[PATCH v2 0/2] tty: vcc: Some small vcc bugfixes found by code scans

[PATCH v2 0/2] tty: vcc: Some small vcc bugfixes found by code scans

[Greg Kroah-Hartman]

Joshua at AISLE has been kind enough to run a bunch of scans on the
tty/serial code and here are two minor fixes for the vcc code that the
tools found.

One note, is this code even used anymore?  Seems to be sparc-specific,
just wanted to know if this platform is still alive?  If not, I'll be
glad to delete this file :)

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Changes in v2:
- change to use scoped_guard() in patch 2
- Link to v1: https://patch.msgid.link/20260731-aisle-tty-vcc-v1-0-962e18beb8a8@linuxfoundation.org

---
Joshua Rogers (2):
      tty: vcc: zero-initialize control packet in vcc_send_ctl()
      tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

 drivers/tty/vcc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
---
base-commit: 075b74841bd0065a3bda3440873c747938e69b68
change-id: 20260731-aisle-tty-vcc-8ea9ace26f6f

Best regards,
--  
Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[PATCH v2 1/2] tty: vcc: zero-initialize control packet in vcc_send_ctl()

[Greg Kroah-Hartman]

From: Joshua Rogers <linux@joshua.hu>

The stack-allocated struct vio_vcc pkt was partially initialized,
leaving the tag.stype_env field uninitialized before being sent via
ldc_write(), potentially leaking kernel stack data to the LDC peer.

Assisted-by: AISLE:Snapshot
Cc: stable <stable@kernel.org>
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vcc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c
index 27a55465bf5e..3947bd2b75ac 100644
--- a/drivers/tty/vcc.c
+++ b/drivers/tty/vcc.c
@@ -492,7 +492,7 @@ static ssize_t domain_show(struct device *dev,
 
 static int vcc_send_ctl(struct vcc_port *port, int ctl)
 {
-	struct vio_vcc pkt;
+	struct vio_vcc pkt = {};
 	int rv;
 
 	pkt.tag.type = VIO_TYPE_CTRL;

-- 
2.55.0

[PATCH v2 2/2] tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

[Greg Kroah-Hartman]

From: Joshua Rogers <linux@joshua.hu>

vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
with vcc_event() LDC callbacks that read port->tty under port->lock and
then use tty->port. This can cause a use-after-free when the callback
dereferences tty->port after cleanup has already destroyed and freed it.

Assisted-by: AISLE:Snapshot
Cc: stable <stable@kernel.org>
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/vcc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c
index 3947bd2b75ac..9adb533f7034 100644
--- a/drivers/tty/vcc.c
+++ b/drivers/tty/vcc.c
@@ -986,7 +986,8 @@ static void vcc_cleanup(struct tty_struct *tty)
 
 	port = vcc_get(tty->index, true);
 	if (port) {
-		port->tty = NULL;
+		scoped_guard(spinlock_irqsave, &port->lock)
+			port->tty = NULL;
 
 		if (port->removed) {
 			vcc_table_remove(tty->index);

-- 
2.55.0

Re: [PATCH v2 1/2] tty: vcc: zero-initialize control packet in vcc_send_ctl()

[Jiri Slaby]

On 03. 08. 26, 16:10, Greg Kroah-Hartman wrote:
> From: Joshua Rogers <linux@joshua.hu>
> 
> The stack-allocated struct vio_vcc pkt was partially initialized,
> leaving the tag.stype_env field uninitialized before being sent via
> ldc_write(), potentially leaking kernel stack data to the LDC peer.
> 
> Assisted-by: AISLE:Snapshot
> Cc: stable <stable@kernel.org>
> Signed-off-by: Joshua Rogers <linux@joshua.hu>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Reviewed-by: Jiri Slaby <jirislaby@kernel.org>

thanks,
-- 
js
suse labs

Re: [PATCH v2 2/2] tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

[Jiri Slaby]

On 03. 08. 26, 16:10, Greg Kroah-Hartman wrote:
> From: Joshua Rogers <linux@joshua.hu>
> 
> vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
> with vcc_event() LDC callbacks that read port->tty under port->lock and
> then use tty->port. This can cause a use-after-free when the callback
> dereferences tty->port after cleanup has already destroyed and freed it.
> 
> Assisted-by: AISLE:Snapshot
> Cc: stable <stable@kernel.org>
> Signed-off-by: Joshua Rogers <linux@joshua.hu>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Reviewed-by: Jiri Slaby <jirislaby@kernel.org>

thanks,
-- 
js
suse labs