mxser: fix xmit_buf leak in activate when LSR == 0xff

BugLink: https://bugs.launchpad.net/bugs/1969110
[ Upstream commit cd3a4907ee334b40d7aa880c7ab310b154fd5cd4 ]

When LSR is 0xff in ->activate() (rather unlike), we return an error.
Provided ->shutdown() is not called when ->activate() fails, nothing
actually frees the buffer in this case.

Fix this by properly freeing the buffer in a designated label. We jump
there also from the "!info->type" if now too.

Fixes: 6769140d3047 ("tty: mxser: use the tty_port_open method")
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Link: https://lore.kernel.org/r/20220124071430.14907-6-jslaby@suse.cz
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit b125b08dbee3611f03f53b71471813ed4ccafcdd)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>

diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c
index da375851af4e67fab4210ea3b94a9d83e386cb45..3b3e169c1f6990d2c7faa4a62d4f9755580843ec 100644 (file)
--- a/drivers/tty/mxser.c
+++ b/drivers/tty/mxser.c
@@ -711,6 +711,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
        struct mxser_port *info = container_of(port, struct mxser_port, port);
        unsigned long page;
        unsigned long flags;
+       int ret;
 
        page = __get_free_page(GFP_KERNEL);
        if (!page)
@@ -720,9 +721,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
 
        if (!info->type) {
                set_bit(TTY_IO_ERROR, &tty->flags);
-               free_page(page);
                spin_unlock_irqrestore(&info->slock, flags);
-               return 0;
+               ret = 0;
+               goto err_free_xmit;
        }
        info->port.xmit_buf = (unsigned char *) page;
 
@@ -748,8 +749,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
                if (capable(CAP_SYS_ADMIN)) {
                        set_bit(TTY_IO_ERROR, &tty->flags);
                        return 0;
-               } else
-                       return -ENODEV;
+               }
+
+               ret = -ENODEV;
+               goto err_free_xmit;
        }
 
        /*
@@ -794,6 +797,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty)
        spin_unlock_irqrestore(&info->slock, flags);
 
        return 0;
+err_free_xmit:
+       free_page(page);
+       info->port.xmit_buf = NULL;
+       return ret;
 }
 
 /*