linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-07 00:59:06 +00:00

No description

Find a file

Lin Ma 67677050ce nfc: nci: add flush_workqueue to prevent uaf [ Upstream commit `ef27324e2c` ] Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 \| nci_dev_up() \| nci_open_device() \| __nci_request(nci_reset_req) \| nci_send_cmd \| queue_work(cmd_work) nci_unregister_device() \| nci_close_device() \| ... del_timer_sync(cmd_timer)[1] \| ... \| Worker nci_free_device() \| nci_cmd_work() kfree(ndev)[3] \| mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF. This UAF is easy to trigger, crash trace by POC is like below [ 66.703713] ================================================================== [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33 [ 66.703974] [ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5 [ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Call Trace: [ 66.703974] <TASK> [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] </TASK> [ 66.703974] [ 66.703974] Allocated by task 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 66.703974] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 66.703974] tty_ioctl+0x764/0x1310 [ 66.703974] __x64_sys_ioctl+0x122/0x190 [ 66.703974] do_syscall_64+0x3b/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae To fix the UAF, this patch adds flush_workqueue() to ensure the nci_cmd_work is finished before the following del_timer_sync. This combination will promise the timer is actually detached. Fixes: `6a2968aaf5` ("NFC: basic NCI protocol implementation") Signed-off-by: Lin Ma <linma@zju.edu.cn> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-04-20 09:23:18 +02:00
arch	cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function	2022-04-20 09:23:09 +02:00
block	Revert "Revert "block, bfq: honor already-setup queue merges""	2022-04-08 14:40:32 +02:00
certs	certs: Trigger creation of RSA module signing key if it's not an RSA key	2021-09-15 09:50:29 +02:00
crypto	crypto: authenc - Fix sleep in atomic context in decrypt_tail	2022-04-08 14:39:59 +02:00
Documentation	docs: sysctl/kernel: add missing bit to panic_print	2022-04-08 14:40:44 +02:00
drivers	scsi: iscsi: Fix conn cleanup and stop race during iscsid restart	2022-04-20 09:23:17 +02:00
fs	btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups()	2022-04-20 09:23:10 +02:00
include	scsi: iscsi: Fix conn cleanup and stop race during iscsid restart	2022-04-20 09:23:17 +02:00
init	init/main.c: return 1 from handled __setup() functions	2022-04-13 21:01:01 +02:00
ipc	shm: extend forced shm destroy to support objects from several IPC nses	2021-12-01 09:19:10 +01:00
kernel	cgroup: Use open-time credentials for process migraton perm checks	2022-04-13 21:01:10 +02:00
lib	ubsan: remove CONFIG_UBSAN_OBJECT_SIZE	2022-04-13 21:01:10 +02:00
LICENSES	LICENSES/deprecated: add Zlib license text	2020-09-16 14:33:49 +02:00
mm	mm: don't skip swap entry even if zap_details specified	2022-04-13 21:01:10 +02:00
net	nfc: nci: add flush_workqueue to prevent uaf	2022-04-20 09:23:18 +02:00
samples	samples/bpf, xdpsock: Fix race when running for fix duration of time	2022-04-08 14:40:21 +02:00
scripts	ubsan: remove CONFIG_UBSAN_OBJECT_SIZE	2022-04-13 21:01:10 +02:00
security	Fix incorrect type in assignment of ipv6 port for audit	2022-04-08 14:40:31 +02:00
sound	ASoC: topology: Allow TLV control to be either read or write	2022-04-08 14:40:44 +02:00
tools	perf tools: Fix misleading add event PMU debug message	2022-04-20 09:23:17 +02:00
usr	usr/include/Makefile: add linux/nfc.h to the compile-test coverage	2022-02-01 17:25:48 +01:00
virt	KVM: Prevent module exit until all VMs are freed	2022-04-08 14:40:38 +02:00
.clang-format	RDMA 5.10 pull request	2020-10-17 11:18:18 -07:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore	kbuild: generate Module.symvers only when vmlinux exists	2021-05-19 10:12:59 +02:00
.mailmap	mailmap: add two more addresses of Uwe Kleine-König	2020-12-06 10:19:07 -08:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Move Jason Cooper to CREDITS	2020-11-30 10:20:34 +01:00
Kbuild	kbuild: rename hostprogs-y/always to hostprogs/always-y	2020-02-04 01:53:07 +09:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	MAINTAINERS: adjust GCC PLUGINS after gcc-plugin.sh removal	2021-12-14 11:32:46 +01:00
Makefile	Linux 5.10.111	2022-04-13 21:01:11 +02:00
README

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.