diff options
| author | Lucas De Marchi <ldemarchi@nvidia.com> | 2026-08-06 17:21:03 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-02 14:27:28 +0200 |
| commit | 01b7bc0938061f2fd46e0094f6483d8c6c02f7d3 (patch) | |
| tree | 11abe092ccb5b62f2d1094903ac65245bbaca664 | |
| parent | 9ca3aab0829b0d05b8316b1565d1585989a5d51b (diff) | |
| download | linux-01b7bc0938061f2fd46e0094f6483d8c6c02f7d3.tar.gz linux-01b7bc0938061f2fd46e0094f6483d8c6c02f7d3.zip | |
xhci: dbgtty: Fix unregister on tty_register_driver() failure
commit a916fa66a43e10f63198b6ce978badffc678821a upstream.
If tty_register_driver() fails, it drops the reference, but fails to set
the global dbc_tty_driver to NULL, causing the unregister to be called
again when module exits.
On module unload dbc_tty_exit() only gates its cleanup on the driver
pointer being non-NULL, so it operates on the already-freed driver:
module_init(xhci_hcd_init)
xhci_hcd_init()
xhci_dbc_init() [return value ignored]
dbc_tty_init()
tty_register_driver() fails
tty_driver_kref_put() -> driver freed
(dbc_tty_driver left dangling)
...
module_exit(xhci_hcd_fini)
xhci_hcd_fini()
xhci_dbc_exit()
dbc_tty_exit()
if (dbc_tty_driver) -> true (dangling)
tty_unregister_driver() -> use-after-free
Fixes: 4521f1613940 ("xhci: dbctty: split dbc tty driver registration and unregistration functions.")
Cc: stable@vger.kernel.org # v5.10
Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lucas De Marchi <ldemarchi@nvidia.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260806142113.2436238-8-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/usb/host/xhci-dbgtty.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/usb/host/xhci-dbgtty.c b/drivers/usb/host/xhci-dbgtty.c index 32f8c3d40fb0..77068bf3c949 100644 --- a/drivers/usb/host/xhci-dbgtty.c +++ b/drivers/usb/host/xhci-dbgtty.c @@ -599,6 +599,7 @@ static int dbc_tty_init(void) pr_err("Can't register dbc tty driver\n"); tty_driver_kref_put(dbc_tty_driver); idr_destroy(&dbc_tty_minors); + dbc_tty_driver = NULL; } return ret; |