linux-kernel - Re: serial: fixup /proc/tty/driver/serial after proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <10f740e80904020043l1f9afee9i88046826394c3d64@mail.gmail.com>
Date:	Thu, 2 Apr 2009 09:43:11 +0200
From:	Geert Uytterhoeven <geert@...ux-m68k.org>
To:	Alexey Dobriyan <adobriyan@...il.com>
Cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: serial: fixup /proc/tty/driver/serial after proc_fops conversion

On Wed, Apr 1, 2009 at 23:59, Linux Kernel Mailing List
<linux-kernel@...r.kernel.org> wrote:
>    serial: fixup /proc/tty/driver/serial after proc_fops conversion
>
>    "struct tty_driver *" lies in m->private not in v which is
>    SEQ_TOKEN_START which is 1 which is enough to trigger NULL dereference
>    next line:
>
>        BUG: unable to handle kernel NULL pointer dereference at 000000ad
>        IP: [<c040d689>] uart_proc_show+0xe/0x2b0
>
>    Noticed by Linus.
>
>    Signed-off-by: Alexey Dobriyan <adobriyan@...il.com>
>    Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
> ---
>  drivers/serial/serial_core.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
> index bf3c0e3..b0bb29d 100644
> --- a/drivers/serial/serial_core.c
> +++ b/drivers/serial/serial_core.c
> @@ -1765,7 +1765,7 @@ static void uart_line_info(struct seq_file *m, struct uart_driver *drv, int i)
>
>  static int uart_proc_show(struct seq_file *m, void *v)
>  {
> -       struct tty_driver *ttydrv = v;
> +       struct tty_driver *ttydrv = m->private;
>        struct uart_driver *drv = ttydrv->driver_state;
>        int i;

Yeah, I've been bitten by this one in the past, too. It's very
confusing to have a `void *'
parameter in a callback whose registration (proc_create_data()) also
takes a `void *'.

What is this `v' parameter actually used for? I couldn't find any
users during a quick
(non-exhaustive) search?

Gr{oetje,eeting}s,

						Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
							    -- Linus Torvalds
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/