Commit cd3a4907 authored by Jiri Slaby's avatar Jiri Slaby Committed by Greg Kroah-Hartman
Browse files

mxser: fix xmit_buf leak in activate when LSR == 0xff 



When LSR is 0xff in ->activate() (rather unlike), we return an error.
Provided ->shutdown() is not called when ->activate() fails, nothing
actually frees the buffer in this case.

Fix this by properly freeing the buffer in a designated label. We jump
there also from the "!info->type" if now too.

Fixes: 6769140d ("tty: mxser: use the tty_port_open method")
Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20220124071430.14907-6-jslaby@suse.cz


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d56738a3

drivers/tty/mxser.c

+11 −4
Original line number Original line Diff line number Diff line
@@ -744,6 +744,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) 
	struct mxser_port *info = container_of(port, struct mxser_port, port);

	struct mxser_port *info = container_of(port, struct mxser_port, port);

	unsigned long page;

	unsigned long page;

	unsigned long flags;

	unsigned long flags;

	int ret;





	page = __get_free_page(GFP_KERNEL);

	page = __get_free_page(GFP_KERNEL);

	if (!page)

	if (!page)
@@ -753,9 +754,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) 




	if (!info->type) {

	if (!info->type) {

		set_bit(TTY_IO_ERROR, &tty->flags);

		set_bit(TTY_IO_ERROR, &tty->flags);

		free_page(page);

		spin_unlock_irqrestore(&info->slock, flags);

		spin_unlock_irqrestore(&info->slock, flags);

		return 0;

		ret = 0;

		goto err_free_xmit;

	}

	}

	info->port.xmit_buf = (unsigned char *) page;

	info->port.xmit_buf = (unsigned char *) page;
@@ -775,8 +776,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) 
		if (capable(CAP_SYS_ADMIN)) {

		if (capable(CAP_SYS_ADMIN)) {

			set_bit(TTY_IO_ERROR, &tty->flags);

			set_bit(TTY_IO_ERROR, &tty->flags);

			return 0;

			return 0;

		} else

		}

			return -ENODEV;



		ret = -ENODEV;

		goto err_free_xmit;

	}

	}





	/*

	/*
@@ -821,6 +824,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) 
	spin_unlock_irqrestore(&info->slock, flags);

	spin_unlock_irqrestore(&info->slock, flags);





	return 0;

	return 0;

err_free_xmit:

	free_page(page);

	info->port.xmit_buf = NULL;

	return ret;

}

}





/*

/*