All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Johan Hovold <johan@kernel.org>
Subject: [PATCH 4.4 27/28] USB: serial: console: fix use-after-free after failed setup
Date: Mon, 16 Oct 2017 18:12:20 +0200	[thread overview]
Message-ID: <20171016160924.831315583@linuxfoundation.org> (raw)
In-Reply-To: <20171016160923.478701091@linuxfoundation.org>

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 299d7572e46f98534033a9e65973f13ad1ce9047 upstream.

Make sure to reset the USB-console port pointer when console setup fails
in order to avoid having the struct usb_serial be prematurely freed by
the console code when the device is later disconnected.

Fixes: 73e487fdb75f ("[PATCH] USB console: fix disconnection issues")
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/console.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -189,6 +189,7 @@ static int usb_console_setup(struct cons
 	tty_kref_put(tty);
  reset_open_count:
 	port->port.count = 0;
+	info->port = NULL;
 	usb_autopm_put_interface(serial->interface);
  error_get_interface:
 	usb_serial_put(serial);

  parent reply	other threads:[~2017-10-16 16:14 UTC|newest]

Thread overview: 34+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-16 16:11 [PATCH 4.4 00/28] 4.4.93-stable review Greg Kroah-Hartman
2017-10-16 16:11 ` [PATCH 4.4 01/28] brcmfmac: add length check in brcmf_cfg80211_escan_handler() Greg Kroah-Hartman
2017-10-16 16:11 ` [PATCH 4.4 02/28] ext4: in ext4_seek_{hole,data}, return -ENXIO for negative offsets Greg Kroah-Hartman
2017-10-16 16:11 ` [PATCH 4.4 03/28] CIFS: Reconnect expired SMB sessions Greg Kroah-Hartman
2017-10-16 16:11 ` [PATCH 4.4 04/28] nl80211: Define policy for packet pattern attributes Greg Kroah-Hartman
2017-10-16 16:11 ` [PATCH 4.4 05/28] iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD Greg Kroah-Hartman
2017-10-16 16:11 ` [PATCH 4.4 06/28] rcu: Allow for page faults in NMI handlers Greg Kroah-Hartman
2017-11-09 15:17   ` [4.4,06/28] " Ben Hutchings
2017-11-09 17:35     ` Steven Rostedt
2017-11-09 17:56     ` Paul E. McKenney
2017-11-09 17:56       ` Paul E. McKenney
2017-10-16 16:12 ` [PATCH 4.4 07/28] USB: dummy-hcd: Fix deadlock caused by disconnect detection Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 08/28] MIPS: math-emu: Remove pr_err() calls from fpu_emu() Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 09/28] dmaengine: edma: Align the memcpy acnt array size with the transfer Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 10/28] HID: usbhid: fix out-of-bounds bug Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 12/28] KVM: nVMX: fix guest CR4 loading when emulating L2 to L1 exit Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 13/28] usb: renesas_usbhs: Fix DMAC sequence for receiving zero-length packet Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 14/28] iommu/amd: Finish TLB flush in amd_iommu_unmap() Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 15/28] ALSA: usb-audio: Kill stray URB at exiting Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 16/28] ALSA: seq: Fix use-after-free at creating a port Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 17/28] ALSA: seq: Fix copy_from_user() call inside lock Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 18/28] ALSA: caiaq: Fix stray URB at probe error path Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 19/28] ALSA: line6: Fix leftover URB at error-path during probe Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 20/28] usb: gadget: composite: Fix use-after-free in usb_composite_overwrite_options Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 21/28] direct-io: Prevent NULL pointer access in submit_page_section Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 22/28] fix unbalanced page refcounting in bio_map_user_iov Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 23/28] USB: serial: ftdi_sio: add id for Cypress WICED dev board Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 24/28] USB: serial: cp210x: add support for ELV TFD500 Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 25/28] USB: serial: option: add support for TP-Link LTE module Greg Kroah-Hartman
2017-10-16 16:12 ` [PATCH 4.4 26/28] USB: serial: qcserial: add Dell DW5818, DW5819 Greg Kroah-Hartman
2017-10-16 16:12 ` Greg Kroah-Hartman [this message]
2017-10-16 16:12 ` [PATCH 4.4 28/28] x86/alternatives: Fix alt_max_short macro to really be a max() Greg Kroah-Hartman
2017-10-17  0:02 ` [PATCH 4.4 00/28] 4.4.93-stable review Shuah Khan
2017-10-17  0:24 ` Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171016160924.831315583@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=johan@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.