From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0362241A794 for ; Fri, 31 Jul 2026 18:19:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785521942; cv=none; b=LzbiQBb16CzQsCMVzOxR7z82Crt1quNH1N5wTgZql3NOAboO7vFiOWw+5a8y8qn2IXOhzGat9h6FcKOKNOnfS1RWa7SEAo4aet+U1zXj+p/P6kr4hLMFOJgrW+4xgZ92N9iEGLMh5eQrTH+ZV8GojnwSVXu2iTRDo3evtgAZlRw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785521942; c=relaxed/simple; bh=SJRRGxOTPHxzTyKNjhPZiDQLH8oJZ0bbZe6wvXlfvs0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=hVxzpozItg8EqbP9InSHTA8zb+OfGUV4SMvO/10NiXYlTubW7MzEDMRRPWmLpMZl9OBlkDMqL2MTDwWf4qVTAMm5Kjb7HcEmHfjRDK1rcFnYoa9nfiKPh1NjifrzHraCqtREEenAsMxovD+eK/LMYDwyyGh6SctAeeb8Zc49dV8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SwsWsvWc; arc=none smtp.client-ip=209.85.221.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SwsWsvWc" Received: by mail-wr1-f54.google.com with SMTP id ffacd0b85a97d-47f707e5d75so1039113f8f.1 for ; Fri, 31 Jul 2026 11:18:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785521938; x=1786126738; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ov0n2RcORghbpUiI0SclFJ455T7zBH3NXkUIJ9HOsqI=; b=SwsWsvWc4BBT4JDMWM+dkt721JDhd5755F7Lm/U8nHxlfV3kSeRs8K2cyipWxUrZHo 8wf+Gn9hFbRp0N0iQqZ+uRUBP1ZXEr1JxHbepEY2VxPmgD7ZL2jkiU2ZI1eEFGt4DEuD Eh6s9ABxYFiXxe0aK7ybGNOi+K+Jn6MEhLspx4D1J299svFntBWIb4ZkAaua4xh0Z24y 8CVSzMx6VPIGA8JMGJOQ4YXn/86IMy0XLrsphXN6NTQz6YenTQXXwtrgVCAnJTsbfw46 yGvbRRWSfkCU9KVXZyigxWOB6V//RRf/BZ5o2RZelc7GZbplN9v3TE8OvweC1MXdQN43 a5ug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785521938; x=1786126738; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ov0n2RcORghbpUiI0SclFJ455T7zBH3NXkUIJ9HOsqI=; b=QjzftsSqJyDVi/A/MQ89nPsoH3wFKsIb+AxnsaGN/fjRPyDxeeLxoPxR6SttTAiXkc pJnSv7IXxSWf1dAZBluUcCFvwAdZ7UEyfN3aPwW7qCvb9Srk2v971rltydJvvUZgstxu U60kDqauU6yIMaRu5/j3p3EN2SYGpkc7y8T4FvJs51RSPKmS5B8WgwKWWBSENVgx1FYJ /Apr2fQuo+t8uQrzuna5nSqcpXtrjS9dI2UKGYflP9MN6+GVcCACuH4q8gblKPdOZvuQ NaRx8qcAtw+AwTKo9/LnXyx0d8SQ1mj/UVkKG377yqOglPBXVZgASvHAHnOur7agSF7J DM5Q== X-Forwarded-Encrypted: i=1; AHgh+Rpzmv2rNhTMhzzvtPaKS/AmSBpq9Ui07uycFrFJRoPO5mE6sBSUh049q7fSI9d0kvq27/fZKIzV9fQcaIw=@vger.kernel.org X-Gm-Message-State: AOJu0Yyw3mM0Q96WEGIBkDhfYshiGqMkw/DIG4unRqxga05SW1qpEGFH Xnx34rVmc9UL6Pt5RdOuWkvae+nvm9t2W9W9/x1+Jq+oF7r7ou9mS6GLkiIFdd66 X-Gm-Gg: AR+sD12Le9zXOE+rPueabfKcn8x3/Wd5TYVN7sx5od+9sqCFaDJREWi+cY80IMf3mEL ao9WACP4shmHodeQhZJUCKrkWUg6/y5/rd8+qViNc6gnAaYRKde2m1FyeDyce30ioD2d9EZ1iAm 8MX0dXb+T6wZEbI35FnqHXs2zsvkkKDIRQf6eUvBsZD2ACqE6A9GRlPnAfbn2YAQGrnseHeniR2 S1AC+jIve6GCk32EY7RHfa5lQ2MB6VDBBhgiF6dOky5ohPpf8a5/tWz0LadLUqA0P+I64f68Nih ebZRzf6R4YU91WhE0snZE63NFroG7NLdGL9gPxd9DHVrBhfpe0SbXDBQGUEqTgpFBAs47gxa5nj YxvDfv9JkTfCON9CUNFyQIaNp2ZNydFxwK8ClvGJY30ySIPvUksLke0OvckiKij1pEAsV8B0aUT n8TAkwgkzna8t4UCYkoopN3kbYyWwOQnpCpPmrbvrINL13rIotthQ3t/JglNoSWPw6auiJWoL2t JYJBdiEihNS4x/lTRkFxOiwGunkXTQrAc9QZPIyy60nyieDl9jtyQ/mr94vVYi2GB6BhrfYjb4O nKuo/m8fG4qgHDKtbHjsZmUrD7V88bkjVOR5LPU2NWQ8z9l5SqGKyjeaXD5hvajjLcgH X-Received: by 2002:a05:6000:40c9:b0:475:f0f0:9ec9 with SMTP id ffacd0b85a97d-47fd732cfdcmr1364879f8f.52.1785521938332; Fri, 31 Jul 2026 11:18:58 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-a8d0-bc01-6d31-3d12-3a11-d2d0.310.pool.telefonica.de. [2a02:3100:a8d0:bc01:6d31:3d12:3a11:d2d0]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47fd41d1756sm7293694f8f.4.2026.07.31.11.18.56 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 31 Jul 2026 11:18:56 -0700 (PDT) From: Karl Mehltretter To: Greg Kroah-Hartman , Jiri Slaby Cc: Karl Mehltretter , linux-serial@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v4 4/5] tty: clear cdev pointer after cdev_add() failure Date: Fri, 31 Jul 2026 20:18:43 +0200 Message-Id: <20260731181844.11330-5-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260731181844.11330-1-kmehltretter@gmail.com> References: <20260731181844.11330-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit tty_cdev_add() drops the cdev reference when cdev_add() fails, but leaves driver->cdevs[index] pointing to freed memory. tty_unregister_device() later passes that stale pointer to cdev_del(), causing a use-after-free. Clear the slot after dropping the reference. Fixes: c1a752ba2d6b ("tty: don't leak cdev in tty_cdev_add()") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter --- drivers/tty/tty_io.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index e742bf9d8631..4889076b975f 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -3167,8 +3167,10 @@ static int tty_cdev_add(struct tty_driver *driver, dev_t dev, driver->cdevs[index]->ops = &tty_fops; driver->cdevs[index]->owner = driver->owner; err = cdev_add(driver->cdevs[index], dev, count); - if (err) + if (err) { kobject_put(&driver->cdevs[index]->kobj); + driver->cdevs[index] = NULL; + } return err; } -- 2.53.0