Fix CVE-2022-3565

[gvrose8192]

Commit message

jira VULN-168
cve CVE-2022-3565
commit-author Duoming Zhou <duoming@zju.edu.cn>
commit 2568a7e0832ee30b0a351016d03062ab4e0e0a3f

The l1oip_cleanup() traverses the l1oip_ilist and calls release_card() to cleanup module and stack. However, release_card() calls del_timer() to delete the timers such as keep_tl and timeout_tl. If the timer handler is running, the del_timer() will not stop it and result in UAF bugs. One of the processes is shown below:

    (cleanup routine)          |        (timer handler)
release_card()                 | l1oip_timeout()
 ...                           |
 del_timer()                   | ...
 ...                           |
 kfree(hc) //FREE              |
                               | hc->timeout_on = 0 //USE

Fix by calling del_timer_sync() in release_card(), which makes sure the timer handlers have finished before the resources, such as l1oip and so on, have been deallocated.

What's more, the hc->workq and hc->socket_thread can kick those timers right back in. We add a bool flag to show if card is released. Then, check this flag in hc->workq and hc->socket_thread.

Fixes: 3712b42d4b1b ("Add layer1 over IP support")
	Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
	Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 2568a7e0832ee30b0a351016d03062ab4e0e0a3f)
	Signed-off-by: Greg Rose <g.v.rose@ciq.com>

Builds:

/home/g.v.rose/prj/kernel-build-tmp
no .config file found, moving on
[TIMER]{MRPROPER}: 0s
x86_64 architecture detected, copying config
'configs/kernel-4.18.0-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-debug-branch"
Making olddefconfig
  HOSTCC  scripts/basic/fixdep
  HOSTCC  scripts/kconfig/conf.o
  YACC    scripts/kconfig/zconf.tab.c
  LEX     scripts/kconfig/zconf.lex.c
  HOSTCC  scripts/kconfig/zconf.tab.o
  HOSTLD  scripts/kconfig/conf
scripts/kconfig/conf  --olddefconfig Kconfig
#
# configuration written to .config
#
Starting Build
scripts/kconfig/conf  --syncconfig Kconfig
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_64.h
  SYSHDR  arch/x86/include/generated/asm/unistd_64_x32.h
  HYPERCALLS arch/x86/include/generated/asm/xen-hypercalls.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_32.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_x32.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_64.h
  HOSTCC  scripts/basic/bin2c
  WRAP    arch/x86/include/generated/uapi/asm/bpf_perf_event.h
  WRAP    arch/x86/include/generated/uapi/asm/poll.h
  WRAP    arch/x86/include/generated/uapi/asm/socket.h
  UPD     include/generated/uapi/linux/version.h
  UPD     include/config/kernel.release
  DESCEND objtool
  DESCEND bpf/resolve_btfids
  MKDIR     /home/g.v.rose/prj/kernel-build-tmp/tools/bpf/resolve_btfids//libbpf

[SNIP]

  INSTALL sound/usb/usx2y/snd-usb-us122l.ko
  INSTALL sound/usb/usx2y/snd-usb-usx2y.ko
  INSTALL sound/virtio/virtio_snd.ko
  INSTALL sound/x86/snd-hdmi-lpe-audio.ko
  INSTALL sound/xen/snd_xen_front.ko
  INSTALL virt/lib/irqbypass.ko
  DEPMOD  4.18.0-debug-branch+
[TIMER]{MODULES}: 70s
Making Install
sh ./arch/x86/boot/install.sh 4.18.0-debug-branch+ arch/x86/boot/bzImage \
        System.map "/boot"
[TIMER]{INSTALL}: 21s
Checking kABI
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-4.18.0-debug-branch+ and Index to 3
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 0s
[TIMER]{BUILD}: 1023s
[TIMER]{MODULES}: 70s
[TIMER]{INSTALL}: 21s
[TIMER]{TOTAL} 1123s
Rebooting in 10 seconds

Boots and runs:

[g.v.rose@lts86-base ~]$ uname -a
Linux lts86-base 4.18.0-debug-branch+ #1 SMP Mon Nov 18 14:45:18 EST 2024 x86_64 x86_64 x86_64 GNU/Linux

Before and after kernel selftests show no changes:
kernel-selftest-before.log
kernel-selftest-after.log

[g.v.rose@lts86-base ~]$ !999
grep '^ok' kernel-selftest-before.log | grep  selftest | wc
    216    1246    9668
[g.v.rose@lts86-base ~]$ !998
grep '^ok' kernel-selftest-after.log | grep  selftest | wc
    216    1246    9668

The nature of the change is such that we do not have the system HW and setup to test the change and get code coverage. We'll have to depend on the patch applying cleanly and the expertise of the folks who created it.

[PlaidCat]

Everything looks good

[bmastbergen]

🥌