Skip to content

Commit caac2b5

Browse files
jhovoldTim Tianyang Chen
authored andcommitted
USB: serial: console: fix use-after-free after failed setup
Make sure to reset the USB-console port pointer when console setup fails in order to avoid having the struct usb_serial be prematurely freed by the console code when the device is later disconnected. Fixes: 73e487f ("[PATCH] USB console: fix disconnection issues") Cc: stable <[email protected]> # 2.6.18 Acked-by: Greg Kroah-Hartman <[email protected]> Signed-off-by: Johan Hovold <[email protected]> (cherry picked from commit 299d757) Orabug: 27206824 CVE: CVE-2017-16525 This bug is partly caused by a clean-up patch that is not merged in uek4, so it only needs 1 commit to fix it. Signed-off-by: Tim Tianyang Chen <[email protected]> Reviewed-by: Reviewed-by: Jack Vogel <[email protected]>
1 parent 6feeb96 commit caac2b5

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

drivers/usb/serial/console.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,7 @@ static int usb_console_setup(struct console *co, char *options)
189189
tty_kref_put(tty);
190190
reset_open_count:
191191
port->port.count = 0;
192+
info->port = NULL;
192193
usb_autopm_put_interface(serial->interface);
193194
error_get_interface:
194195
usb_serial_put(serial);

0 commit comments

Comments
 (0)