linux-kernel - [PATCH] char: mxser.c, tty->driver_data is not set, kernel 2.6.33.7

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 10 Aug 2010 17:21:18 +0300
From:	Alexander <aledin@...atoria.com.ua>
To:	linux-kernel@...r.kernel.org
CC:	Jiri Slaby <jirislaby@...il.com>
Subject: [PATCH] char: mxser.c, tty->driver_data is not set, kernel 2.6.33.7

Hello,

tty->driver_data is not initialized in drivers/char/mxser.c, so it results in
something like this:


BUG: unable to handle kernel NULL pointer dereference at 0000007c
IP: [<d098753f>] mxser_change_speed+0x1f/0x5e0 [mxser]
...
Pid: 1662, comm: msterm Not tainted 2.6.33.4-smp #1 nVidia-nForce/
EIP: 0060:[<d098753f>] EFLAGS: 00010092 CPU: 0
EIP is at mxser_change_speed+0x1f/0x5e0 [mxser]
EAX: cb0b1840 EBX: 00000000 ECX: 0000c400 EDX: cb263800
ESI: 00000cbd EDI: cb263800 EBP: cf9a3dc0 ESP: cf9a3d7c
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process msterm (pid: 1662, ti=cf9a2000 task=cf930000 task.ti=cf9a2000)
Stack:
 00000000 cb263800 cb0ec000 00000001 00000003 c16274d0 c16274cc 00000001
<0> 00000292 cf9a3dc0 c1647740 d098b5bc d098b5bc cb263800 0000c405 d098b5bc
<0> cb263800 cf9a3de8 d0987e4e d098b5a0 d098b6fc 0000c406 0000c402 00000286
Call Trace:
 [<d0987e4e>] ? mxser_activate+0x12e/0x1b0 [mxser]
 [<c129d5df>] ? tty_port_open+0x6f/0xb0
 [<d0988306>] ? mxser_open+0x76/0x80 [mxser]
 [<c12970fc>] ? tty_open+0x22c/0x510
 [<c10dee4b>] ? chrdev_open+0xbb/0x1a0
 [<c105f0aa>] ? in_group_p+0x2a/0x30
 [<c10d9e53>] ? __dentry_open+0xe3/0x290
 [<c10e3f73>] ? inode_permission+0x83/0xb0
 [<c10db04a>] ? nameidata_to_filp+0x4a/0x60
 [<c10ded90>] ? chrdev_open+0x0/0x1a0
 [<c10e732a>] ? do_filp_open+0x6fa/0x9b0
 [<c1057b5d>] ? remove_wait_queue+0x3d/0x50
 [<c129bb4d>] ? tty_ldisc_deref+0xd/0x10
 [<c12961f7>] ? tty_write+0x1b7/0x1e0
 [<c10f0de4>] ? alloc_fd+0x74/0x100
 [<c10d9c06>] ? do_sys_open+0x56/0x110
 [<c10d9d2e>] ? sys_open+0x2e/0x40
 [<c1471874>] ? syscall_call+0x7/0xb
Code: b6 00 00 00 00 8d bc 27 00 00 00 00 55 89 e5 57 56 53 83 ec 38 0f 1f 44 00
00 89 45 c0 89 c2 8b 98 3c 01 00 00 8b 40 44 8b 70 08 <8b> 43 7c 85 c0 0f 84 bc
01 00 00 8b 42 10 8b 04 85 c0 df 98 d0
EIP: [<d098753f>] mxser_change_speed+0x1f/0x5e0 [mxser] SS:ESP 0068:cf9a3d7c
CR2: 000000000000007c

In kernels 2.6.34 and up it's fixed already, but not in 2.6.33.7.

The included patch is against 2.6.33.7:



--- linux-2.6.33.7/drivers/char/mxser.c	2010-08-02 20:27:18.000000000 +0300
+++ my-linux-2.6.33.7/drivers/char/mxser.c	2010-08-10 15:14:01.000000000 +0300
@@ -1012,6 +1012,8 @@
 	if (!info->ioaddr)
 		return -ENODEV;

+	tty->driver_data = info;
+
 	return tty_port_open(&info->port, tty, filp);
 }





-- 
Alexander Pravdin
aledin@...atoria.com.ua

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/