8250_pci: Fix potential use-after-free in error path
commitc130b666a9
upstream. Commitf209fa03fc
("serial: 8250_pci: Detach low-level driver during PCI error recovery") introduces a potential use-after-free in case the pciserial_init_ports call in serial8250_io_resume fails, which may happen if a memory allocation fails or if the .init quirk failed for whatever reason). If this happen, further pci_get_drvdata will return a pointer to freed memory. This patch reworks the PCI recovery resume hook to restore the old priv structure in this case, which should be ok, since the ports were already detached. Such error during recovery causes us to give up on the recovery. Fixes:f209fa03fc
("serial: 8250_pci: Detach low-level driver during PCI error recovery") Reported-by: Michal Suchanek <msuchanek@suse.com> Signed-off-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com> Signed-off-by: Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
3fbd2ba1da
commit
1bf9bc4813
|
@ -5621,17 +5621,15 @@ static pci_ers_result_t serial8250_io_slot_reset(struct pci_dev *dev)
|
|||
static void serial8250_io_resume(struct pci_dev *dev)
|
||||
{
|
||||
struct serial_private *priv = pci_get_drvdata(dev);
|
||||
const struct pciserial_board *board;
|
||||
struct serial_private *new;
|
||||
|
||||
if (!priv)
|
||||
return;
|
||||
|
||||
board = priv->board;
|
||||
kfree(priv);
|
||||
priv = pciserial_init_ports(dev, board);
|
||||
|
||||
if (!IS_ERR(priv)) {
|
||||
pci_set_drvdata(dev, priv);
|
||||
new = pciserial_init_ports(dev, priv->board);
|
||||
if (!IS_ERR(new)) {
|
||||
pci_set_drvdata(dev, new);
|
||||
kfree(priv);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue