Go to file
Hyunwoo Kim dd291e070b efi: capsule-loader: Fix use-after-free in efi_capsule_write
commit 9cb636b5f6 upstream.

A race condition may occur if the user calls close() on another thread
during a write() operation on the device node of the efi capsule.

This is a race condition that occurs between the efi_capsule_write() and
efi_capsule_flush() functions of efi_capsule_fops, which ultimately
results in UAF.

So, the page freeing process is modified to be done in
efi_capsule_release() instead of efi_capsule_flush().

Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-15 11:30:00 +02:00
arch s390: fix nospec table alignments 2022-09-08 12:28:07 +02:00
block blk-mq: fix io hung due to missing commit_rqs 2022-08-31 17:16:50 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto KEYS: asymmetric: enforce SM2 signature use pkey algo 2022-08-17 14:24:28 +02:00
Documentation arm64: errata: Add Cortex-A510 to the repeat tlbi list 2022-09-05 10:30:04 +02:00
drivers efi: capsule-loader: Fix use-after-free in efi_capsule_write 2022-09-15 11:30:00 +02:00
fs cifs: fix small mempool leak in SMB2_negotiate() 2022-09-08 12:28:04 +02:00
include USB: core: Prevent nested device-reset calls 2022-09-08 12:28:07 +02:00
init stack: Declare {randomize_,}kstack_offset to fix Sparse warnings 2022-08-17 14:23:10 +02:00
ipc ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() 2022-06-09 10:23:10 +02:00
kernel bpf, cgroup: Fix kernel BUG in purge_effective_progs 2022-09-08 12:28:01 +02:00
lib crypto: lib - remove unneeded selection of XOR_BLOCKS 2022-09-05 10:30:03 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm: pagewalk: Fix race between unmap and page walker 2022-09-08 12:28:05 +02:00
net net: mac802154: Fix a condition in the receive path 2022-09-08 12:28:07 +02:00
samples samples/landlock: Format with clang-format 2022-06-09 10:23:23 +02:00
scripts kbuild: fix up permissions on scripts/pahole-flags.sh 2022-09-08 12:30:36 +02:00
security apparmor: Fix memleak in aa_simple_write_to_buffer() 2022-08-25 11:40:01 +02:00
sound ALSA: seq: Fix data-race at module auto-loading 2022-09-08 12:28:08 +02:00
tools testing: selftests: nft_flowtable.sh: use random netns names 2022-09-05 10:30:12 +02:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:27:15 +01:00
virt KVM: Unconditionally get a ref to /dev/kvm module when creating a VM 2022-08-25 11:39:53 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore .gitignore: ignore only top-level modules.builtin 2021-05-02 00:43:35 +09:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS Input: goodix - add a goodix.h header file 2022-07-12 16:34:51 +02:00
Makefile Linux 5.15.67 2022-09-08 12:32:54 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.