2021-11-15 13:44:28

by Johan Hovold

Subject: [PATCH 2/3] serial: liteuart: fix use-after-free and memleak on unbind

Deregister the port when unbinding the driver to prevent it from being
used after releasing the driver data and leaking memory allocated by
serial core.

Fixes: 1da81e5562fa ("drivers/tty/serial: add LiteUART driver")
Cc: [email protected] # 5.11
Cc: Filip Kokosinski <[email protected]>
Cc: Mateusz Holenko <[email protected]>
Cc: Stafford Horne <[email protected]>
Signed-off-by: Johan Hovold <[email protected]>
---
drivers/tty/serial/liteuart.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/liteuart.c b/drivers/tty/serial/liteuart.c
index f075f4ff5fcf..da792d0df790 100644
--- a/drivers/tty/serial/liteuart.c
+++ b/drivers/tty/serial/liteuart.c
@@ -295,6 +295,7 @@ static int liteuart_remove(struct platform_device *pdev)
struct uart_port *port = platform_get_drvdata(pdev);
struct liteuart_port *uart = to_liteuart_port(port);

+ uart_remove_one_port(&liteuart_driver, port);
xa_erase(&liteuart_array, uart->id);

return 0;
--
2.32.0

2021-11-16 00:10:05

by Stafford Horne

Subject: Re: [PATCH 2/3] serial: liteuart: fix use-after-free and memleak on unbind

On Mon, Nov 15, 2021 at 02:37:44PM +0100, Johan Hovold wrote:
> Deregister the port when unbinding the driver to prevent it from being
> used after releasing the driver data and leaking memory allocated by
> serial core.

This looks good to me. Just curious did you test this on a Litex SoC/FPGA?

> Fixes: 1da81e5562fa ("drivers/tty/serial: add LiteUART driver")
> Cc: [email protected] # 5.11
> Cc: Filip Kokosinski <[email protected]>
> Cc: Mateusz Holenko <[email protected]>
> Cc: Stafford Horne <[email protected]>
> Signed-off-by: Johan Hovold <[email protected]>

Reviewed-by: Stafford Horne <[email protected]>

> ---
> drivers/tty/serial/liteuart.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/tty/serial/liteuart.c b/drivers/tty/serial/liteuart.c
> index f075f4ff5fcf..da792d0df790 100644
> --- a/drivers/tty/serial/liteuart.c
> +++ b/drivers/tty/serial/liteuart.c
> @@ -295,6 +295,7 @@ static int liteuart_remove(struct platform_device *pdev)
> struct uart_port *port = platform_get_drvdata(pdev);
> struct liteuart_port *uart = to_liteuart_port(port);
>
> + uart_remove_one_port(&liteuart_driver, port);
> xa_erase(&liteuart_array, uart->id);
>
> return 0;
> --
> 2.32.0
>

2021-11-16 07:07:17

by Johan Hovold

Subject: Re: [PATCH 2/3] serial: liteuart: fix use-after-free and memleak on unbind

On Tue, Nov 16, 2021 at 06:15:05AM +0900, Stafford Horne wrote:
> On Mon, Nov 15, 2021 at 02:37:44PM +0100, Johan Hovold wrote:
> > Deregister the port when unbinding the driver to prevent it from being
> > used after releasing the driver data and leaking memory allocated by
> > serial core.
>
> This looks good to me. Just curious did you test this on a Litex
> SoC/FPGA?

No, this series has only been compile tested.

> > Fixes: 1da81e5562fa ("drivers/tty/serial: add LiteUART driver")
> > Cc: [email protected] # 5.11
> > Cc: Filip Kokosinski <[email protected]>
> > Cc: Mateusz Holenko <[email protected]>
> > Cc: Stafford Horne <[email protected]>
> > Signed-off-by: Johan Hovold <[email protected]>
>
> Reviewed-by: Stafford Horne <[email protected]>

Thanks for reviewing.

Johan