Patch "8250_pci: Fix potential use-after-free in error path" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

8250_pci: Fix potential use-after-free in error path

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
8250_pci-fix-potential-use-after-free-in-error-path.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Gabriel Krisman Bertazi <[email protected]>
Date: Wed, 28 Dec 2016 16:42:00 -0200
Subject: 8250_pci: Fix potential use-after-free in error path

From: Gabriel Krisman Bertazi <[email protected]>

commit c130b666a9a711f985a0a44b58699ebe14bb7245 upstream.

Commit f209fa03fc9d ("serial: 8250_pci: Detach low-level driver during PCI error recovery") introduces a potential use-after-free in case the pciserial_init_ports call in serial8250_io_resume fails, which may happen if a memory allocation fails or if the .init quirk failed for whatever reason). If this happen, further pci_get_drvdata will return a pointer to freed memory.

This patch reworks the PCI recovery resume hook to restore the old priv structure in this case, which should be ok, since the ports were already detached. Such error during recovery causes us to give up on the recovery.

---
 drivers/tty/serial/8250/8250_pci.c |   12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

@@ -5621,17 +5621,15 @@ static pci_ers_result_t serial8250_io_sl
 static void serial8250_io_resume(struct pci_dev *dev)
 {
 	struct serial_private *priv = pci_get_drvdata(dev);
-	const struct pciserial_board *board;
+	struct serial_private *new;
 
 	if (!priv)
 		return;
 
-	board = priv->board;
-	kfree(priv);
-	priv = pciserial_init_ports(dev, board);
-
-	if (!IS_ERR(priv)) {
-		pci_set_drvdata(dev, priv);
+	new = pciserial_init_ports(dev, priv->board);
+	if (!IS_ERR(new)) {
+		pci_set_drvdata(dev, new);
+		kfree(priv);
 	}
 }
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/8250_pci-fix-potential-use-after-free-in-error-path.patch