• Johan Hovold's avatar
    USB: ftdi_sio: fix use-after-free in TIOCMIWAIT · 6929b79f
    Johan Hovold authored
    commit 71ccb9b0 upstream.
    
    Use the port wait queue and make sure to check the serial disconnected
    flag before accessing private port data after waking up.
    
    This is is needed as the private port data (including the wait queue
    itself) can be gone when waking up after a disconnect.
    
    When switching to tty ports, some lifetime assumptions were changed.
    Specifically, close can now be called before the final tty reference is
    dropped as part of hangup at device disconnect. Even with the ftdi
    private-data refcounting this means that the port private data can be
    freed while a process is sleeping on modem-status changes and thus
    cannot be relied on to detect disconnects when woken up.
    Signed-off-by: default avatarJohan Hovold <jhovold@gmail.com>
    Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
    Cc: Yang Yingliang <yangyingliang@huawei.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    6929b79f
ftdi_sio.c 88.9 KB