This is a note to let you know that I've just added the patch titled USB: console: fix potential use after free to the 3.18-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: usb-console-fix-potential-use-after-free.patch and it can be found in the queue-3.18 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad Mon Sep 17 00:00:00 2001 From: Johan Hovold <johan@xxxxxxxxxx> Date: Mon, 5 Jan 2015 16:04:13 +0100 Subject: USB: console: fix potential use after free From: Johan Hovold <johan@xxxxxxxxxx> commit 32a4bf2e81ec378e5925d4e069e0677a6c86a6ad upstream. Use tty kref to release the fake tty in usb_console_setup to avoid use after free if the underlying serial driver has acquired a reference. Note that using the tty destructor release_one_tty requires some more state to be initialised. Fixes: 4a90f09b20f4 ("tty: usb-serial krefs") Signed-off-by: Johan Hovold <johan@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/usb/serial/console.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) --- a/drivers/usb/serial/console.c +++ b/drivers/usb/serial/console.c @@ -46,6 +46,8 @@ static struct console usbcons; * ------------------------------------------------------------ */ +static const struct tty_operations usb_console_fake_tty_ops = { +}; /* * The parsing of the command line works exactly like the @@ -137,14 +139,17 @@ static int usb_console_setup(struct cons goto reset_open_count; } kref_init(&tty->kref); - tty_port_tty_set(&port->port, tty); tty->driver = usb_serial_tty_driver; tty->index = co->index; init_ldsem(&tty->ldisc_sem); + INIT_LIST_HEAD(&tty->tty_files); + kref_get(&tty->driver->kref); + tty->ops = &usb_console_fake_tty_ops; if (tty_init_termios(tty)) { retval = -ENOMEM; - goto free_tty; + goto put_tty; } + tty_port_tty_set(&port->port, tty); } /* only call the device specific open if this @@ -162,7 +167,7 @@ static int usb_console_setup(struct cons serial->type->set_termios(tty, port, &dummy); tty_port_tty_set(&port->port, NULL); - kfree(tty); + tty_kref_put(tty); } set_bit(ASYNCB_INITIALIZED, &port->port.flags); } @@ -178,8 +183,8 @@ static int usb_console_setup(struct cons fail: tty_port_tty_set(&port->port, NULL); - free_tty: - kfree(tty); + put_tty: + tty_kref_put(tty); reset_open_count: port->port.count = 0; usb_autopm_put_interface(serial->interface); Patches currently in stable-queue which might be from johan@xxxxxxxxxx are queue-3.18/usb-console-fix-potential-use-after-free.patch queue-3.18/usb-cp210x-add-ids-for-cel-usb-sticks-and-meshworks-devices.patch queue-3.18/usb-keyspan-fix-null-deref-at-probe.patch queue-3.18/usb-cp210x-fix-id-for-production-cel-meshconnect-usb-stick.patch queue-3.18/gpio-fix-memory-and-reference-leaks-in-gpiochip_add-error-path.patch queue-3.18/usb-qcserial-option-make-at-urcs-work-for-sierra-wireless-mc73xx.patch queue-3.18/pinctrl-lantiq-remove-bogus-of_gpio_chip_add.patch queue-3.18/gpio-sysfs-fix-gpio-device-attribute-leak.patch queue-3.18/gpio-fix-memory-leak-and-sleep-while-atomic.patch queue-3.18/gpio-sysfs-fix-gpio-chip-device-attribute-leak.patch queue-3.18/usb-console-fix-uninitialised-ldisc-semaphore.patch queue-3.18/gpio-fix-sleep-while-atomic-in-gpiochip_remove.patch queue-3.18/leds-netxbig-fix-oops-at-probe-time.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html