Ziyang Xuan 632881680b can: bcm: fix UAF of bcm op ... Stopping tasklet and hrtimer rely on the active state of tasklet and hrtimer sequentially in bcm_remove_op(), the op object will be freed if they are all unactive. Assume the hrtimer timeout is short, the hrtimer cb has been excuted after tasklet conditional judgment which must be false after last round tasklet_kill() and before condition hrtimer_active(), it is false when execute to hrtimer_active(). Bug is triggerd, because the stopping action is end and the op object will be freed, but the tasklet is scheduled. The resources of the op object will occur UAF bug. Move hrtimer_cancel() behind tasklet_kill() and switch 'while () {...}' to 'do {...} while ()' to fix the op UAF problem. Fixes: a06393ed03 ("can: bcm: fix hrtimer/tasklet termination in bcm op removal") Reported-by: syzbot+5ca851459ed04c778d1d@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com> Acked-by: Oliver Hartkopp <socketcan@hartkopp.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-01-29 10:17:06 +01:00
..
af_can.c	can: af_can: prevent potential access of uninitialized member in canfd_rcv()	2020-11-24 13:05:47 +01:00
af_can.h	can: complete initial namespace support	2017-04-25 09:04:29 +02:00
bcm.c	can: bcm: fix UAF of bcm op	2022-01-29 10:17:06 +01:00
gw.c	can: gw: synchronize rcu operations before removing gw job entry	2021-07-20 16:17:29 +02:00
Kconfig
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
proc.c	can: proc: can_remove_proc(): silence remove_proc_entry warning	2020-11-22 10:00:25 +01:00
raw.c	can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF	2021-08-04 12:22:15 +02:00