Drop 0102-patch-5.14-can-j1939-j1939_netdev_start-fix-UAF-for-rx_kref-of-.patch as it is already in RHEL upstream

i9-aarch64 changed/i9/kernel-5.14.0-427.28.1.el9_4
Arkady L. Shane 5 months ago
parent 4df70f69f7
commit cec13d6242
Signed by: tigro
GPG Key ID: 1EC08A25C9DB2503

@ -1,70 +0,0 @@
can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
It will trigger UAF for rx_kref of j1939_priv as following.
cpu0 cpu1
j1939_sk_bind(socket0, ndev0, ...)
j1939_netdev_start
j1939_sk_bind(socket1, ndev0, ...)
j1939_netdev_start
j1939_priv_set
j1939_priv_get_by_ndev_locked
j1939_jsk_add
.....
j1939_netdev_stop
kref_put_lock(&priv->rx_kref, ...)
kref_get(&priv->rx_kref, ...)
REFCOUNT_WARN("addition on 0;...")
====================================================
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0
RIP: 0010:refcount_warn_saturate+0x169/0x1e0
Call Trace:
j1939_netdev_start+0x68b/0x920
j1939_sk_bind+0x426/0xeb0
? security_socket_bind+0x83/0xb0
The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to
protect.
Fixes: 9d71dd0c70099 ("can: add support of SAE J1939 protocol")
Link: https://lore.kernel.org/all/20210926104757.2021540-1-william.xuanziyang@huawei.com
Cc: stable@vger.kernel.org
Reported-by: syzbot+85d9878b19c94f9019ad@syzkaller.appspotmail.com
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
diff -ruN linux-5.14.0-427.18.orig/net/can/j1939/main.c linux-5.14.0-427.18/net/can/j1939/main.c
index 0e9af9075..0cf84b7e5 100644
--- linux-5.14.0-427.18.orig/net/can/j1939/main.c
+++ linux-5.14.0-427.18/net/can/j1939/main.c
@@ -253,11 +253,14 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
struct j1939_priv *priv, *priv_new;
int ret;
- priv = j1939_priv_get_by_ndev(ndev);
+ spin_lock(&j1939_netdev_lock);
+ priv = j1939_priv_get_by_ndev_locked(ndev);
if (priv) {
kref_get(&priv->rx_kref);
+ spin_unlock(&j1939_netdev_lock);
return priv;
}
+ spin_unlock(&j1939_netdev_lock);
priv = j1939_priv_create(ndev);
if (!priv)
@@ -273,10 +276,10 @@ struct j1939_priv *j1939_netdev_start(struct net_device *ndev)
/* Someone was faster than us, use their priv and roll
* back our's.
*/
+ kref_get(&priv_new->rx_kref);
spin_unlock(&j1939_netdev_lock);
dev_put(ndev);
kfree(priv);
- kref_get(&priv_new->rx_kref);
return priv_new;
}
j1939_priv_set(ndev, priv);

@ -958,7 +958,6 @@ Patch2007: 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch
# Backported by Inferit # Backported by Inferit
Patch3001: 0101-patch-5.14-bluetooth-hci_sysfs-Fix-attempting-to-call-device_ad.patch Patch3001: 0101-patch-5.14-bluetooth-hci_sysfs-Fix-attempting-to-call-device_ad.patch
Patch3002: 0102-patch-5.14-can-j1939-j1939_netdev_start-fix-UAF-for-rx_kref-of-.patch
# Inferit hardware support # Inferit hardware support
Patch3101: 0201-5.14.0-mic-fix.patch Patch3101: 0201-5.14.0-mic-fix.patch
@ -1698,7 +1697,6 @@ ApplyPatch 0006-Bring-back-deprecated-pci-ids-to-qla4xxx-driver.patch
ApplyPatch 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch ApplyPatch 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch
ApplyPatch 0101-patch-5.14-bluetooth-hci_sysfs-Fix-attempting-to-call-device_ad.patch ApplyPatch 0101-patch-5.14-bluetooth-hci_sysfs-Fix-attempting-to-call-device_ad.patch
ApplyPatch 0102-patch-5.14-can-j1939-j1939_netdev_start-fix-UAF-for-rx_kref-of-.patch
ApplyPatch 0201-5.14.0-mic-fix.patch ApplyPatch 0201-5.14.0-mic-fix.patch
ApplyOptionalPatch patch-%{patchversion}-redhat.patch ApplyOptionalPatch patch-%{patchversion}-redhat.patch

Loading…
Cancel
Save