mxser: fix xmit_buf leak in activate when LSR == 0xff

[ Upstream commit cd3a4907ee334b40d7aa880c7ab310b154fd5cd4 ]

When LSR is 0xff in ->activate() (rather unlike), we return an error.
Provided ->shutdown() is not called when ->activate() fails, nothing
actually frees the buffer in this case.

Fix this by properly freeing the buffer in a designated label. We jump
there also from the "!info->type" if now too.

Fixes: 6769140d3047 ("tty: mxser: use the tty_port_open method")
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20220124071430.14907-6-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
index 3703987c46661396bbf3c276a4ce295e3157ca0b..8344265a1948bf78acc66f836f79e75cd7d33f93 100644 (file)
--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -858,6 +858,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
        struct mxser_port *info = container_of(port, struct mxser_port, port);
        unsigned long page;
        unsigned long flags;
+       int ret;
 
        page = __get_free_page(GFP_KERNEL);
        if (!page)
@@ -867,9 +868,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
 
        if (!info->ioaddr || !info->type) {
                set_bit(TTY_IO_ERROR, &tty->flags);
-               free_page(page);
                spin_unlock_irqrestore(&info->slock, flags);
-               return 0;
+               ret = 0;
+               goto err_free_xmit;
        }
        info->port.xmit_buf = (unsigned char *) page;
 
@@ -895,8 +896,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
                if (capable(CAP_SYS_ADMIN)) {
                        set_bit(TTY_IO_ERROR, &tty->flags);
                        return 0;
-               } else
-                       return -ENODEV;
+               }
+
+               ret = -ENODEV;
+               goto err_free_xmit;
        }
 
        /*
@@ -941,6 +944,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
        spin_unlock_irqrestore(&info->slock, flags);
 
        return 0;
+err_free_xmit:
+       free_page(page);
+       info->port.xmit_buf = NULL;
+       return ret;
 }
 
 /*