[ Sasha's backport helper bot ] Hi, The upstream commit SHA1 provided is correct: 9462f4ca56e7d2430fdb6dcc8498244acbfc4489 WARNING: Author mismatch between patch and upstream commit: Backport author: <mingli.yu@xxxxxxxxxxxxxxxxx> Commit author: Longlong Xia <xialonglong@xxxxxxxxxx> Status in newer kernel trees: 6.12.y | Present (exact SHA1) 6.11.y | Present (different SHA1: 0eec592c6a74) 6.6.y | Present (different SHA1: c29f192e0d44) 6.1.y | Present (different SHA1: bf171b5e86e4) 5.15.y | Not found Note: The patch differs from the upstream commit: --- --- - 2024-11-28 06:15:22.075748655 -0500 +++ /tmp/tmp.vWxXusWqkZ 2024-11-28 06:15:22.068138702 -0500 @@ -1,3 +1,5 @@ +commit 9462f4ca56e7d2430fdb6dcc8498244acbfc4489 upstream. + BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 @@ -51,20 +53,37 @@ Suggested-by: Jiri Slaby <jirislaby@xxxxxxxxxx> Link: https://lore.kernel.org/r/20240926130213.531959-1-xialonglong@xxxxxxxxxx Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> +[Mingli: Backport to fix CVE-2024-50073, no guard macro defined resolution] +Signed-off-by: Mingli Yu <mingli.yu@xxxxxxxxxxxxx> --- - drivers/tty/n_gsm.c | 2 ++ - 1 file changed, 2 insertions(+) + drivers/tty/n_gsm.c | 4 ++++ + 1 file changed, 4 insertions(+) diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c -index 5d37a09849163..252849910588f 100644 +index aae9f73585bd..1becbdf7c470 100644 --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c -@@ -3157,6 +3157,8 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) +@@ -2443,6 +2443,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) + int i; + struct gsm_dlci *dlci; + struct gsm_msg *txq, *ntxq; ++ unsigned long flags; + + gsm->dead = true; + mutex_lock(&gsm->mutex); +@@ -2471,9 +2472,12 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) mutex_unlock(&gsm->mutex); /* Now wipe the queues */ tty_ldisc_flush(gsm->tty); + -+ guard(spinlock_irqsave)(&gsm->tx_lock); - list_for_each_entry_safe(txq, ntxq, &gsm->tx_ctrl_list, list) ++ spin_lock_irqsave(&gsm->tx_lock, flags); + list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list) kfree(txq); - INIT_LIST_HEAD(&gsm->tx_ctrl_list); + INIT_LIST_HEAD(&gsm->tx_list); ++ spin_unlock_irqrestore(&gsm->tx_lock, flags); + } + + /** +-- +2.34.1 + --- Results of testing on various branches: | Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.15.y | Success | Success |
