linux-kernel - [PATCH 2/3] serial: liteuart: fix use-after-free and memleak on unbind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20211115133745.11445-3-johan@kernel.org>
Date:   Mon, 15 Nov 2021 14:37:44 +0100
From:   Johan Hovold <johan@...nel.org>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Ilia Sergachev <silia@...z.ch>,
        Karol Gugala <kgugala@...micro.com>,
        Mateusz Holenko <mholenko@...micro.com>,
        linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org,
        Johan Hovold <johan@...nel.org>, stable@...r.kernel.org,
        Filip Kokosinski <fkokosinski@...micro.com>,
        Stafford Horne <shorne@...il.com>
Subject: [PATCH 2/3] serial: liteuart: fix use-after-free and memleak on unbind

Deregister the port when unbinding the driver to prevent it from being
used after releasing the driver data and leaking memory allocated by
serial core.

Fixes: 1da81e5562fa ("drivers/tty/serial: add LiteUART driver")
Cc: stable@...r.kernel.org      # 5.11
Cc: Filip Kokosinski <fkokosinski@...micro.com>
Cc: Mateusz Holenko <mholenko@...micro.com>
Cc: Stafford Horne <shorne@...il.com>
Signed-off-by: Johan Hovold <johan@...nel.org>
---
 drivers/tty/serial/liteuart.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/liteuart.c b/drivers/tty/serial/liteuart.c
index f075f4ff5fcf..da792d0df790 100644
--- a/drivers/tty/serial/liteuart.c
+++ b/drivers/tty/serial/liteuart.c
@@ -295,6 +295,7 @@ static int liteuart_remove(struct platform_device *pdev)
 	struct uart_port *port = platform_get_drvdata(pdev);
 	struct liteuart_port *uart = to_liteuart_port(port);
 
+	uart_remove_one_port(&liteuart_driver, port);
 	xa_erase(&liteuart_array, uart->id);
 
 	return 0;
-- 
2.32.0