Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout[EOL][EOL]When the pn532 uart device is detaching, the pn532_uart_remove()[EOL]is called. But there are no functions in pn532_uart_remove() that[EOL]could delete the cmd_timeout timer, which will cause use-after-free[EOL]bugs. The process is shown below:[EOL][EOL]    (thread 1)                   (        (thread 2)[EOL)                                |  pn532_uart_send_frameEOL]pn532_uart_remove                (    mod_timer(&pn532->cmd_timeout,...)[EOL)  ...                           |    (wait a time)EOL]  kfree(pn532) //FREE            (    pn532_cmd_timeout[EOL)                                |      pn532_uart_send_frameEOL]                                 (        pn532->... //USE[EOL)EOL]This patch adds del_timer_sync() in pn532_uart_remove() in order to[EOL]prevent the use-after-free bugs. What's more, the pn53x_unregister_nfc()[EOL]is well synchronized, it sets nfc_dev->shutting_down to true and there[EOL]are no syscalls could restart the cmd_timeout timer.

CREATE(Triage):(User=lchen-cn) [CVE-2022-50005 (https://nvd.nist.gov/vuln/detail/CVE-2022-50005)