linux-kernel - [PATCH 3/3] tty: reset termios state on device registration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 30 Mar 2017 15:39:36 +0200
From:   Johan Hovold <johan@...nel.org>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jiri Slaby <jslaby@...e.com>
Cc:     linux-kernel@...r.kernel.org, Johan Hovold <johan@...nel.org>,
        Jan Kundrát <jan.kundrat@...net.cz>
Subject: [PATCH 3/3] tty: reset termios state on device registration

Free any saved termios data when registering a tty device so that the
termios state is reset when reusing a minor number.

This is useful for hot-pluggable buses such as USB where it does not
make much sense to reuse saved termios data from an unrelated device
when a new device is later plugged in.

This specifically avoids a situation where the new device does not have
the carrier-detect signal wired, but the saved termios state has CLOCAL
cleared, effectively preventing the port from being opened in blocking
mode as noted by Jan Kundrát <jan.kundrat@...net.cz>.

Note that clearing the saved data at deregistration would not work as
the device could still be open.

Also note that the termios data is not reset for drivers with
TTY_DRIVER_DYNAMIC_ALLOC set (e.g. legacy pty) as their character device
is registered at driver registration and could theoretically already
have been opened (and pty termios state is never saved anyway).

Reported-by: Jan Kundrát <jan.kundrat@...net.cz>
Signed-off-by: Johan Hovold <johan@...nel.org>
---
 drivers/tty/tty_io.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 5f834dcb0b15..d697053f5e42 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -3293,6 +3293,7 @@ struct device *tty_register_device_attr(struct tty_driver *driver,
 {
 	char name[64];
 	dev_t devt = MKDEV(driver->major, driver->minor_start) + index;
+	struct ktermios *tp;
 	struct device *dev;
 	int retval;

@@ -3326,6 +3327,16 @@ struct device *tty_register_device_attr(struct tty_driver *driver,
 		goto err_put;

 	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
+		/*
+		 * Free any saved termios data so that the termios state is
+		 * reset when reusing a minor number.
+		 */
+		tp = driver->termios[index];
+		if (tp) {
+			driver->termios[index] = NULL;
+			kfree(tp);
+		}
+
 		retval = tty_cdev_add(driver, devt, index, 1);
 		if (retval)
 			goto err_del;
-- 
2.12.2