Re: [PATCH v2 2/2] tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
Jiri Slaby <[email protected]>
| Newsgroups | org.kernel.vger.sparclinux,org.kernel.vger.linux-kernel,org.kernel.vger.linux-serial |
|---|---|
| Message-ID | <[email protected]> |
On 03. 08. 26, 16:10, Greg Kroah-Hartman wrote: > From: Joshua Rogers <[email protected]> > > vcc_cleanup() sets port->tty to NULL without holding port->lock, racing > with vcc_event() LDC callbacks that read port->tty under port->lock and > then use tty->port. This can cause a use-after-free when the callback > dereferences tty->port after cleanup has already destroyed and freed it. > > Assisted-by: AISLE:Snapshot > Cc: stable <[email protected]> > Signed-off-by: Joshua Rogers <[email protected]> > Signed-off-by: Greg Kroah-Hartman <[email protected]> Reviewed-by: Jiri Slaby <[email protected]> thanks, -- js suse labs