From: Johan Hovold Date: Mon, 26 Apr 2021 08:11:49 +0000 (+0200) Subject: net: hso: fix NULL-deref on disconnect regression X-Git-Tag: v5.15~1236^2~31 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=2ad5692db72874f02b9ad551d26345437ea4f7f3;p=platform%2Fkernel%2Flinux-starfive.git net: hso: fix NULL-deref on disconnect regression Commit 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration") fixed the racy minor allocation reported by syzbot, but introduced an unconditional NULL-pointer dereference on every disconnect instead. Specifically, the serial device table must no longer be accessed after the minor has been released by hso_serial_tty_unregister(). Fixes: 8a12f8836145 ("net: hso: fix null-ptr-deref during tty device unregistration") Cc: stable@vger.kernel.org Cc: Anirudh Rayabharam Reported-by: Leonardo Antoniazzi Signed-off-by: Johan Hovold Reviewed-by: Anirudh Rayabharam Signed-off-by: David S. Miller --- diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index 9bc58e6..3ef4b28 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -3104,7 +3104,7 @@ static void hso_free_interface(struct usb_interface *interface) cancel_work_sync(&serial_table[i]->async_put_intf); cancel_work_sync(&serial_table[i]->async_get_intf); hso_serial_tty_unregister(serial); - kref_put(&serial_table[i]->ref, hso_serial_ref_free); + kref_put(&serial->parent->ref, hso_serial_ref_free); } }