Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1305886

[PATCH v3 06/19] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)

Show all headers | View raw

ioctl(TIOCGETD) retrieves the line discipline id directly from the
ldisc because the line discipline id (c_line) in termios is untrustworthy;
userspace may have set termios via ioctl(TCSETS*) without actually
changing the line discipline via ioctl(TIOCSETD).

However, directly accessing the current ldisc via tty->ldisc is
unsafe; the ldisc ptr dereferenced may be stale if the line discipline
is changing via ioctl(TIOCSETD) or hangup.

Wait for the line discipline reference (just like read() or write())
to retrieve the "current" line discipline id.

Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
---
 drivers/tty/tty_io.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 892c923..56d3a6b 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2649,6 +2649,28 @@ static int tiocsetd(struct tty_struct *tty, int __user *p)
 }
 
 /**
+ *	tiocgetd	-	get line discipline
+ *	@tty: tty device
+ *	@p: pointer to user data
+ *
+ *	Retrieves the line discipline id directly from the ldisc.
+ *
+ *	Locking: waits for ldisc reference (in case the line discipline
+ *		is changing or the tty is being hungup)
+ */
+
+static int tiocgetd(struct tty_struct *tty, int __user *p)
+{
+	struct tty_ldisc *ld;
+	int ret;
+
+	ld = tty_ldisc_ref_wait(tty);
+	ret = put_user(ld->ops->num, p);
+	tty_ldisc_deref(ld);
+	return ret;
+}
+
+/**
  *	send_break	-	performed time break
  *	@tty: device to break on
  *	@duration: timeout in mS
@@ -2874,7 +2896,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	case TIOCGSID:
 		return tiocgsid(tty, real_tty, p);
 	case TIOCGETD:
-		return put_user(tty->ldisc->ops->num, (int __user *)p);
+		return tiocgetd(tty, p);
 	case TIOCSETD:
 		return tiocsetd(tty, p);
 	case TIOCVHANGUP:
-- 
2.7.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2 00/19] Fix driver crashes on hangup Peter Hurley <peter@hurleysoftware.com> - 2016-01-10 05:50 +0100
  [PATCH v2 05/19] tty: Remove chars_in_buffer() line discipline method Peter Hurley <peter@hurleysoftware.com> - 2016-01-10 05:50 +0100
  [PATCH v2 14/19] tty: Move tty_ldisc_kill() Peter Hurley <peter@hurleysoftware.com> - 2016-01-10 05:50 +0100
  [PATCH v2 01/19] staging: digi: Replace open-coded tty_wakeup() Peter Hurley <peter@hurleysoftware.com> - 2016-01-10 05:50 +0100
  [PATCH v2 12/19] tty: Prepare for destroying line discipline on hangup Peter Hurley <peter@hurleysoftware.com> - 2016-01-10 05:50 +0100
  [PATCH v2 08/19] tty: Reset c_line from driver's init_termios Peter Hurley <peter@hurleysoftware.com> - 2016-01-10 05:50 +0100
  [PATCH v2 02/19] serial: 68328: Remove bogus ldisc reset Peter Hurley <peter@hurleysoftware.com> - 2016-01-10 05:50 +0100
  [PATCH v2 16/19] tty: Refactor tty_ldisc_reinit() for reuse Peter Hurley <peter@hurleysoftware.com> - 2016-01-10 05:50 +0100
  [PATCH v2 03/19] bluetooth: hci_ldisc: Remove dead code Peter Hurley <peter@hurleysoftware.com> - 2016-01-10 05:50 +0100
  [PATCH v3 19/19] tty: Avoid unnecessary temporaries for tty->ldisc Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 17/19] tty: Destroy ldisc instance on hangup Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 08/19] tty: Reset c_line from driver's init_termios Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 06/19] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 04/19] NFC: nci: Remove dead code Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 15/19] tty: Use 'disc' for line discipline index name Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 01/19] staging: digi: Replace open-coded tty_wakeup() Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 14/19] tty: Move tty_ldisc_kill() Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 05/19] tty: Remove chars_in_buffer() line discipline method Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 02/19] serial: 68328: Remove bogus ldisc reset Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
    Re: [PATCH v3 02/19] serial: 68328: Remove bogus ldisc reset One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-01-11 15:20 +0100
  [PATCH v3 13/19] tty: Handle NULL tty->ldisc Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 12/19] tty: Prepare for destroying line discipline on hangup Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 03/19] bluetooth: hci_ldisc: Remove dead code Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 10/19] tty: Fix comments for tty_ldisc_get() Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 07/19] n_tty: Fix unsafe reference to "other" ldisc Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 11/19] tty: Fix comments for tty_ldisc_release() Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 09/19] staging/speakup: Use tty_ldisc_ref() for paste kworker Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 18/19] tty: Document c_line == N_TTY initial condition Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 16/19] tty: Refactor tty_ldisc_reinit() for reuse Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100
  [PATCH v3 00/19] Fix driver crashes on hangup Peter Hurley <peter@hurleysoftware.com> - 2016-01-11 07:50 +0100

csiph-web