linux-kernel - [PATCH] tty: serial: fsl_lpuart: potential NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1481322636-30847-1-git-send-email-khoroshilov@ispras.ru>
Date:   Sat, 10 Dec 2016 01:30:36 +0300
From:   Alexey Khoroshilov <khoroshilov@...ras.ru>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jiri Slaby <jslaby@...e.com>
Cc:     Alexey Khoroshilov <khoroshilov@...ras.ru>,
        linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org,
        ldv-project@...uxtesting.org
Subject: [PATCH] tty: serial: fsl_lpuart: potential NULL dereference

tty_port_tty_get() might return a tty which is NULL
if the port is not associated with a tty
(e.g. due to close or hangup).
But lpuart_start_rx_dma() dereferences tty without any check.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@...ras.ru>
---
 drivers/tty/serial/fsl_lpuart.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 76103f2c4a80..9945b37c914a 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -833,9 +833,16 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
 	struct circ_buf *ring = &sport->rx_ring;
 	int ret, nent;
 	int bits, baud;
-	struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port);
-	struct ktermios *termios = &tty->termios;
+	struct tty_struct *tty;
+	struct ktermios *termios;
 
+	tty = tty_port_tty_get(&sport->port.state->port);
+	if (!tty) {
+		dev_err(sport->port.dev, "Port is not associated with a tty\n");
+		return -ENODEV;
+	}
+
+	termios = &tty->termios;
 	baud = tty_get_baud_rate(tty);
 
 	bits = (termios->c_cflag & CSIZE) == CS7 ? 9 : 10;
-- 
2.7.4