Re: [PATCH v2 2/2] tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

[Jiri Slaby]

On 03. 08. 26, 16:10, Greg Kroah-Hartman wrote:
> From: Joshua Rogers <linux@xxxxxxxxx>
>
> vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
> with vcc_event() LDC callbacks that read port->tty under port->lock and
> then use tty->port. This can cause a use-after-free when the callback
> dereferences tty->port after cleanup has already destroyed and freed it.
>
> Assisted-by: AISLE:Snapshot
> Cc: stable <stable@xxxxxxxxxx>
> Signed-off-by: Joshua Rogers <linux@xxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

Reviewed-by: Jiri Slaby <jirislaby@xxxxxxxxxx>

thanks,
--
js
suse labs