Re: [PATCH 2/2] tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

[Jiri Slaby]

On 31. 07. 26, 10:15, Greg Kroah-Hartman wrote:
> From: Joshua Rogers <linux@xxxxxxxxx>
>
> vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
> with vcc_event() LDC callbacks that read port->tty under port->lock and
> then use tty->port. This can cause a use-after-free when the callback
> dereferences tty->port after cleanup has already destroyed and freed it.
>
> Assisted-by: AISLE:Snapshot
> Cc: stable <stable@xxxxxxxxxx>
> Signed-off-by: Joshua Rogers <linux@xxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
>   drivers/tty/vcc.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c
> index 3947bd2b75ac..03ed8c692acd 100644
> --- a/drivers/tty/vcc.c
> +++ b/drivers/tty/vcc.c
> @@ -983,10 +983,13 @@ static int vcc_install(struct tty_driver *driver, struct tty_struct *tty)
>   static void vcc_cleanup(struct tty_struct *tty)
>   {
>   	struct vcc_port *port;
> +	unsigned long flags;
>   
>   	port = vcc_get(tty->index, true);
>   	if (port) {
> +		spin_lock_irqsave(&port->lock, flags);
>   		port->tty = NULL;
> +		spin_unlock_irqrestore(&port->lock, flags);

For these, I like

scope_guard(spinlock_irqsave, &port->lock)
  port->tty = NULL;

more, as well.

thanks,
--
js
suse labs