Subject: CVE-2023-52439: uio: Fix use-after-free in uio_open

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

uio: Fix use-after-free in uio_open

core-1				core-2
-------------------------------------------------------
uio_unregister_device		uio_open
				idev = idr_find()
device_unregister(&idev->dev)
put_device(&idev->dev)
uio_device_release
				get_device(&idev->dev)
kfree(idev)
uio_free_minor(minor)
				uio_release
				put_device(&idev->dev)
				kfree(idev)
-------------------------------------------------------

In the core-1 uio_unregister_device(), the device_unregister will kfree
idev when the idev->dev kobject ref is 1. But after core-1
device_unregister, put_device and before doing kfree, the core-2 may
get_device. Then:
1. After core-1 kfree idev, the core-2 will do use-after-free for idev.
2. When core-2 do uio_release and put_device, the idev will be double
   freed.

To address this issue, we can get idev atomic & inc idev reference with
minor_lock.

The Linux kernel CVE team has assigned CVE-2023-52439 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 4.19.306 with commit 3174e0f7de1b
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 5.4.268 with commit e93da893d52d
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 5.10.209 with commit 5e0be1229ae1
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 5.15.148 with commit 5cf604ee538e
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 6.1.74 with commit 17a8519cb359
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 6.6.13 with commit 35f102607054
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 6.7.1 with commit 913205930da6
	Issue introduced in 4.18 with commit 57c5f4df0a5a and fixed in 6.8 with commit 0c9ae0b86050
	Issue introduced in 4.14.100 with commit 13af019c87f2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-52439
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/uio/uio.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3174e0f7de1ba392dc191625da83df02d695b60c
	https://git.kernel.org/stable/c/e93da893d52d82d57fc0db2ca566024e0f26ff50
	https://git.kernel.org/stable/c/5e0be1229ae199ebb90b33102f74a0f22d152570
	https://git.kernel.org/stable/c/5cf604ee538ed0c467abe3b4cda5308a6398f0f7
	https://git.kernel.org/stable/c/17a8519cb359c3b483fb5c7367efa9a8a508bdea
	https://git.kernel.org/stable/c/35f102607054faafe78d2a6994b18d5d9d6e92ad
	https://git.kernel.org/stable/c/913205930da6213305616ac539447702eaa85e41
	https://git.kernel.org/stable/c/0c9ae0b8605078eafc3bea053cc78791e97ba2e2