diff options
| author | Shuangpeng Bai <shuangpeng.kernel@gmail.com> | 2026-03-05 22:40:06 -0500 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-03-09 18:47:55 -0700 |
| commit | 288598d80a068a0e9281de35bcb4ce495f189e2a (patch) | |
| tree | 352d14c91fa6a3b19c125390932af6cbb20469a0 /tools/perf/scripts/python | |
| parent | 87d126852158467ab87d5cbc36ccfd3f15464a6c (diff) | |
| download | linux-288598d80a068a0e9281de35bcb4ce495f189e2a.tar.gz linux-288598d80a068a0e9281de35bcb4ce495f189e2a.zip | |
serial: caif: hold tty->link reference in ldisc_open and ser_release
A reproducer triggers a KASAN slab-use-after-free in pty_write_room()
when caif_serial's TX path calls tty_write_room(). The faulting access
is on tty->link->port.
Hold an extra kref on tty->link for the lifetime of the caif_serial line
discipline: get it in ldisc_open() and drop it in ser_release(), and
also drop it on the ldisc_open() error path.
With this change applied, the reproducer no longer triggers the UAF in
my testing.
Link: https://gist.github.com/shuangpengbai/c898debad6bdf170a84be7e6b3d8707f
Link: https://lore.kernel.org/netdev/20260301220525.1546355-1-shuangpeng.kernel@gmail.com
Fixes: e31d5a05948e ("caif: tty's are kref objects so take a reference")
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260306034006.3395740-1-shuangpeng.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions