diff options
| author | Karl Mehltretter <kmehltretter@gmail.com> | 2026-07-31 20:18:43 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-08-03 16:53:09 +0200 |
| commit | 6645856f0df3aeecd45519cb611415b4b89c2223 (patch) | |
| tree | 9e826018225771c3095db56386e8d33916804290 /include/linux/workqueue.h | |
| parent | c3b5623fd97648f2747444aa8932ae604662df93 (diff) | |
tty: clear cdev pointer after cdev_add() failure
tty_cdev_add() drops the cdev reference when cdev_add() fails, but
leaves driver->cdevs[index] pointing to freed memory.
tty_unregister_device() later passes that stale pointer to cdev_del(),
causing a use-after-free.
Clear the slot after dropping the reference.
Fixes: c1a752ba2d6b ("tty: don't leak cdev in tty_cdev_add()")
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20260731181844.11330-5-kmehltretter@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/linux/workqueue.h')
0 files changed, 0 insertions, 0 deletions