linux-kernel - Re: [PATCH] tty_port: Restore tty port default ops on unregistering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200204094748.GG26725@localhost>
Date:   Tue, 4 Feb 2020 10:47:48 +0100
From:   Johan Hovold <johan@...nel.org>
To:     Loic Poulain <loic.poulain@...aro.org>
Cc:     gregkh@...uxfoundation.org, jslaby@...e.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] tty_port: Restore tty port default ops on unregistering

On Wed, Jan 29, 2020 at 09:07:04AM +0100, Loic Poulain wrote:
> When a port is unregistered from serdev, its serdev specific client_ops
> pointer is nullified, which can lead to future null pointer dereference.
> Fix that by restoring default client_ops when port is unregistered from
> serdev.

Hmm, yeah, this seems like something we should fix as 8250 appears to
allow reregistering ports, but...

> port registering/unregistering can happen several times, at least it
> happens when statically registered 8250 ISA port are replaced at boot
> time by e.g. device-tree defined 8250 ports.

How did the serdev controller get registered in the first place here if
you're talking about statically registered 8250 ISA ports (i.e. where is
the client defined)?

Did you actually ever hit this one?

> Signed-off-by: Loic Poulain <loic.poulain@...aro.org>
> ---
>  drivers/tty/tty_port.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
> index 044c3cb..bf893da 100644
> --- a/drivers/tty/tty_port.c
> +++ b/drivers/tty/tty_port.c
> @@ -203,8 +203,10 @@ void tty_port_unregister_device(struct tty_port *port,
>  	int ret;
>  
>  	ret = serdev_tty_port_unregister(port);
> -	if (ret == 0)
> +	if (ret == 0) {
> +		port->client_ops = &default_client_ops;
>  		return;
> +	}
>  
>  	tty_unregister_device(driver, index);
>  }

Johan