kernel-7.1.4-201
* Mon Jul 20 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-1] - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Lee Jones) Resolves: Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
This commit is contained in:
Justin M. Forbes
parent
a68837d130
commit
f34eb87ae8
6 changed files with 136 additions and 6 deletions
|
|
@ -12,7 +12,7 @@ RHEL_MINOR = 99
|
|||
#
|
||||
# Use this spot to avoid future merge conflicts.
|
||||
# Do not trim this comment.
|
||||
RHEL_RELEASE = 0
|
||||
RHEL_RELEASE = 1
|
||||
|
||||
#
|
||||
# RHEL_REBASE_NUM
|
||||
|
|
|
|||
|
|
@ -1,3 +1,6 @@
|
|||
https://gitlab.com/cki-project/kernel-ark/-/commit/398377259f01c70d2cdb14c206967ccf200ed6bd
|
||||
398377259f01c70d2cdb14c206967ccf200ed6bd can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
|
||||
|
||||
https://gitlab.com/cki-project/kernel-ark/-/commit/7b8efc5af560ec18096b99f3d8b1b6b6ef101ee5
|
||||
7b8efc5af560ec18096b99f3d8b1b6b6ef101ee5 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
|
||||
|
||||
|
|
|
|||
|
|
@ -1,3 +1,7 @@
|
|||
* Mon Jul 20 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-1]
|
||||
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Lee Jones)
|
||||
Resolves:
|
||||
|
||||
* Sat Jul 18 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-0]
|
||||
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Sean Christopherson)
|
||||
- drm/amd: Create a device link between APU display and XHCI devices (Mario Limonciello)
|
||||
|
|
|
|||
|
|
@ -190,13 +190,13 @@ Summary: The Linux kernel
|
|||
%define specrpmversion 7.1.4
|
||||
%define specversion 7.1.4
|
||||
%define patchversion 7.1
|
||||
%define pkgrelease 200
|
||||
%define pkgrelease 201
|
||||
%define kversion 7
|
||||
%define tarfile_release 7.1.4
|
||||
# This is needed to do merge window version magic
|
||||
%define patchlevel 1
|
||||
# This allows pkg_release to have configurable %%{?dist} tag
|
||||
%define specrelease 200%{?buildid}%{?dist}
|
||||
%define specrelease 201%{?buildid}%{?dist}
|
||||
# This defines the kabi tarball version
|
||||
%define kabiversion 7.1.4
|
||||
|
||||
|
|
@ -4857,6 +4857,9 @@ fi\
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Mon Jul 20 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-1]
|
||||
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Lee Jones)
|
||||
|
||||
* Sat Jul 18 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-0]
|
||||
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Sean Christopherson)
|
||||
- drm/amd: Create a device link between APU display and XHCI devices (Mario Limonciello)
|
||||
|
|
|
|||
|
|
@ -46,6 +46,7 @@
|
|||
include/linux/random.h | 10 +
|
||||
include/linux/security.h | 9 +
|
||||
kernel/module/signing.c | 9 +-
|
||||
net/can/bcm.c | 37 +-
|
||||
scripts/Makefile.lib | 3 +
|
||||
scripts/tags.sh | 2 +
|
||||
security/integrity/platform_certs/load_uefi.c | 6 +-
|
||||
|
|
@ -56,7 +57,7 @@
|
|||
tools/testing/selftests/bpf/DENYLIST.rhel | 76 ++
|
||||
tools/testing/selftests/bpf/Makefile | 2 +-
|
||||
tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 -
|
||||
58 files changed, 2034 insertions(+), 142 deletions(-)
|
||||
59 files changed, 2068 insertions(+), 145 deletions(-)
|
||||
|
||||
diff --git a/MAINTAINERS b/MAINTAINERS
|
||||
index f74da642290a..06c8bb2075e6 100644
|
||||
|
|
@ -2921,6 +2922,125 @@ index 590ba29c85ab..02153d857531 100644
|
|||
}
|
||||
|
||||
int module_sig_check(struct load_info *info, int flags)
|
||||
diff --git a/net/can/bcm.c b/net/can/bcm.c
|
||||
index a4bef2c48a55..bdf53241bd7b 100644
|
||||
--- a/net/can/bcm.c
|
||||
+++ b/net/can/bcm.c
|
||||
@@ -58,6 +58,7 @@
|
||||
#include <linux/can/skb.h>
|
||||
#include <linux/can/bcm.h>
|
||||
#include <linux/slab.h>
|
||||
+#include <linux/workqueue.h>
|
||||
#include <linux/spinlock.h>
|
||||
#include <net/can.h>
|
||||
#include <net/sock.h>
|
||||
@@ -92,6 +93,8 @@ MODULE_ALIAS("can-proto-2");
|
||||
|
||||
#define BCM_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)
|
||||
|
||||
+static struct workqueue_struct *bcm_wq;
|
||||
+
|
||||
/*
|
||||
* easy access to the first 64 bit of can(fd)_frame payload. cp->data is
|
||||
* 64 bit aligned so the offset has to be multiples of 8 which is ensured
|
||||
@@ -105,6 +108,7 @@ static inline u64 get_u64(const struct canfd_frame *cp, int offset)
|
||||
struct bcm_op {
|
||||
struct list_head list;
|
||||
struct rcu_head rcu;
|
||||
+ struct work_struct work;
|
||||
int ifindex;
|
||||
canid_t can_id;
|
||||
u32 flags;
|
||||
@@ -793,9 +797,12 @@ static struct bcm_op *bcm_find_op(struct list_head *ops,
|
||||
return NULL;
|
||||
}
|
||||
|
||||
-static void bcm_free_op_rcu(struct rcu_head *rcu_head)
|
||||
+static void bcm_free_op_work(struct work_struct *work)
|
||||
{
|
||||
- struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
|
||||
+ struct bcm_op *op = container_of(work, struct bcm_op, work);
|
||||
+
|
||||
+ hrtimer_cancel(&op->timer);
|
||||
+ hrtimer_cancel(&op->thrtimer);
|
||||
|
||||
if ((op->frames) && (op->frames != &op->sframe))
|
||||
kfree(op->frames);
|
||||
@@ -803,9 +810,23 @@ static void bcm_free_op_rcu(struct rcu_head *rcu_head)
|
||||
if ((op->last_frames) && (op->last_frames != &op->last_sframe))
|
||||
kfree(op->last_frames);
|
||||
|
||||
+ /* the last possible access to op->timer/op->thrtimer has now
|
||||
+ * happened above via hrtimer_cancel() - op->sk is no longer
|
||||
+ * needed by any pending timer callback, so drop our reference
|
||||
+ */
|
||||
+ sock_put(op->sk);
|
||||
+
|
||||
kfree(op);
|
||||
}
|
||||
|
||||
+static void bcm_free_op_rcu(struct rcu_head *rcu_head)
|
||||
+{
|
||||
+ struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
|
||||
+
|
||||
+ INIT_WORK(&op->work, bcm_free_op_work);
|
||||
+ queue_work(bcm_wq, &op->work);
|
||||
+}
|
||||
+
|
||||
static void bcm_remove_op(struct bcm_op *op)
|
||||
{
|
||||
hrtimer_cancel(&op->timer);
|
||||
@@ -1060,6 +1081,7 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
|
||||
|
||||
/* bcm_can_tx / bcm_tx_timeout_handler needs this */
|
||||
op->sk = sk;
|
||||
+ sock_hold(sk);
|
||||
op->ifindex = ifindex;
|
||||
|
||||
/* initialize uninitialized (kzalloc) structure */
|
||||
@@ -1221,6 +1243,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
|
||||
|
||||
/* bcm_can_tx / bcm_tx_timeout_handler needs this */
|
||||
op->sk = sk;
|
||||
+ sock_hold(sk);
|
||||
op->ifindex = ifindex;
|
||||
|
||||
/* ifindex for timeout events w/o previous frame reception */
|
||||
@@ -1839,11 +1862,15 @@ static int __init bcm_module_init(void)
|
||||
{
|
||||
int err;
|
||||
|
||||
+ bcm_wq = alloc_workqueue("can-bcm-wq", WQ_UNBOUND, 0);
|
||||
+ if (!bcm_wq)
|
||||
+ return -ENOMEM;
|
||||
+
|
||||
pr_info("can: broadcast manager protocol\n");
|
||||
|
||||
err = register_pernet_subsys(&canbcm_pernet_ops);
|
||||
if (err)
|
||||
- return err;
|
||||
+ goto register_pernet_failed;
|
||||
|
||||
err = register_netdevice_notifier(&canbcm_notifier);
|
||||
if (err)
|
||||
@@ -1861,6 +1888,8 @@ static int __init bcm_module_init(void)
|
||||
unregister_netdevice_notifier(&canbcm_notifier);
|
||||
register_notifier_failed:
|
||||
unregister_pernet_subsys(&canbcm_pernet_ops);
|
||||
+register_pernet_failed:
|
||||
+ destroy_workqueue(bcm_wq);
|
||||
return err;
|
||||
}
|
||||
|
||||
@@ -1869,6 +1898,8 @@ static void __exit bcm_module_exit(void)
|
||||
can_proto_unregister(&bcm_can_proto);
|
||||
unregister_netdevice_notifier(&canbcm_notifier);
|
||||
unregister_pernet_subsys(&canbcm_pernet_ops);
|
||||
+ rcu_barrier();
|
||||
+ destroy_workqueue(bcm_wq);
|
||||
}
|
||||
|
||||
module_init(bcm_module_init);
|
||||
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
|
||||
index 0718e39cedda..10e94a1b8b6e 100644
|
||||
--- a/scripts/Makefile.lib
|
||||
|
|
|
|||
4
sources
4
sources
|
|
@ -1,3 +1,3 @@
|
|||
SHA512 (linux-7.1.4.tar.xz) = 164f7c0353dfcf1eaacf886530273271d473314a9f99d9441a63bfc24368c8d2f194552bd4800dd440bf824598cbd74263b1b544dc61307517b8208acf9b4a7a
|
||||
SHA512 (kernel-abi-stablelists-7.1.4.tar.xz) = f5bc5d159e0503a7e53ed241ab4a4f4cdb20ede32d00915fa4e1404a19024276e169c8675eef900d4d0b2e9d6a55f814bbbddcfdf6f38e19a1d0957533848573
|
||||
SHA512 (kernel-kabi-dw-7.1.4.tar.xz) = d8d89633a4474b1ad9522ab066c97907e217f72fde3290b3a02bbddadd79b5d82514ae1a6b0b1dccd770cd0717df0a45e9e6aaa4bc9f45aba1ee9be44d1e832b
|
||||
SHA512 (kernel-abi-stablelists-7.1.4.tar.xz) = 77a0b54baff4e889f8f7c5b035da71e5ff22071e5daf8e2b48fd67ae6ec2d0720842da6e2b8fbedbc8b5c62074fe71d5f2aa53558e9fd22837c54cb1835d095a
|
||||
SHA512 (kernel-kabi-dw-7.1.4.tar.xz) = bf880002eb61ae0c19a5692db25c281152d08404e60023770660fe3bbbd57055ae1a7a0ec770e57a871bd3d8a531d401951743b95731cb93ff26a0623f9bd217
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue