From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Johan Hovold <johan@kernel.org>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 5.4 24/68] net: hso: fix muxed tty registration
Date: Mon, 27 Sep 2021 19:02:20 +0200 [thread overview]
Message-ID: <20210927170220.791697034@linuxfoundation.org> (raw)
In-Reply-To: <20210927170219.901812470@linuxfoundation.org>
From: Johan Hovold <johan@kernel.org>
commit e8f69b16ee776da88589b5271e3f46020efc8f6c upstream.
If resource allocation and registration fail for a muxed tty device
(e.g. if there are no more minor numbers) the driver should not try to
deregister the never-registered (or already-deregistered) tty.
Fix up the error handling to avoid dereferencing a NULL pointer when
attempting to remove the character device.
Fixes: 72dc1c096c70 ("HSO: add option hso driver")
Cc: stable@vger.kernel.org # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/hso.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2704,14 +2704,14 @@ struct hso_device *hso_create_mux_serial
serial = kzalloc(sizeof(*serial), GFP_KERNEL);
if (!serial)
- goto exit;
+ goto err_free_dev;
hso_dev->port_data.dev_serial = serial;
serial->parent = hso_dev;
if (hso_serial_common_create
(serial, 1, CTRL_URB_RX_SIZE, CTRL_URB_TX_SIZE))
- goto exit;
+ goto err_free_serial;
serial->tx_data_length--;
serial->write_data = hso_mux_serial_write_data;
@@ -2727,11 +2727,9 @@ struct hso_device *hso_create_mux_serial
/* done, return it */
return hso_dev;
-exit:
- if (serial) {
- tty_unregister_device(tty_drv, serial->minor);
- kfree(serial);
- }
+err_free_serial:
+ kfree(serial);
+err_free_dev:
kfree(hso_dev);
return NULL;
next prev parent reply other threads:[~2021-09-27 17:04 UTC|newest]
Thread overview: 75+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-27 17:01 [PATCH 5.4 00/68] 5.4.150-rc1 review Greg Kroah-Hartman
2021-09-27 17:01 ` [PATCH 5.4 01/68] ocfs2: drop acl cache for directories too Greg Kroah-Hartman
2021-09-27 17:01 ` [PATCH 5.4 02/68] usb: gadget: r8a66597: fix a loop in set_feature() Greg Kroah-Hartman
2021-09-27 17:01 ` [PATCH 5.4 03/68] usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 04/68] usb: dwc2: gadget: Fix ISOC transfer complete handling for DDMA Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 05/68] usb: musb: tusb6010: uninitialized data in tusb_fifo_write_unaligned() Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 06/68] cifs: fix incorrect check for null pointer in header_assemble Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 07/68] xen/x86: fix PV trap handling on secondary processors Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 08/68] usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 09/68] USB: serial: cp210x: add ID for GW Instek GDM-834x Digital Multimeter Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 10/68] USB: cdc-acm: fix minor-number release Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 11/68] binder: make sure fd closes complete Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 12/68] staging: greybus: uart: fix tty use after free Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 13/68] Re-enable UAS for LaCie Rugged USB3-FW with fk quirk Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 14/68] usb: core: hcd: Add support for deferring roothub registration Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 15/68] USB: serial: mos7840: remove duplicated 0xac24 device ID Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 16/68] USB: serial: option: add Telit LN920 compositions Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 17/68] USB: serial: option: remove duplicate USB device ID Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 18/68] USB: serial: option: add device id for Foxconn T99W265 Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 19/68] mcb: fix error handling in mcb_alloc_bus() Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 20/68] erofs: fix up erofs_lookup tracepoint Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 21/68] btrfs: prevent __btrfs_dump_space_info() to underflow its free space Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 22/68] xhci: Set HCD flag to defer primary roothub registration Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 23/68] serial: mvebu-uart: fix drivers tx_empty callback Greg Kroah-Hartman
2021-09-27 17:02 ` Greg Kroah-Hartman [this message]
2021-09-27 17:02 ` [PATCH 5.4 25/68] afs: Fix incorrect triggering of sillyrename on 3rd-party invalidation Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 26/68] platform/x86/intel: punit_ipc: Drop wrong use of ACPI_PTR() Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 27/68] enetc: Fix illegal access when reading affinity_hint Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 28/68] bnxt_en: Fix TX timeout when TX ring size is set to the smallest Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 29/68] net/smc: add missing error check in smc_clc_prfx_set() Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 30/68] gpio: uniphier: Fix void functions to remove return value Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 31/68] qed: rdma - dont wait for resources under hw error recovery flow Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 32/68] net/mlx4_en: Dont allow aRFS for encapsulated packets Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 33/68] scsi: iscsi: Adjust iface sysfs attr detection Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 34/68] tty: synclink_gt, drop unneeded forward declarations Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 35/68] tty: synclink_gt: rename a conflicting function name Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 36/68] fpga: machxo2-spi: Return an error on failure Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 37/68] fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 38/68] thermal/core: Potential buffer overflow in thermal_build_list_of_policies() Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 39/68] cifs: fix a sign extension bug Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 40/68] scsi: qla2xxx: Restore initiator in dual mode Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 41/68] scsi: lpfc: Use correct scnprintf() limit Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 42/68] irqchip/goldfish-pic: Select GENERIC_IRQ_CHIP to fix build Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 43/68] irqchip/gic-v3-its: Fix potential VPE leak on error Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 44/68] md: fix a lock order reversal in md_alloc Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 45/68] blktrace: Fix uaf in blk_trace access after removing by sysfs Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 46/68] net: macb: fix use after free on rmmod Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 47/68] net: stmmac: allow CSR clock of 300MHz Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 48/68] m68k: Double cast io functions to unsigned long Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 49/68] ipv6: delay fib6_sernum increase in fib6_add Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 50/68] bpf: Add oversize check before call kvcalloc() Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 51/68] xen/balloon: use a kernel thread instead a workqueue Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 52/68] nvme-multipath: fix ANA state updates when a namespace is not present Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 53/68] sparc32: page align size in arch_dma_alloc Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 54/68] blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 55/68] compiler.h: Introduce absolute_pointer macro Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 56/68] net: i825xx: Use absolute_pointer for memcpy from fixed memory location Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 57/68] sparc: avoid stringop-overread errors Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 58/68] qnx4: " Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 59/68] parisc: Use absolute_pointer() to define PAGE0 Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 60/68] arm64: Mark __stack_chk_guard as __ro_after_init Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 61/68] alpha: Declare virt_to_phys and virt_to_bus parameter as pointer to volatile Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 62/68] net: 6pack: Fix tx timeout and slot time Greg Kroah-Hartman
2021-09-27 17:02 ` [PATCH 5.4 63/68] spi: Fix tegra20 build with CONFIG_PM=n Greg Kroah-Hartman
2021-09-27 17:03 ` [PATCH 5.4 64/68] EDAC/synopsys: Fix wrong value type assignment for edac_mode Greg Kroah-Hartman
2021-09-27 17:03 ` [PATCH 5.4 65/68] thermal/drivers/int340x: Do not set a wrong tcc offset on resume Greg Kroah-Hartman
2021-09-27 17:03 ` [PATCH 5.4 66/68] arm64: dts: marvell: armada-37xx: Extend PCIe MEM space Greg Kroah-Hartman
2021-09-27 17:03 ` [PATCH 5.4 67/68] xen/balloon: fix balloon kthread freezing Greg Kroah-Hartman
2021-09-27 17:03 ` [PATCH 5.4 68/68] qnx4: work around gcc false positive warning bug Greg Kroah-Hartman
2021-09-27 17:49 ` [PATCH 5.4 00/68] 5.4.150-rc1 review Florian Fainelli
2021-09-27 22:59 ` Shuah Khan
2021-09-28 7:00 ` Jon Hunter
2021-09-28 9:26 ` Naresh Kamboju
2021-09-28 12:19 ` Sudip Mukherjee
2021-09-29 1:32 ` Samuel Zou
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210927170220.791697034@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox