Re: [PATCH 2/2] serdev: use tty_port_tty_get() in ttyport_write_buf() to prevent UAF

--=-9ubk5P0CAZ1iIWTfmgD3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, 2026-07-31 at 10:06 +0200, Greg Kroah-Hartman wrote:
> From: Joshua Rogers <[email protected]>
>=20
> ttyport_write_buf() snapshots serport->tty as a raw pointer without
> taking a reference, while ttyport_close() can concurrently release the
> tty via tty_release_struct(), leading to a use-after-free. Use
> tty_port_tty_get() to obtain a reference-counted tty pointer, matching
> the pattern already used by ttyport_write_wakeup().
>=20
> Assisted-by: AISLE:Snapshot
> Cc: stable <[email protected]>
> Signed-off-by: Joshua Rogers <[email protected]>
> Signed-off-by: Greg Kroah-Hartman <[email protected]>
> ---
>  drivers/tty/serdev/serdev-ttyport.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
>=20
> diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/ser=
dev-ttyport.c
> index 48ce5b3f8308..4d37c8130dd7 100644
> --- a/drivers/tty/serdev/serdev-ttyport.c
> +++ b/drivers/tty/serdev/serdev-ttyport.c
> @@ -85,13 +85,21 @@ static const struct tty_port_client_operations client=
_ops =3D {
>  static ssize_t ttyport_write_buf(struct serdev_controller *ctrl, const u=
8 *data, size_t len)
>  {
>  	struct serport *serport =3D serdev_controller_get_drvdata(ctrl);
> -	struct tty_struct *tty =3D serport->tty;
> +	struct tty_struct *tty;
> +	ssize_t ret;
> =20
>  	if (!test_bit(SERPORT_ACTIVE, &serport->flags))
>  		return 0;
> =20
> +	tty =3D tty_port_tty_get(serport->port);
> +	if (!tty)
> +		return 0;
> +
>  	set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
> -	return tty->ops->write(serport->tty, data, len);
> +	ret =3D tty->ops->write(tty, data, len);
> +	tty_kref_put(tty);
> +
> +	return ret;
>  }
> =20
>  static void ttyport_write_flush(struct serdev_controller *ctrl)

It should be the responsibility of the driver to ensure
`serdev_device_close` and `serdev_device_write_buf` are not called
concurrently.

This also applies to
- serdev_device_set_baudrate
- serdev_device_set_flow_control
- serdev_device_wait_until_sent
and more, which currently iirc even introduce a null pointer
dereference if called with the serdev device closed.

I don't see why `serdev_device_write_buf` needs special protection
here, which the other functions don't need for some reason.

As with the previous patch, this still makes sense for hardening.
With scope_guard being used,

Reviewed-by: Markus Probst <[email protected]>


Thanks
- Markus Probst


--=-9ubk5P0CAZ1iIWTfmgD3
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQJPBAABCAA5FiEEgnQYxPSsWOdyMMRzNHYf+OetQ9IFAmpsnGwbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyAAoJEDR2H/jnrUPSfK8P/jc0o5PydQM2Kze0GhXR
CNIpoB7VD4wyqMichSSRja7U3vkm/nMR7+HnGq6x4Kw8d5/YLptLsr7gXTtIY7o3
87KBY3PyGOt+nO2LgDjw/yh+Km+buX5WehVoDE6+c0PZQK0IvVq1gNZT57VoNmHG
DMp8PwtnbwcalHr90sNZC0+GEztipo94d5CsE+WF/8taUCLRikGipRn7jQx+uyr0
YyofhX73v0qo8zbcwydU3zxdmJBuxDf61XN1YspwIKaoWQe1nyw5r+g+O4flC+wH
p9wHQS+cSsHaSnoeZ/0icDqcq5g7IWWgYeoHynOAlXkz9ai5Wpy/LMJKngH50j0C
yLRkjVcu+88gr90PyUhRW0IBdQWHYG3HnrIJ4xFOcVn2Uo/Qk9xJ48sA2afoqou+
vM3/Km0UR3jWltfs5G05RURI0kPt9mD7J/83sjKcbQYKOjnYXcKaM6HcE63mFdPl
oqbWJ1YOmtwAytDQqHlpbrlRdPnEIJbkUI3mdDLODq5h6sqGg/ccAuoAAhIvc/2F
KHIjznXHihMKVs9XiZfbVlFFEmUxvRUnRm9cZZPAZYmzaI71BmjG/mk3f7XUL2vD
iI3ctoKhquLLB0LSJpOlTezxcoPMiHysswuUYP/9WdMs5L50ELxplF3KcpbGenoR
RcdKXdt6nkiuj9vxYJaYZSSo
=0LCx
-----END PGP SIGNATURE-----

--=-9ubk5P0CAZ1iIWTfmgD3--