[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-can
Subject:    Re: [PATCH 4.9] can: bcm: fix UAF of bcm op
From:       Greg KH <gregkh () linuxfoundation ! org>
Date:       2022-01-29 11:41:51
Message-ID: YfUn/++keVx5/ez/ () kroah ! com
[Download RAW message or body]

On Fri, Jan 28, 2022 at 02:40:54PM +0800, Ziyang Xuan wrote:
> Stopping tasklet and hrtimer rely on the active state of tasklet and
> hrtimer sequentially in bcm_remove_op(), the op object will be freed
> if they are all unactive. Assume the hrtimer timeout is short, the
> hrtimer cb has been excuted after tasklet conditional judgment which
> must be false after last round tasklet_kill() and before condition
> hrtimer_active(), it is false when execute to hrtimer_active(). Bug
> is triggerd, because the stopping action is end and the op object
> will be freed, but the tasklet is scheduled. The resources of the op
> object will occur UAF bug.
> 
> Move hrtimer_cancel() behind tasklet_kill() and switch 'while () {...}'
> to 'do {...} while ()' to fix the op UAF problem.
> 
> Fixes: a06393ed0316 ("can: bcm: fix hrtimer/tasklet termination in bcm op removal")
> Reported-by: syzbot+5ca851459ed04c778d1d@syzkaller.appspotmail.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
> ---
>  net/can/bcm.c | 20 ++++++++++----------
>  1 file changed, 10 insertions(+), 10 deletions(-)

Both now queued up, thanks.

greg k-h
[prev in list] [next in list] [prev in thread] [next in thread]