iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mxser: fix xmit_buf leak in activate when LSR == 0xff

Browse Source 
[ Upstream commit cd3a4907ee334b40d7aa880c7ab310b154fd5cd4 ]

When LSR is 0xff in ->activate() (rather unlike), we return an error.
Provided ->shutdown() is not called when ->activate() fails, nothing
actually frees the buffer in this case.

Fix this by properly freeing the buffer in a designated label. We jump
there also from the "!info->type" if now too.

Fixes: 6769140d3047 ("tty: mxser: use the tty_port_open method")
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20220124071430.14907-6-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Jiri Slaby 2022-01-24 08:14:24 +01:00 committed by Greg Kroah-Hartman
parent 7a68abde36
commit b125b08dbe
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/tty/mxser.c
View File

@ -711,6 +711,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
struct mxser_port *info = container_of(port, struct mxser_port, port);
unsigned long page;
unsigned long flags;
int ret;
page = __get_free_page(GFP_KERNEL);
if (!page)
@ -720,9 +721,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
if (!info->type) {
set_bit(TTY_IO_ERROR, &tty->flags);
free_page(page);
spin_unlock_irqrestore(&info->slock, flags);
return 0;
ret = 0;
goto err_free_xmit;
}
info->port.xmit_buf = (unsigned char *) page;
@ -748,8 +749,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
if (capable(CAP_SYS_ADMIN)) {
set_bit(TTY_IO_ERROR, &tty->flags);
return 0;
} else
return -ENODEV;
}
ret = -ENODEV;
goto err_free_xmit;
}
/*
@ -794,6 +797,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
spin_unlock_irqrestore(&info->slock, flags);
return 0;
err_free_xmit:
free_page(page);
info->port.xmit_buf = NULL;
return ret;
}
/*