linux-kernel - [PATCH 10/21] TTY: n_tty, remove bogus checks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 18 Oct 2012 22:26:36 +0200
From:	Jiri Slaby <jslaby@...e.cz>
To:	gregkh@...uxfoundation.org
Cc:	alan@...ux.intel.com, linux-kernel@...r.kernel.org,
	jirislaby@...il.com
Subject: [PATCH 10/21] TTY: n_tty, remove bogus checks

* BUG_ON(!tty) in n_tty_set_termios -- it cannot be called with tty ==
  NULL. It is called from two call sites. First, from n_tty_open where
  we have a valid tty. Second, as ld->ops->set_termios from
  tty_set_termios. But there we have a valid tty too.
* if (!tty) in n_tty_open -- why would the TTY layer call ldisc's
  open with an invalid TTY? No it indeed does not. All call sites have
  a tty and dereference that.
* BUG_ON(!tty->read_buf) in n_tty_read -- this used to be a valid
  check. The ldisc handling was broken some time ago when I added the
  check to ensure everything is OK. It still can catch the case, but
  no later than we move the buffer to ldisc data. Then there will be
  no read_buf in tty_struct, i.e. nothing to check for.
* if (!tty->read_buf) in n_tty_receive_buf -- this should never
  happen. All callers of ldisc->ops->receive_ops should hold a
  reference to an ldisc and close (which frees read_buf) cannot be
  called until the reference is dropped.
* if (WARN_ON(!tty->read_buf)) in n_tty_read -- the same as in the
  previous case.

Signed-off-by: Jiri Slaby <jslaby@...e.cz>
---
 drivers/tty/n_tty.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index f27289d..ceae074 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -1375,9 +1375,6 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
 	char	buf[64];
 	unsigned long cpuflags;

-	if (!tty->read_buf)
-		return;
-
 	if (tty->real_raw) {
 		spin_lock_irqsave(&tty->read_lock, cpuflags);
 		i = min(N_TTY_BUF_SIZE - tty->read_cnt,
@@ -1471,7 +1468,6 @@ int is_ignored(int sig)
 static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 {
 	int canon_change = 1;
-	BUG_ON(!tty);

 	if (old)
 		canon_change = (old->c_lflag ^ tty->termios.c_lflag) & ICANON;
@@ -1579,9 +1575,6 @@ static void n_tty_close(struct tty_struct *tty)

 static int n_tty_open(struct tty_struct *tty)
 {
-	if (!tty)
-		return -EINVAL;
-
 	/* These are ugly. Currently a malloc failure here can panic */
 	tty->read_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
 	tty->echo_buf = kzalloc(N_TTY_BUF_SIZE, GFP_KERNEL);
@@ -1736,10 +1729,6 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 	int packet;

 do_it_again:
-
-	if (WARN_ON(!tty->read_buf))
-		return -EAGAIN;
-
 	c = job_control(tty, file);
 	if (c < 0)
 		return c;
@@ -1825,7 +1814,6 @@ do_it_again:
 			/* FIXME: does n_tty_set_room need locking ? */
 			n_tty_set_room(tty);
 			timeout = schedule_timeout(timeout);
-			BUG_ON(!tty->read_buf);
 			continue;
 		}
 		__set_current_state(TASK_RUNNING);
-- 
1.7.12.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/