| Message ID | 20210426081149.10498-1-johan@kernel.org |
|---|---|
| State | New |
| Headers | show |
| Series | net: hso: fix NULL-deref on disconnect regression | expand |
On Mon, Apr 26, 2021 at 11:29:11AM +0200, Leonardo Antoniazzi wrote: > On Mon, 26 Apr 2021 10:11:49 +0200 > Johan Hovold <johan@kernel.org> wrote: > > > Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device > > unregistration") fixed the racy minor allocation reported by syzbot, but > > introduced an unconditional NULL-pointer dereference on every disconnect > > instead. > > > > Specifically, the serial device table must no longer be accessed after > > the minor has been released by hso_serial_tty_unregister(). > > > > Fixes: 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration") > > Cc: stable@vger.kernel.org > > Cc: Anirudh Rayabharam <mail@anirudhrb.com> > > Reported-by: Leonardo Antoniazzi <leoanto@aruba.it> > > Signed-off-by: Johan Hovold <johan@kernel.org> > > --- > the patch fix the problem Thanks for confirming. Next time, please keep the CC list intact when replying so that everyone sees that you've tested it. Johan
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index 9bc58e64b5b7..3ef4b2841402 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -3104,7 +3104,7 @@ static void hso_free_interface(struct usb_interface *interface) cancel_work_sync(&serial_table[i]->async_put_intf); cancel_work_sync(&serial_table[i]->async_get_intf); hso_serial_tty_unregister(serial); - kref_put(&serial_table[i]->ref, hso_serial_ref_free); + kref_put(&serial->parent->ref, hso_serial_ref_free); } }
Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration") fixed the racy minor allocation reported by syzbot, but introduced an unconditional NULL-pointer dereference on every disconnect instead. Specifically, the serial device table must no longer be accessed after the minor has been released by hso_serial_tty_unregister(). Fixes: 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration") Cc: stable@vger.kernel.org Cc: Anirudh Rayabharam <mail@anirudhrb.com> Reported-by: Leonardo Antoniazzi <leoanto@aruba.it> Signed-off-by: Johan Hovold <johan@kernel.org> --- drivers/net/usb/hso.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)