Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

NFC: nci: uart: Set tty->disc_data only in success path

Setting tty->disc_data before opening the NCI device means we need to
clean it up on error paths. This also opens some short window if device
starts sending data, even before NCIUARTSETDRIVER IOCTL succeeded
(broken hardware?). Close the window by exposing tty->disc_data only on
the success path, when opening of the NCI device and try_module_get()
succeeds.

The code differs in error path in one aspect: tty->disc_data won't be
ever assigned thus NULL-ified. This however should not be relevant
difference, because of "tty->disc_data=NULL" in nci_uart_tty_open().

Cc: Linus Torvalds <torvalds@linuxfoundation.org>
Fixes: 9961127d4bce ("NFC: nci: add generic uart support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20250618073649.25049-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Krzysztof Kozlowski and committed by
Jakub Kicinski
fc27ab48 10876da9

+4 -4
+4 -4
net/nfc/nci/uart.c
··· 119 119 120 120 memcpy(nu, nci_uart_drivers[driver], sizeof(struct nci_uart)); 121 121 nu->tty = tty; 122 - tty->disc_data = nu; 123 122 skb_queue_head_init(&nu->tx_q); 124 123 INIT_WORK(&nu->write_work, nci_uart_write_work); 125 124 spin_lock_init(&nu->rx_lock); 126 125 127 126 ret = nu->ops.open(nu); 128 127 if (ret) { 129 - tty->disc_data = NULL; 130 128 kfree(nu); 129 + return ret; 131 130 } else if (!try_module_get(nu->owner)) { 132 131 nu->ops.close(nu); 133 - tty->disc_data = NULL; 134 132 kfree(nu); 135 133 return -ENOENT; 136 134 } 137 - return ret; 135 + tty->disc_data = nu; 136 + 137 + return 0; 138 138 } 139 139 140 140 /* ------ LDISC part ------ */