[v1] backport to fix a race condition/UAF in padata_reorder

[PATCH 6.1.y 0/2] backport to fix a race condition/UAF in padata_reorder

Bin Lan posted 2 patches 1 month, 2 weeks ago

Diff against v1
Download series mbox

include/linux/padata.h |   4 --
kernel/padata.c        | 136 +++++++++++------------------------------
2 files changed, 37 insertions(+), 103 deletions(-)

Expand all Fold all

[PATCH 6.1.y 0/2] backport to fix a race condition/UAF in padata_reorder

Posted by Bin Lan 1 month, 2 weeks ago

From: Bin Lan <bin.lan.cn@windriver.com>

This series backports the fix for a use-after-free vulnerability in the
padata subsystem, to the Linux 6.1.y stable branch.

Backport notes for 6.1.y:

  - The upstream fix (commit 71203f68c774) was written against mainline
    which uses the 2-argument cpumask_next_wrap(cpu, mask) API introduced
    by dc5bb9b769c9 ("cpumask: deprecate cpumask_next_wrap()"). Since
    6.1.y still has the original 4-argument API, the call in
    padata_reorder() is adapted to:
      cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false)
    This is functionally equivalent.

  - The context in padata_find_next() differs from mainline due to
    f954a2d37637 ("padata: switch padata_find_next() to using
    cpumask_next_wrap()") not being present in 6.1.y. The conflict was
    resolved.

After applying this series, kernel/padata.c matches the upstream file at
commit 71203f68c774 with a few differences. None of these differences 
affect the fix, the core changes to padata_find_next(), padata_reorder(), 
and padata_do_serial() are identical.

Thanks
Bin Lan


Herbert Xu (2):
  padata: Fix pd UAF once and for all
  padata: Remove comment for reorder_work

 include/linux/padata.h |   4 --
 kernel/padata.c        | 136 +++++++++++------------------------------
 2 files changed, 37 insertions(+), 103 deletions(-)

-- 
2.43.0