diff options
| author | Joshua Rogers <linux@joshua.hu> | 2026-08-03 16:10:55 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-23 12:20:27 +0200 |
| commit | 03b49c991abb8d021ca6fe51cd173447236b0552 (patch) | |
| tree | 318aff4ed7e2b361b669e5bb80803df42ae8b747 /tools/lib/python | |
| parent | 1f71f565e3585da1098ff19ca3c24687dab59185 (diff) | |
| download | linux-next-03b49c991abb8d021ca6fe51cd173447236b0552.tar.gz linux-next-03b49c991abb8d021ca6fe51cd173447236b0552.zip | |
tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
with vcc_event() LDC callbacks that read port->tty under port->lock and
then use tty->port. This can cause a use-after-free when the callback
dereferences tty->port after cleanup has already destroyed and freed it.
Assisted-by: AISLE:Snapshot
Cc: stable <stable@kernel.org>
Signed-off-by: Joshua Rogers <linux@joshua.hu>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://patch.msgid.link/20260803-aisle-tty-vcc-v2-2-a50bc9b15193@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions