can: bcm: Fix UAF in bcm_proc_show()

JIRA: https://issues.redhat.com/browse/RHEL-80748
CVE: CVE-2023-52922

commit 55c3b96
Author: YueHaibing <yuehaibing@huawei.com>
Date:   Sat Jul 15 17:25:43 2023 +0800

    can: bcm: Fix UAF in bcm_proc_show()

    BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80
    Read of size 8 at addr ffff888155846230 by task cat/7862

    CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 ctrliq#230
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0xd5/0x150
     print_report+0xc1/0x5e0
     kasan_report+0xba/0xf0
     bcm_proc_show+0x969/0xa80
     seq_read_iter+0x4f6/0x1260
     seq_read+0x165/0x210
     proc_reg_read+0x227/0x300
     vfs_read+0x1d5/0x8d0
     ksys_read+0x11e/0x240
     do_syscall_64+0x35/0xb0
     entry_SYSCALL_64_after_hwframe+0x63/0xcd

    Allocated by task 7846:
     kasan_save_stack+0x1e/0x40
     kasan_set_track+0x21/0x30
     __kasan_kmalloc+0x9e/0xa0
     bcm_sendmsg+0x264b/0x44e0
     sock_sendmsg+0xda/0x180
     ____sys_sendmsg+0x735/0x920
     ___sys_sendmsg+0x11d/0x1b0
     __sys_sendmsg+0xfa/0x1d0
     do_syscall_64+0x35/0xb0
     entry_SYSCALL_64_after_hwframe+0x63/0xcd

    Freed by task 7846:
     kasan_save_stack+0x1e/0x40
     kasan_set_track+0x21/0x30
     kasan_save_free_info+0x27/0x40
     ____kasan_slab_free+0x161/0x1c0
     slab_free_freelist_hook+0x119/0x220
     __kmem_cache_free+0xb4/0x2e0
     rcu_core+0x809/0x1bd0

    bcm_op is freed before procfs entry be removed in bcm_release(),
    this lead to bcm_proc_show() may read the freed bcm_op.

    Fixes: ffd980f ("[CAN]: Add broadcast manager (bcm) protocol")
    Signed-off-by: YueHaibing <yuehaibing@huawei.com>
    Reviewed-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Link: https://lore.kernel.org/all/20230715092543.15548-1-yuehaibing@huawei.com
    Cc: stable@vger.kernel.org
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>

Author: michich

net/can/bcm.c

@@ -1511,6 +1511,12 @@ static int bcm_release(struct socket *sock)
 
 	lock_sock(sk);
 
+#if IS_ENABLED(CONFIG_PROC_FS)
+	/* remove procfs entry */
+	if (net->can.bcmproc_dir && bo->bcm_proc_read)
+		remove_proc_entry(bo->procname, net->can.bcmproc_dir);
+#endif /* CONFIG_PROC_FS */
+
 	list_for_each_entry_safe(op, next, &bo->tx_ops, list)
 		bcm_remove_op(op);
 
@@ -1546,12 +1552,6 @@ static int bcm_release(struct socket *sock)
 	list_for_each_entry_safe(op, next, &bo->rx_ops, list)
 		bcm_remove_op(op);
 
-#if IS_ENABLED(CONFIG_PROC_FS)
-	/* remove procfs entry */
-	if (net->can.bcmproc_dir && bo->bcm_proc_read)
-		remove_proc_entry(bo->procname, net->can.bcmproc_dir);
-#endif /* CONFIG_PROC_FS */
-
 	/* remove device reference */
 	if (bo->bound) {
 		bo->bound   = 0;