linux-kernel - Re: [PATCH] RDMA/hns: Fix UAF for cq async event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e195d0ec-92a8-4ea4-a939-31f6d5b7ef7b@windriver.com>
Date: Fri, 20 Sep 2024 21:02:58 +0800
From: "Yan, Haixiao (CN)" <haixiao.yan.cn@...driver.com>
To: Jason Gunthorpe <jgg@...pe.ca>
Cc: liangwenpeng@...wei.com, liweihang@...wei.com, dledford@...hat.com,
        linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH] RDMA/hns: Fix UAF for cq async event

Add Greg in the loop. Thanks.

On 9/20/2024 8:57 PM, Jason Gunthorpe wrote:
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
> On Fri, Sep 20, 2024 at 08:45:40PM +0800, haixiao.yan.cn@...driver.com wrote:
>> From: Chengchang Tang <tangchengchang@...wei.com>
>>
>> [ Upstream commit a942ec2745ca864cd8512142100e4027dc306a42 ]
>>
>> The refcount of CQ is not protected by locks. When CQ asynchronous
>> events and CQ destruction are concurrent, CQ may have been released,
>> which will cause UAF.
>>
>> Use the xa_lock() to protect the CQ refcount.
>>
>> Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
>> Signed-off-by: Chengchang Tang <tangchengchang@...wei.com>
>> Signed-off-by: Junxian Huang <huangjunxian6@...ilicon.com>
>> Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com
>> Signed-off-by: Leon Romanovsky <leon@...nel.org>
>> Signed-off-by: Haixiao Yan <haixiao.yan.cn@...driver.com>
>> ---
>> This commit is backporting a942ec2745ca to the branch linux-5.15.y to
>> solve the CVE-2024-38545. Please merge this commit to linux-5.15.y.
> Don't you need to send this to the stable maintainers too?
>
> Jason