[SRU,Xenial,Yakkety] 8250_pci: Fix potential use-after-free in error path

Submitted by Mauricio Faria de Oliveira on March 1, 2017, 10:07 p.m.

Details

Message ID 1488406036-26699-1-git-send-email-mauricfo@linux.vnet.ibm.com
State New
Headers show

Commit Message

Mauricio Faria de Oliveira March 1, 2017, 10:07 p.m.
BugLink: http://bugs.launchpad.net/bugs/1669153

Commit f209fa03fc9d ("serial: 8250_pci: Detach low-level driver during
PCI error recovery") introduces a potential use-after-free in case the
pciserial_init_ports call in serial8250_io_resume fails, which may
happen if a memory allocation fails or if the .init quirk failed for
whatever reason).  If this happen, further pci_get_drvdata will return a
pointer to freed memory.

This patch reworks the PCI recovery resume hook to restore the old priv
structure in this case, which should be ok, since the ports were already
detached. Such error during recovery causes us to give up on the
recovery.

Fixes: f209fa03fc9d ("serial: 8250_pci: Detach low-level driver during
  PCI error recovery")
Reported-by: Michal Suchanek <msuchanek@suse.com>
Signed-off-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry-picked from commit c130b666a9a711f985a0a44b58699ebe14bb7245)
Signed-off-by: Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>

---
 drivers/tty/serial/8250/8250_pci.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

Comments

Tim Gardner March 2, 2017, 12:52 p.m.

Mauricio Faria de Oliveira March 2, 2017, 1:38 p.m.
Oops, this patch's author is someone else; I missed something.
Thanks Cascardo for spotting it.

From: Gabriel Krisman Bertazi <krisman at linux.vnet.ibm.com>

Sorry,
Seth Forshee March 8, 2017, 8:59 p.m.
ACK contingent on the author getting fixed when applied.
Thadeu Lima de Souza Cascardo March 13, 2017, 12:58 p.m.
Applied to xenial and yakkety master-next branches.

Thanks.
Cascardo.

Patch hide | download patch | download mbox

diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index aa0166b..116436b 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -5642,17 +5642,15 @@  static pci_ers_result_t serial8250_io_slot_reset(struct pci_dev *dev)
 static void serial8250_io_resume(struct pci_dev *dev)
 {
 	struct serial_private *priv = pci_get_drvdata(dev);
-	const struct pciserial_board *board;
+	struct serial_private *new;
 
 	if (!priv)
 		return;
 
-	board = priv->board;
-	kfree(priv);
-	priv = pciserial_init_ports(dev, board);
-
-	if (!IS_ERR(priv)) {
-		pci_set_drvdata(dev, priv);
+	new = pciserial_init_ports(dev, priv->board);
+	if (!IS_ERR(new)) {
+		pci_set_drvdata(dev, new);
+		kfree(priv);
 	}
 }