lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 23 Jan 2022 15:10:01 +0100
From:   Oliver Hartkopp <>
To:     Greg KH <>,
        Ziyang Xuan <>
Subject: Re: [PATCH 4.14] can: bcm: fix UAF of bcm op

On 22.01.22 11:30, Greg KH wrote:
> On Sat, Jan 22, 2022 at 06:25:06PM +0800, Ziyang Xuan wrote:
>> Stopping tasklet and hrtimer rely on the active state of tasklet and
>> hrtimer sequentially in bcm_remove_op(), the op object will be freed
>> if they are all unactive. Assume the hrtimer timeout is short, the
>> hrtimer cb has been excuted after tasklet conditional judgment which
>> must be false after last round tasklet_kill() and before condition
>> hrtimer_active(), it is false when execute to hrtimer_active(). Bug
>> is triggerd, because the stopping action is end and the op object
>> will be freed, but the tasklet is scheduled. The resources of the op
>> object will occur UAF bug.
>> Move hrtimer_cancel() behind tasklet_kill() and switch 'while () {...}'
>> to 'do {...} while ()' to fix the op UAF problem.
>> Fixes: a06393ed0316 ("can: bcm: fix hrtimer/tasklet termination in bcm op removal")
>> Reported-by:
>> Cc:
>> Signed-off-by: Ziyang Xuan <>
>> ---
>>   net/can/bcm.c | 20 ++++++++++----------
>>   1 file changed, 10 insertions(+), 10 deletions(-)
> What is the git commit id of this change in Linus's tree?

Linus' tree has been fixed by removing the tasklet implementation and 
replacing it with a HRTIMER_MODE_SOFT approach here:

commit bf74aa86e111a ("can: bcm: switch timer to HRTIMER_MODE_SOFT and 
remove hrtimer_tasklet")

This patch from Ziyang Xuan fixes the 'old' tasklet implementation for 
'old' stable kernels that lack the HRTIMER_MODE_SOFT infrastructure.

Acked-by: Oliver Hartkopp <>

Best regards,

> thanks,
> greg k-h

Powered by blists - more mailing lists