github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

serdev: ttyport: Clear serport->tty after freeing

Browse Source 
Both error paths in ttyport_open(), and ttyport_close(), release the tty
with tty_release_struct() and leave serport->tty pointing at freed memory.

The serdev core itself never dereferences it afterwards. However, a buggy
driver could easily trigger a use-after-free by calling a ttyport operation
on a port that is not open, or by calling close() twice. While those
drivers should be fixed, clearing the pointer, makes them fail
deterministically instead of touching freed memory.

Note that a driver which currently double closes gets away with it only by
chance, depending on whether the freed tty has been reused. After this
change such a driver oopses immediately instead, which is the intended
outcome, but it may surface latent bugs elsewhere.

Signed-off-by: Ibrahim Abdelkader <iabdelka@qti.qualcomm.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Reviewed-by: Markus Probst <markus.probst@posteo.de>
Link: https://patch.msgid.link/20260819125748.194377-1-johannes.goede@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ibrahim Abdelkader 2026-08-19 14:57:48 +02:00 committed by Greg Kroah-Hartman
parent de7f683ff9
commit f8631f993e
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/tty/serdev/serdev-ttyport.c
View File

@ -137,6 +137,7 @@ static int ttyport_open(struct serdev_controller *ctrl)
err_unlock:
tty_unlock(tty);
tty_release_struct(tty, serport->tty_idx);
serport->tty = NULL;
return ret;
}
@ -154,6 +155,7 @@ static void ttyport_close(struct serdev_controller *ctrl)
tty_unlock(tty);
tty_release_struct(tty, serport->tty_idx);
serport->tty = NULL;
}
static unsigned int ttyport_set_baudrate(struct serdev_controller *ctrl, unsigned int speed)