From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9B9E1E51FA; Mon, 23 Jun 2025 21:24:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750713871; cv=none; b=Taltqo4BVzqXL3ZJRZJUm3EZaT77sZE5zePCIC0w1JzqlwEGt00kJvkOqWto3vAtgwAyB2s4Ez2mKKP4hxOy1xF9FSaI9t4YZJBV2JmlB0sFb9EMCvUJpwOUuRGt0sp1LYS4jPxYgmTIEKWYVaJzzxAnqCECk06g9fQRGXK5pt4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750713871; c=relaxed/simple; bh=EFIFhzGF5UamCc9ROWph60/lp2yTETaJx+rInjPj3Cc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bQzc9SXO3wg4ehLf9MBFk6gbpt+2yK3b8fotI7VnYBvggiVLWEJFQ0rb3kTBP2R+QQiRK8al9080RAeLGsVVEHZDDkT+VFWMY6lF+YjENOaKCojyNX2wy3d3fbiqD/W6YgNMP082rit4vmxL9xKxudStHDthRbELAgCclnjmD2E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QdGSQDv4; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="QdGSQDv4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 735E1C4CEEA; Mon, 23 Jun 2025 21:24:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1750713871; bh=EFIFhzGF5UamCc9ROWph60/lp2yTETaJx+rInjPj3Cc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QdGSQDv41St8/voHPMPBkWu5ELDI+DsKrVMW9uZmr/LJ54Pzd2bcaxrtPHzzHUt5L EoHArdUDjTOfHhIGPpZ9HxTaKA75tkg9uwLs3LsjbCepwscXeKZF/HEvF5s2QbE6rF QiAmzI9i9ezYfVGtDBtbNf6/LLqKfBrdBpDlF+wU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Linus Torvalds , Krzysztof Kozlowski , Jakub Kicinski Subject: [PATCH 5.10 191/355] NFC: nci: uart: Set tty->disc_data only in success path Date: Mon, 23 Jun 2025 15:06:32 +0200 Message-ID: <20250623130632.421372594@linuxfoundation.org> X-Mailer: git-send-email 2.50.0 In-Reply-To: <20250623130626.716971725@linuxfoundation.org> References: <20250623130626.716971725@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Krzysztof Kozlowski commit fc27ab48904ceb7e4792f0c400f1ef175edf16fe upstream. Setting tty->disc_data before opening the NCI device means we need to clean it up on error paths. This also opens some short window if device starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded (broken hardware?). Close the window by exposing tty->disc_data only on the success path, when opening of the NCI device and try_module_get() succeeds. The code differs in error path in one aspect: tty->disc_data won't be ever assigned thus NULL-ified. This however should not be relevant difference, because of "tty->disc_data=NULL" in nci_uart_tty_open(). Cc: Linus Torvalds Fixes: 9961127d4bce ("NFC: nci: add generic uart support") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20250618073649.25049-2-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/nfc/nci/uart.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/net/nfc/nci/uart.c +++ b/net/nfc/nci/uart.c @@ -131,22 +131,22 @@ static int nci_uart_set_driver(struct tt memcpy(nu, nci_uart_drivers[driver], sizeof(struct nci_uart)); nu->tty = tty; - tty->disc_data = nu; skb_queue_head_init(&nu->tx_q); INIT_WORK(&nu->write_work, nci_uart_write_work); spin_lock_init(&nu->rx_lock); ret = nu->ops.open(nu); if (ret) { - tty->disc_data = NULL; kfree(nu); + return ret; } else if (!try_module_get(nu->owner)) { nu->ops.close(nu); - tty->disc_data = NULL; kfree(nu); return -ENOENT; } - return ret; + tty->disc_data = nu; + + return 0; } /* ------ LDISC part ------ */