linux-kernel - Re: [PATCH v2 09/19] staging/speakup: Use tty_ldisc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 10 Jan 2016 23:16:17 +0000
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Peter Hurley <peter@...leysoftware.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	Jiri Slaby <jslaby@...e.cz>, linux-kernel@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [PATCH v2 09/19] staging/speakup: Use tty_ldisc_ref() for paste
 kworker

On Sat, 2016-01-09 at 20:41 -0800, Peter Hurley wrote:
> As the function documentation for tty_ldisc_ref_wait() notes, it is
> only callable from a tty file_operations routine; otherwise there
> is no guarantee the ref won't be NULL.
> 
> The key difference with the VT's paste_selection() is that is an ioctl,
> where __speakup_paste_selection() is completely asynch kworker, kicked
> off from interrupt context.
> 
> Fixes: 28a821c30688 ("Staging: speakup: Update __speakup_paste_selection()
>        tty (ab)usage to match vt")
> Cc: <stable@...r.kernel.org>
> 
> Signed-off-by: Peter Hurley <peter@...leysoftware.com>
> ---
>  drivers/staging/speakup/selection.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c
> index aa5ab6c..86c0b9a 100644
> --- a/drivers/staging/speakup/selection.c
> +++ b/drivers/staging/speakup/selection.c
> @@ -142,7 +142,9 @@ static void __speakup_paste_selection(struct work_struct *work)
>  	struct tty_ldisc *ld;
>  	DECLARE_WAITQUEUE(wait, current);
>  
> -	ld = tty_ldisc_ref_wait(tty);
> +	ld = tty_ldisc_ref(tty);
> +	if (!ld)
> +		return;
>  	tty_buffer_lock_exclusive(&vc->port);
>  
>  	add_wait_queue(&vc->paste_wait, &wait);

This leaks a reference to the tty.  Instead of returning directly, I
think you need to add a label and goto the tty_kref_put() at the bottom
of the function.

Ben.

-- 
Ben Hutchings
Power corrupts.  Absolute power is kind of neat.
                           - John Lehman, Secretary of the US Navy 1981-1987
Download attachment "signature.asc" of type "application/pgp-signature" (812 bytes)