[PATCH 06/19] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)

From	Peter Hurley <peter@hurleysoftware.com>
Newsgroups	linux.kernel
Subject	[PATCH 06/19] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
Date	2015-11-27 22:50 +0100
Message-ID	<qzz3Y-8gp-1@gated-at.bofh.it> (permalink)
References	<qzyUh-8cQ-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

ioctl(TIOCGETD) retrieves the line discipline id directly from the
ldisc because the line discipline id (c_line) in termios is untrustworthy;
userspace may have set termios via ioctl(TCSETS*) without actually
changing the line discipline via ioctl(TIOCSETD).

However, directly accessing the current ldisc via tty->ldisc is
unsafe; the ldisc ptr dereferenced may be stale if the line discipline
is changing via ioctl(TIOCSETD) or hangup.

Wait for the line discipline reference (just like read() or write())
to retrieve the "current" line discipline id.

Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
---
 drivers/tty/tty_io.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 892c923..56d3a6b 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2649,6 +2649,28 @@ static int tiocsetd(struct tty_struct *tty, int __user *p)
 }
 
 /**
+ *	tiocgetd	-	get line discipline
+ *	@tty: tty device
+ *	@p: pointer to user data
+ *
+ *	Retrieves the line discipline id directly from the ldisc.
+ *
+ *	Locking: waits for ldisc reference (in case the line discipline
+ *		is changing or the tty is being hungup)
+ */
+
+static int tiocgetd(struct tty_struct *tty, int __user *p)
+{
+	struct tty_ldisc *ld;
+	int ret;
+
+	ld = tty_ldisc_ref_wait(tty);
+	ret = put_user(ld->ops->num, p);
+	tty_ldisc_deref(ld);
+	return ret;
+}
+
+/**
  *	send_break	-	performed time break
  *	@tty: device to break on
  *	@duration: timeout in mS
@@ -2874,7 +2896,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	case TIOCGSID:
 		return tiocgsid(tty, real_tty, p);
 	case TIOCGETD:
-		return put_user(tty->ldisc->ops->num, (int __user *)p);
+		return tiocgetd(tty, p);
 	case TIOCSETD:
 		return tiocsetd(tty, p);
 	case TIOCVHANGUP:
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Thread

[PATCH 00/19] Fix driver crashes on hangup Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:40 +0100
  [PATCH 03/19] bluetooth: hci_ldisc: Remove dead code Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:40 +0100
  [PATCH 06/19] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 12/19] tty: Prepare for destroying line discipline on hangup Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 19/19] tty: Touch up style issues in ldisc core Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 13/19] tty: Handle NULL tty->ldisc Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 09/19] staging/speakup: Use tty_ldisc_ref() for paste kworker Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 10/19] tty: Fix comments for tty_ldisc_get() Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 14/19] tty: Move tty_ldisc_kill() Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 11/19] tty: Fix comments for tty_ldisc_release() Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 08/19] tty: Reset c_line from driver's init_termios Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 02/19] serial: 68328: Remove bogus ldisc reset Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 17/19] tty: Destroy ldisc instance on hangup Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 01/19] staging: digi: Replace open-coded tty_wakeup() Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 15/19] tty: Use 'disc' for line discipline index name Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 18/19] tty: Document c_line == N_TTY initial condition Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 05/19] tty: Remove chars_in_buffer() line discipline method Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 16/19] tty: Refactor tty_ldisc_reinit() for reuse Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100
  [PATCH 07/19] n_tty: Fix unsafe reference to "other" ldisc Peter Hurley <peter@hurleysoftware.com> - 2015-11-27 22:50 +0100

csiph-web