Re: [PATCH 2/2] serdev: use tty_port_tty_get() in ttyport_write_buf() to prevent UAF

--=-+oaxTSrBQKxiYHEjqZQz
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Fri, 2026-07-31 at 15:22 +0200, Greg Kroah-Hartman wrote:
> On Fri, Jul 31, 2026 at 01:00:30PM +0000, Markus Probst wrote:
> > On Fri, 2026-07-31 at 10:06 +0200, Greg Kroah-Hartman wrote:
> > > From: Joshua Rogers <[email protected]>
> > >=20
> > > ttyport_write_buf() snapshots serport->tty as a raw pointer without
> > > taking a reference, while ttyport_close() can concurrently release th=
e
> > > tty via tty_release_struct(), leading to a use-after-free. Use
> > > tty_port_tty_get() to obtain a reference-counted tty pointer, matchin=
g
> > > the pattern already used by ttyport_write_wakeup().
> > >=20
> > > Assisted-by: AISLE:Snapshot
> > > Cc: stable <[email protected]>
> > > Signed-off-by: Joshua Rogers <[email protected]>
> > > Signed-off-by: Greg Kroah-Hartman <[email protected]>
> > > ---
> > >  drivers/tty/serdev/serdev-ttyport.c | 12 ++++++++++--
> > >  1 file changed, 10 insertions(+), 2 deletions(-)
> > >=20
> > > diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev=
/serdev-ttyport.c
> > > index 48ce5b3f8308..4d37c8130dd7 100644
> > > --- a/drivers/tty/serdev/serdev-ttyport.c
> > > +++ b/drivers/tty/serdev/serdev-ttyport.c
> > > @@ -85,13 +85,21 @@ static const struct tty_port_client_operations cl=
ient_ops =3D {
> > >  static ssize_t ttyport_write_buf(struct serdev_controller *ctrl, con=
st u8 *data, size_t len)
> > >  {
> > >  	struct serport *serport =3D serdev_controller_get_drvdata(ctrl);
> > > -	struct tty_struct *tty =3D serport->tty;
> > > +	struct tty_struct *tty;
> > > +	ssize_t ret;
> > > =20
> > >  	if (!test_bit(SERPORT_ACTIVE, &serport->flags))
> > >  		return 0;
> > > =20
> > > +	tty =3D tty_port_tty_get(serport->port);
> > > +	if (!tty)
> > > +		return 0;
> > > +
> > >  	set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
> > > -	return tty->ops->write(serport->tty, data, len);
> > > +	ret =3D tty->ops->write(tty, data, len);
> > > +	tty_kref_put(tty);
> > > +
> > > +	return ret;
> > >  }
> > > =20
> > >  static void ttyport_write_flush(struct serdev_controller *ctrl)
> >=20
> > It should be the responsibility of the driver to ensure
> > `serdev_device_close` and `serdev_device_write_buf` are not called
> > concurrently.
> >=20
> > This also applies to
> > - serdev_device_set_baudrate
>=20
> Doesn't touch a tty structure, so why is the same reference count logic
> needed here?
It calls `ttyport_set_baudrate`.

>=20
> > - serdev_device_set_flow_control
It calls `ttyport_set_flow_control`.
>=20
> Same here.
>=20
> > - serdev_device_wait_until_sent
>=20
> Or here?
It calls `ttyport_wait_until_sent`.

See `struct serdev_controller_ops ctrl_ops` in `serdev-ttyport.c`.

All of those mentioned above call into tty_ functions. Obviously the
tty_struct pointer needs to be valid for those calls, which is only the
case if the device is open.

Thanks
- Markus Probst

>=20
> > and more, which currently iirc even introduce a null pointer
> > dereference if called with the serdev device closed.
> >=20
> > I don't see why `serdev_device_write_buf` needs special protection
> > here, which the other functions don't need for some reason.
>=20
> It's the access to the tty pointer that I think the issue is, right?
>=20
> > As with the previous patch, this still makes sense for hardening.
> > With scope_guard being used,
> >=20
> > Reviewed-by: Markus Probst <[email protected]>
>=20
> Great, thanks, I'll send out a v2 next week with that change made, as
> I've done it locally and will wait a bit.
>=20
> thanks,
>=20
> greg k-h

--=-+oaxTSrBQKxiYHEjqZQz
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQJPBAABCAA5FiEEgnQYxPSsWOdyMMRzNHYf+OetQ9IFAmpso18bFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyAAoJEDR2H/jnrUPSrQUP/1Q6GABcF0LuIQmqnCKx
uz961k7HQn6OPhQHvg7lgvw913NoqazwXpd9ipUcLB1Y9xYOBgCKhoEL3/rQXBi7
viMHwRMTvquKGYV2jrkTqZ0XkbM+8YBuRYwUq7HTrT9DnBvgxclSIHcXGldBrmkV
19VJAI117F0Qb4jAXZtvR+vCmggVxrOaIGcIlY/Kgfx1aSBx9N4Da07+R3SdAc5x
6rfX3p7jKvFzI03xPEqmsz/mIf0Xsga5NdvJH1dpxfZ2bBbMrBgrjcOJYJxLhjJy
obXqxDG7rCu7HaHp492sckkz9uXExQGRpFIoPJcoc56F5HQd1EUT+w6LFo1O6kZD
w/GiRidw9Rn5Zw70v4QMac5+V7pC1t0kqBw/eeiulK1zbUcPq44l9HHVofPSyLEU
ivvVRCbFPAMAIjmoqjwCd0ZbwOHTnVMBoccWDPgTCuepdlk4sW7cmeKkEUnSrfiR
jih98IlCdUWj0ZxtltDuSwsBC2S+lVqSah646y1ZFTMGEoMy3gHIcOfLQ+DAaDBC
kprCTpLC8f9YdMI343sfquQtFMreH/D6lf/XFHg4NcinoHIASZoQ6D2TPdQUWlbv
cjmpmVo14YLtPaR9a3qrPjfozSQnjsMe1uTZnmt2YODBFtqSH9oyeFjo/GhowcH/
+Q0T07yw7XqcARrmMM6IU5Sw
=r5dn
-----END PGP SIGNATURE-----

--=-+oaxTSrBQKxiYHEjqZQz--