CVE-2024-26998

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> serial: core: Clearing the circular buffer before NULLifying it<br /> <br /> The circular buffer is NULLified in uart_tty_port_shutdown()<br /> under the spin lock. However, the PM or other timer based callbacks<br /> may still trigger after this event without knowning that buffer pointer<br /> is not valid. Since the serial code is a bit inconsistent in checking<br /> the buffer state (some rely on the head-tail positions, some on the<br /> buffer pointer), it&amp;#39;s better to have both aligned, i.e. buffer pointer<br /> to be NULL and head-tail possitions to be the same, meaning it&amp;#39;s empty.<br /> This will prevent asynchronous calls to dereference NULL pointer as<br /> reported recently in 8250 case:<br /> <br /> BUG: kernel NULL pointer dereference, address: 00000cf5<br /> Workqueue: pm pm_runtime_work<br /> EIP: serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)<br /> ...<br /> ? serial8250_tx_chars (drivers/tty/serial/8250/8250_port.c:1809)<br /> __start_tx (drivers/tty/serial/8250/8250_port.c:1551)<br /> serial8250_start_tx (drivers/tty/serial/8250/8250_port.c:1654)<br /> serial_port_runtime_suspend (include/linux/serial_core.h:667 drivers/tty/serial/serial_port.c:63)<br /> __rpm_callback (drivers/base/power/runtime.c:393)<br /> ? serial_port_remove (drivers/tty/serial/serial_port.c:50)<br /> rpm_suspend (drivers/base/power/runtime.c:447)<br /> <br /> The proposed change will prevent -&gt;start_tx() to be called during<br /> suspend on shut down port.