Re: [PATCH 2/2] serdev: use tty_port_tty_get() in ttyport_write_buf() to prevent UAF

[Jiri Slaby <jirislaby@kernel.org>]

On 31. 07. 26, 10:06, Greg Kroah-Hartman wrote:
> From: Joshua Rogers <linux@joshua.hu>
> 
> ttyport_write_buf() snapshots serport->tty as a raw pointer without
> taking a reference, while ttyport_close() can concurrently release the
> tty via tty_release_struct(), leading to a use-after-free. Use
> tty_port_tty_get() to obtain a reference-counted tty pointer, matching
> the pattern already used by ttyport_write_wakeup().
> 
> Assisted-by: AISLE:Snapshot
> Cc: stable <stable@kernel.org>
> Signed-off-by: Joshua Rogers <linux@joshua.hu>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>   drivers/tty/serdev/serdev-ttyport.c | 12 ++++++++++--
>   1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
> index 48ce5b3f8308..4d37c8130dd7 100644
> --- a/drivers/tty/serdev/serdev-ttyport.c
> +++ b/drivers/tty/serdev/serdev-ttyport.c
> @@ -85,13 +85,21 @@ static const struct tty_port_client_operations client_ops = {
>   static ssize_t ttyport_write_buf(struct serdev_controller *ctrl, const u8 *data, size_t len)
>   {
>   	struct serport *serport = serdev_controller_get_drvdata(ctrl);
> -	struct tty_struct *tty = serport->tty;
> +	struct tty_struct *tty;
> +	ssize_t ret;
>   
>   	if (!test_bit(SERPORT_ACTIVE, &serport->flags))
>   		return 0;
>   
> +	tty = tty_port_tty_get(serport->port);
> +	if (!tty)
> +		return 0;
> +
>   	set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
> -	return tty->ops->write(serport->tty, data, len);
> +	ret = tty->ops->write(tty, data, len);
> +	tty_kref_put(tty);

Here,

   scope_guard(tty_port_tty, serport->port) {
     struct tty_struct *tty = scoped_tty();

     set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
     return tty->ops->write(serport->tty, data, len);
   }

   return 0;

appears to be cleaner.

thanks,
-- 
js
suse labs