diff --git a/patches.suse/netdevsim-fib-Fix-reference-count-leak-on-route-dele.patch b/patches.suse/netdevsim-fib-Fix-reference-count-leak-on-route-dele.patch index 6b070e0..06df775 100644 --- a/patches.suse/netdevsim-fib-Fix-reference-count-leak-on-route-dele.patch +++ b/patches.suse/netdevsim-fib-Fix-reference-count-leak-on-route-dele.patch @@ -4,7 +4,7 @@ Date: Thu, 28 Jul 2022 14:45:33 +0300 Subject: [PATCH 06/16] netdevsim: fib: Fix reference count leak on route deletion failure Git-commit: 180a6a3ee60a7cb69ed1232388460644f6a21f00 -References: git-fixes +References: git-fixes bsc#1210454 CVE-2023-2019 Patch-mainline: v6.0-rc1 As part of FIB offload simulation, netdevsim stores IPv4 and IPv6 routes diff --git a/patches.suse/nfc-st-nci-Fix-use-after-free-bug-in-ndlc_remove-due.patch b/patches.suse/nfc-st-nci-Fix-use-after-free-bug-in-ndlc_remove-due.patch new file mode 100644 index 0000000..f93e2d3 --- /dev/null +++ b/patches.suse/nfc-st-nci-Fix-use-after-free-bug-in-ndlc_remove-due.patch @@ -0,0 +1,71 @@ +From 5000fe6c27827a61d8250a7e4a1d26c3298ef4f6 Mon Sep 17 00:00:00 2001 +From: Zheng Wang +Date: Mon, 13 Mar 2023 00:08:37 +0800 +Subject: [PATCH] nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition +Git-commit: 5000fe6c27827a61d8250a7e4a1d26c3298ef4f6 +Patch-mainline: v6.3-rc3 +References: git-fixes bsc#1210337 CVE-2023-1990 + +This bug influences both st_nci_i2c_remove and st_nci_spi_remove. +Take st_nci_i2c_remove as an example. + +In st_nci_i2c_probe, it called ndlc_probe and bound &ndlc->sm_work +with llt_ndlc_sm_work. + +When it calls ndlc_recv or timeout handler, it will finally call +schedule_work to start the work. + +When we call st_nci_i2c_remove to remove the driver, there +may be a sequence as follows: + +Fix it by finishing the work before cleanup in ndlc_remove + +CPU0 CPU1 + + |llt_ndlc_sm_work +st_nci_i2c_remove | + ndlc_remove | + st_nci_remove | + nci_free_device| + kfree(ndev) | +//free ndlc->ndev | + |llt_ndlc_rcv_queue + |nci_recv_frame + |//use ndlc->ndev + +Fixes: 35630df68d60 ("NFC: st21nfcb: Add driver for STMicroelectronics ST21NFCB NFC chip") +Signed-off-by: Zheng Wang +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20230312160837.2040857-1-zyytlz.wz@163.com +Signed-off-by: Jakub Kicinski +Acked-by: Takashi Iwai +Acked-by: Chester Lin +--- + drivers/nfc/st-nci/ndlc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nfc/st-nci/ndlc.c b/drivers/nfc/st-nci/ndlc.c +index 755460a73c0d..d2aa9f766738 100644 +--- a/drivers/nfc/st-nci/ndlc.c ++++ b/drivers/nfc/st-nci/ndlc.c +@@ -282,13 +282,15 @@ EXPORT_SYMBOL(ndlc_probe); + + void ndlc_remove(struct llt_ndlc *ndlc) + { +- st_nci_remove(ndlc->ndev); +- + /* cancel timers */ + del_timer_sync(&ndlc->t1_timer); + del_timer_sync(&ndlc->t2_timer); + ndlc->t2_active = false; + ndlc->t1_active = false; ++ /* cancel work */ ++ cancel_work_sync(&ndlc->sm_work); ++ ++ st_nci_remove(ndlc->ndev); + + skb_queue_purge(&ndlc->rcv_q); + skb_queue_purge(&ndlc->send_q); +-- +2.35.3 + diff --git a/patches.suse/udmabuf-add-back-sanity-check.patch b/patches.suse/udmabuf-add-back-sanity-check.patch index 52121c3..95f7c62 100644 --- a/patches.suse/udmabuf-add-back-sanity-check.patch +++ b/patches.suse/udmabuf-add-back-sanity-check.patch @@ -4,7 +4,7 @@ Date: Mon, 20 Jun 2022 09:15:47 +0200 Subject: udmabuf: add back sanity check Git-commit: 05b252cccb2e5c3f56119d25de684b4f810ba40a Patch-mainline: v5.19-rc4 -References: jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 +References: jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225 bsc#1210453 CVE-2023-2008 Check vm_fault->pgoff before using it. When we removed the warning, we also removed the check. diff --git a/series.conf b/series.conf index 1ec9a48..edc5b05 100644 --- a/series.conf +++ b/series.conf @@ -36920,6 +36920,7 @@ patches.suse/0001-net-tls-fix-possible-race-condition-between-do_tls_g.patch patches.suse/bnxt_en-Avoid-order-5-memory-allocation-for-TPA-data.patch patches.suse/ice-avoid-bonding-causing-auxiliary-plug-unplug-unde.patch + patches.suse/nfc-st-nci-Fix-use-after-free-bug-in-ndlc_remove-due.patch patches.suse/s390-uaccess-add-missing-earlyclobber-annotations-to-__clear_user.patch ########################################################