Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1330735

[PATCH 3.19.y-ckt 30/47] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)

Show all headers | View raw

3.19.8-ckt15 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Peter Hurley <peter@hurleysoftware.com>

commit 5c17c861a357e9458001f021a7afa7aab9937439 upstream.

ioctl(TIOCGETD) retrieves the line discipline id directly from the
ldisc because the line discipline id (c_line) in termios is untrustworthy;
userspace may have set termios via ioctl(TCSETS*) without actually
changing the line discipline via ioctl(TIOCSETD).

However, directly accessing the current ldisc via tty->ldisc is
unsafe; the ldisc ptr dereferenced may be stale if the line discipline
is changing via ioctl(TIOCSETD) or hangup.

Wait for the line discipline reference (just like read() or write())
to retrieve the "current" line discipline id.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/tty/tty_io.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index cc7b224..5b60f42 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2664,6 +2664,28 @@ static int tiocsetd(struct tty_struct *tty, int __user *p)
 }
 
 /**
+ *	tiocgetd	-	get line discipline
+ *	@tty: tty device
+ *	@p: pointer to user data
+ *
+ *	Retrieves the line discipline id directly from the ldisc.
+ *
+ *	Locking: waits for ldisc reference (in case the line discipline
+ *		is changing or the tty is being hungup)
+ */
+
+static int tiocgetd(struct tty_struct *tty, int __user *p)
+{
+	struct tty_ldisc *ld;
+	int ret;
+
+	ld = tty_ldisc_ref_wait(tty);
+	ret = put_user(ld->ops->num, p);
+	tty_ldisc_deref(ld);
+	return ret;
+}
+
+/**
  *	send_break	-	performed time break
  *	@tty: device to break on
  *	@duration: timeout in mS
@@ -2889,7 +2911,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	case TIOCGSID:
 		return tiocgsid(tty, real_tty, p);
 	case TIOCGETD:
-		return put_user(tty->ldisc->ops->num, (int __user *)p);
+		return tiocgetd(tty, p);
 	case TIOCSETD:
 		return tiocsetd(tty, p);
 	case TIOCVHANGUP:
-- 
1.9.1

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[3.19.y-ckt stable] Linux 3.19.8-ckt15 stable review Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100
  [PATCH 3.19.y-ckt 47/47] KEYS: Fix keyring ref leak in join_session_keyring() Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100
  [PATCH 3.19.y-ckt 41/47] perf hists: Fix HISTC_MEM_DCACHELINE width setting Kamal Mostafa <kamal@canonical.com> - 2016-02-09 23:50 +0100
  [PATCH 3.19.y-ckt 11/47] cdc-acm:exclude Samsung phone 04e8:685d Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 10/47] usb: cdc-acm: send zero packet for intel 7260 modem Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 17/47] ALSA: seq: Fix incorrect sanity check at snd_seq_oss_synth_cleanup() Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 35/47] ALSA: dummy: Disable switching timer backend via sysfs Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 34/47] seccomp: always propagate NO_NEW_PRIVS on tsync Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 19/47] USB: serial: ftdi_sio: add support for Yaesu SCU-18 cable Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 23/47] ALSA: usb-audio: Fix TEAC UD-501/UD-503/NT-503 usb delay Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 16/47] USB: serial: option: Adding support for Telit LE922 Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 36/47] drm/vmwgfx: respect 'nomodeset' Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 24/47] ALSA: bebob: Use a signed return type for get_formation_index Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 12/47] usb: hub: do not clear BOS field during reset device Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 09/47] usb: cdc-acm: handle unlinked urb in acm read callback Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 30/47] tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 21/47] USB: option: fix Cinterion AHxx enumeration Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 28/47] powerpc/eeh: Fix PE location code Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 15/47] USB: serial: visor: fix crash on detecting device without write_urbs Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 32/47] staging/speakup: Use tty_ldisc_ref() for paste kworker Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 22/47] ALSA: compress: Disable GET_CODEC_CAPS ioctl for some architectures Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 14/47] USB: visor: fix null-deref at probe Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 26/47] arm64: mm: avoid calling apply_to_page_range on empty range Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 27/47] x86/mm: Fix types used in pgprot cacheability flags translations Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 20/47] arm64: kernel: fix architected PMU registers unconditional access Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 08/47] ACPI / PCI / hotplug: unlock in error path in acpiphp_enable_slot() Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 29/47] SCSI: fix crashes in sd and sr runtime PM Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 25/47] arm64: errata: Add -mpc-relative-literal-loads to build flags Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:00 +0100
  [PATCH 3.19.y-ckt 07/47] ACPI: Revert "ACPI / video: Add Dell Inspiron 5737 to the blacklist" Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 03/47] KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8 Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 06/47] powerpc: Simplify module TOC handling Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 04/47] KVM: PPC: Fix ONE_REG AltiVec support Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100
  [PATCH 3.19.y-ckt 02/47] iio: adis_buffer: Fix out-of-bounds memory access Kamal Mostafa <kamal@canonical.com> - 2016-02-10 00:10 +0100

csiph-web