -protect. - -Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol") -Link: https://lore.kernel.org/all/20210926104757.2021540-1-william.xuanziyang@huawei.com -Cc: stable@vger.kernel.org -Reported-by: syzbot+85d9878b19c94f9019ad@syzkaller.appspotmail.com -Signed-off-by: Ziyang Xuan -Acked-by: Oleksij Rempel -Signed-off-by: Marc Kleine-Budde ---- -diff -ruN linux-5.14.0-427.18.orig/net/can/j1939/main.c linux-5.14.0-427.18/net/can/j1939/main.c -index 0e9af9075..0cf84b7e5 100644 ---- linux-5.14.0-427.18.orig/net/can/j1939/main.c -+++ linux-5.14.0-427.18/net/can/j1939/main.c -@@ -253,11 +253,14 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev) - struct j1939_priv *priv, *priv_new; - int ret; - -- priv = j1939_priv_get_by_ndev(ndev); -+ spin_lock(&j1939_netdev_lock); -+ priv = j1939_priv_get_by_ndev_locked(ndev); - if (priv) { - kref_get(&priv->rx_kref); -+ spin_unlock(&j1939_netdev_lock); - return priv; - } -+ spin_unlock(&j1939_netdev_lock); - - priv = j1939_priv_create(ndev); - if (!priv) -@@ -273,10 +276,10 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev) - /* Someone was faster than us, use their priv and roll - * back our's. - */ -+ kref_get(&priv_new->rx_kref); - spin_unlock(&j1939_netdev_lock); - dev_put(ndev); - kfree(priv); -- kref_get(&priv_new->rx_kref); - return priv_new; - } - j1939_priv_set(ndev, priv); diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 73bcb0d..3debebf 100755 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -958,7 +958,6 @@ Patch2007: 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch # Backported by Inferit Patch3001: 0101-patch-5.14-bluetooth-hci_sysfs-Fix-attempting-to-call-device_ad.patch -Patch3002: 0102-patch-5.14-can-j1939-j1939_netdev_start-fix-UAF-for-rx_kref-of-.patch # Inferit hardware support Patch3101: 0201-5.14.0-mic-fix.patch @@ -1698,7 +1697,6 @@ ApplyPatch 0006-Bring-back-deprecated-pci-ids-to-qla4xxx-driver.patch ApplyPatch 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch ApplyPatch 0101-patch-5.14-bluetooth-hci_sysfs-Fix-attempting-to-call-device_ad.patch -ApplyPatch 0102-patch-5.14-can-j1939-j1939_netdev_start-fix-UAF-for-rx_kref-of-.patch ApplyPatch 0201-5.14.0-mic-fix.patch ApplyOptionalPatch patch-%{patchversion}-redhat.patch