diff options
| author | Peter Hurley <peter@hurleysoftware.com> | 2016-01-10 22:40:55 -0800 |
|---|---|---|
| committer | Mark Salyzyn <salyzyn@google.com> | 2016-05-17 09:44:29 -0700 |
| commit | 1f95b0e9be77e4d72a6352b6fc486d0678def27f (patch) | |
| tree | 8ba1b32a1ac35e1f23ba6c3a3b8d07284d40e5af /scripts/objdiff | |
| parent | 9a326f6c084b089765ed8ee903b76a5e8251b0b3 (diff) | |
UPSTREAM: tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
(cherry pick from commit 5c17c861a357e9458001f021a7afa7aab9937439)
ioctl(TIOCGETD) retrieves the line discipline id directly from the
ldisc because the line discipline id (c_line) in termios is untrustworthy;
userspace may have set termios via ioctl(TCSETS*) without actually
changing the line discipline via ioctl(TIOCSETD).
However, directly accessing the current ldisc via tty->ldisc is
unsafe; the ldisc ptr dereferenced may be stale if the line discipline
is changing via ioctl(TIOCSETD) or hangup.
Wait for the line discipline reference (just like read() or write())
to retrieve the "current" line discipline id.
Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 28409131
Change-Id: I6774bd883a2e48bbe020486c72c42fb410e3f98a
Diffstat (limited to 'scripts/objdiff')
0 files changed, 0 insertions, 0 deletions