sunsu: Fix use after free in su_remove(). (9616ff43) · Commits · 戴 / test

Real serial port 'up' objects are statically allocated from an array in the driver. Keyboard and mouse ports, on the other hand, are dynamically allocated. Unfortunately, we free these dynamic 'up' objects before we unmap the I/O registers. Rearrange su_remove() so that this does not happen. Noticed by Julia Lawall. Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/serial/sunsu.c

+9 −4

Original line number	Diff line number	Diff line
		@@ -1500,20 +1500,25 @@ out_unmap:
		static int __devexit su_remove(struct of_device *op)
		{
		struct uart_sunsu_port *up = dev_get_drvdata(&op->dev);
		bool kbdms = false;

		if (up->su_type == SU_PORT_MS \|\|
		up->su_type == SU_PORT_KBD) {
		up->su_type == SU_PORT_KBD)
		kbdms = true;

		if (kbdms) {
		#ifdef CONFIG_SERIO
		serio_unregister_port(&up->serio);
		#endif
		kfree(up);
		} else if (up->port.type != PORT_UNKNOWN) {
		} else if (up->port.type != PORT_UNKNOWN)
		uart_remove_one_port(&sunsu_reg, &up->port);
		}

		if (up->port.membase)
		of_iounmap(&op->resource[0], up->port.membase, up->reg_size);

		if (kbdms)
		kfree(up);

		dev_set_drvdata(&op->dev, NULL);

		return 0;

Admin message