From f8631f993e26ea6eea6242dec7185017ba2e566c Mon Sep 17 00:00:00 2001 From: Ibrahim Abdelkader Date: Wed, 19 Aug 2026 14:57:48 +0200 Subject: [PATCH] serdev: ttyport: Clear serport->tty after freeing Both error paths in ttyport_open(), and ttyport_close(), release the tty with tty_release_struct() and leave serport->tty pointing at freed memory. The serdev core itself never dereferences it afterwards. However, a buggy driver could easily trigger a use-after-free by calling a ttyport operation on a port that is not open, or by calling close() twice. While those drivers should be fixed, clearing the pointer, makes them fail deterministically instead of touching freed memory. Note that a driver which currently double closes gets away with it only by chance, depending on whether the freed tty has been reused. After this change such a driver oopses immediately instead, which is the intended outcome, but it may surface latent bugs elsewhere. Signed-off-by: Ibrahim Abdelkader Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Reviewed-by: Markus Probst Link: https://patch.msgid.link/20260819125748.194377-1-johannes.goede@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman --- drivers/tty/serdev/serdev-ttyport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c index bab1b143b8a6..b6638f9f40d2 100644 --- a/drivers/tty/serdev/serdev-ttyport.c +++ b/drivers/tty/serdev/serdev-ttyport.c @@ -137,6 +137,7 @@ static int ttyport_open(struct serdev_controller *ctrl) err_unlock: tty_unlock(tty); tty_release_struct(tty, serport->tty_idx); + serport->tty = NULL; return ret; } @@ -154,6 +155,7 @@ static void ttyport_close(struct serdev_controller *ctrl) tty_unlock(tty); tty_release_struct(tty, serport->tty_idx); + serport->tty = NULL; } static unsigned int ttyport_set_baudrate(struct serdev_controller *ctrl, unsigned int speed)