NFC: nci: uart: Set tty->disc_data only in success path · Pull Request !17582 · openEuler/kernel

fix CVE-2025-38416
issue link:https://gitee.com/src-openeuler/kernel/issues/ICOXJS

commit 79b6ebf58be23d4a262cdd7dcd46d7e89206657a (HEAD -> CVE-2025-38416, origin/CVE-2025-38416)
Author: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Date:   Wed Jun 18 09:36:50 2025 +0200

NFC: nci: uart: Set tty->disc_data only in success path

stable inclusion
    from stable-v6.6.95
    commit a8acc7080ad55c5402a1b818b3008998247dda87
    category: bugfix
    bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXJS
    CVE: CVE-2025-38416

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a8acc7080ad55c5402a1b818b3008998247dda87

--------------------------------

commit fc27ab48904ceb7e4792f0c400f1ef175edf16fe upstream.

Setting tty->disc_data before opening the NCI device means we need to
    clean it up on error paths.  This also opens some short window if device
    starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded
    (broken hardware?).  Close the window by exposing tty->disc_data only on
    the success path, when opening of the NCI device and try_module_get()
    succeeds.

The code differs in error path in one aspect: tty->disc_data won't be
    ever assigned thus NULL-ified.  This however should not be relevant
    difference, because of "tty->disc_data=NULL" in nci_uart_tty_open().

Cc: Linus Torvalds <torvalds@linuxfoundation.org>
    Fixes: 9961127d4bce ("NFC: nci: add generic uart support")
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Link: https://patch.msgid.link/20250618073649.25049-2-krzysztof.kozlowski@linaro.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Yu Wu <wuyu06@inspur.com>

GVPopenEuler/kernel

搜索帮助

GVP openEuler/kernel