lkml.org 
[lkml]   [2015]   [Apr]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.4 097/176] USB: console: fix potential use after free
    Date
    From: Johan Hovold <johan@kernel.org>

    3.4.107-rc1 review patch. If anyone has any objections, please let me know.

    ------------------


    commit 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad upstream.

    Use tty kref to release the fake tty in usb_console_setup to avoid use
    after free if the underlying serial driver has acquired a reference.

    Note that using the tty destructor release_one_tty requires some more
    state to be initialised.

    Fixes: 4a90f09b20f4 ("tty: usb-serial krefs")
    Signed-off-by: Johan Hovold <johan@kernel.org>
    [lizf: Backported to 3.4: adjust context]
    Signed-off-by: Zefan Li <lizefan@huawei.com>
    ---
    drivers/usb/serial/console.c | 15 ++++++++++-----
    1 file changed, 10 insertions(+), 5 deletions(-)

    diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
    index 1ee6b2a..ae0fa72 100644
    --- a/drivers/usb/serial/console.c
    +++ b/drivers/usb/serial/console.c
    @@ -47,6 +47,8 @@ static struct console usbcons;
    * ------------------------------------------------------------
    */

    +static const struct tty_operations usb_console_fake_tty_ops = {
    +};

    /*
    * The parsing of the command line works exactly like the
    @@ -141,14 +143,17 @@ static int usb_console_setup(struct console *co, char *options)
    goto reset_open_count;
    }
    kref_init(&tty->kref);
    - tty_port_tty_set(&port->port, tty);
    tty->driver = usb_serial_tty_driver;
    tty->index = co->index;
    + INIT_LIST_HEAD(&tty->tty_files);
    + kref_get(&tty->driver->kref);
    + tty->ops = &usb_console_fake_tty_ops
    if (tty_init_termios(tty)) {
    retval = -ENOMEM;
    err("no more memory");
    - goto free_tty;
    + goto put_tty;
    }
    + tty_port_tty_set(&port->port, tty);
    }

    /* only call the device specific open if this
    @@ -170,7 +175,7 @@ static int usb_console_setup(struct console *co, char *options)
    serial->type->set_termios(tty, port, &dummy);

    tty_port_tty_set(&port->port, NULL);
    - kfree(tty);
    + tty_kref_put(tty);
    }
    set_bit(ASYNCB_INITIALIZED, &port->port.flags);
    }
    @@ -186,8 +191,8 @@ static int usb_console_setup(struct console *co, char *options)

    fail:
    tty_port_tty_set(&port->port, NULL);
    - free_tty:
    - kfree(tty);
    + put_tty:
    + tty_kref_put(tty);
    reset_open_count:
    port->port.count = 0;
    usb_autopm_put_interface(serial->interface);
    --
    1.9.1


    \
     
     \ /
      Last update: 2015-04-09 12:21    [W:4.150 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site