[PATCH 2/2] tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

From: Joshua Rogers <[email protected]>

vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
with vcc_event() LDC callbacks that read port->tty under port->lock and
then use tty->port. This can cause a use-after-free when the callback
dereferences tty->port after cleanup has already destroyed and freed it.

Assisted-by: AISLE:Snapshot
Cc: stable <[email protected]>
Signed-off-by: Joshua Rogers <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
 drivers/tty/vcc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c
index 3947bd2b75ac..03ed8c692acd 100644
--- a/drivers/tty/vcc.c
+++ b/drivers/tty/vcc.c
@@ -983,10 +983,13 @@ static int vcc_install(struct tty_driver *driver, struct tty_struct *tty)
 static void vcc_cleanup(struct tty_struct *tty)
 {
 	struct vcc_port *port;
+	unsigned long flags;
 
 	port = vcc_get(tty->index, true);
 	if (port) {
+		spin_lock_irqsave(&port->lock, flags);
 		port->tty = NULL;
+		spin_unlock_irqrestore(&port->lock, flags);
 
 		if (port->removed) {
 			vcc_table_remove(tty->index);

-- 
2.55.0