Commit 3f3c125c authored by Wang Weiyang's avatar Wang Weiyang Committed by Gu Bowen
Browse files

tty: goldfish: Use tty_port_destroy() to destroy port 

stable inclusion
from stable-v4.19.247
commit 326192b99c903a2193d820c30ed936cc2402382c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6XS
CVE: CVE-2022-49399

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=326192b99c903a2193d820c30ed936cc2402382c



--------------------------------

[ Upstream commit 507b0506 ]

In goldfish_tty_probe(), the port initialized through tty_port_init()
should be destroyed in error paths.In goldfish_tty_remove(), qtty->port
also should be destroyed or else might leak resources.

Fix the above by calling tty_port_destroy().

Fixes: 666b7793 ("goldfish: tty driver")
Reviewed-by: default avatarJiri Slaby <jirislaby@kernel.org>
Signed-off-by: default avatarWang Weiyang <wangweiyang2@huawei.com>
Link: https://lore.kernel.org/r/20220328115844.86032-1-wangweiyang2@huawei.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Conflicts:
	drivers/tty/goldfish.c
[Context conflicts due to commit 499e13aa ("tty: goldfish: Fix
free_irq() on remove") has merged.]
Signed-off-by: default avatarGu Bowen <gubowen5@huawei.com>
parent 75a88146

drivers/tty/goldfish.c

+2 −0
Original line number Diff line number Diff line
@@ -407,6 +407,7 @@ static int goldfish_tty_probe(struct platform_device *pdev) 
err_tty_register_device_failed:

	free_irq(irq, qtty);

err_dec_line_count:

	tty_port_destroy(&qtty->port);

	goldfish_tty_current_line_count--;

	if (goldfish_tty_current_line_count == 0)

		goldfish_tty_delete_driver();
@@ -428,6 +429,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) 
	iounmap(qtty->base);

	qtty->base = NULL;

	free_irq(qtty->irq, qtty);

	tty_port_destroy(&qtty->port);

	goldfish_tty_current_line_count--;

	if (goldfish_tty_current_line_count == 0)

		goldfish_tty_delete_driver();