Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: "Ziyang Xuan (William)" <william.xuanziyang@huawei.com>
Cc: davem@davemloft.net, kuba@kernel.org, socketcan@hartkopp.net,
mkl@pengutronix.de, netdev@vger.kernel.org,
stable@vger.kernel.org, linux-can@vger.kernel.org,
tglx@linutronix.de, anna-maria@linutronix.de
Subject: Re: [PATCH net] can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet
Date: Thu, 13 Jan 2022 11:49:36 +0100 [thread overview]
Message-ID: <YeADwHa4blpQFCII@kroah.com> (raw)
In-Reply-To: <afcc8f0c-1aa7-9f43-bf50-b404c954db8b@huawei.com>
On Tue, Jan 11, 2022 at 10:02:09AM +0800, Ziyang Xuan (William) wrote:
> > On Mon, Jan 10, 2022 at 09:23:22PM +0800, Ziyang Xuan wrote:
> >> From: Thomas Gleixner <tglx@linutronix.de>
> >>
> >> [ commit bf74aa86e111aa3b2fbb25db37e3a3fab71b5b68 upstream ]
> >>
> >> Stop tx/rx cycle rely on the active state of tasklet and hrtimer
> >> sequentially in bcm_remove_op(), the op object will be freed if they
> >> are all unactive. Assume the hrtimer timeout is short, the hrtimer
> >> cb has been excuted after tasklet conditional judgment which must be
> >> false after last round tasklet_kill() and before condition
> >> hrtimer_active(), it is false when execute to hrtimer_active(). Bug
> >> is triggerd, because the stopping action is end and the op object
> >> will be freed, but the tasklet is scheduled. The resources of the op
> >> object will occur UAF bug.
> >
> > That is not the changelog text of this commit. Why modify it?
>
> Above statement is the reason why I want to backport the patch to
> stable tree. Maybe I could give an extra cover-letter to explain
> the details of the problem, but modify the original changelog. Is it?
>
> >
> >>
> >> ----------------------------------------------------------------------
> >>
> >> This patch switches the timer to HRTIMER_MODE_SOFT, which executed the
> >> timer callback in softirq context and removes the hrtimer_tasklet.
> >>
> >> Reported-by: syzbot+652023d5376450cc8516@syzkaller.appspotmail.com
>
> This is the public problem reporter. Do I need to move it to cover-letter
> but here?
>
> >> Cc: stable@vger.kernel.org # 4.19
>
> I want to backport the patch to linux-4.19.y stable tree. How do I need to
> modify?
No need, I can take it like this, thanks.
greg k-h
prev parent reply other threads:[~2022-01-13 10:49 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-10 13:23 Ziyang Xuan
2022-01-10 13:16 ` Greg KH
2022-01-11 2:02 ` Ziyang Xuan (William)
2022-01-11 7:57 ` Oliver Hartkopp
2022-01-11 13:02 ` Ziyang Xuan (William)
2022-01-13 10:49 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YeADwHa4blpQFCII@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=anna-maria@linutronix.de \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=mkl@pengutronix.de \
--cc=netdev@vger.kernel.org \
--cc=socketcan@hartkopp.net \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=william.xuanziyang@huawei.com \
--subject='Re: [PATCH net] can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet' \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).