linux-kernel - Re: [patch 0/3] Re: tty contention resulting from tty_open_by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170718122637.l5v3re2gcjbxkzeq@mwanda>
Date:   Tue, 18 Jul 2017 15:26:37 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Okash Khawaja <okash.khawaja@...il.com>
Cc:     Alan Cox <gnomes@...rguk.ukuu.org.uk>,
        "devel@...verdev.osuosl.org" <devel@...verdev.osuosl.org>,
        Kirk Reiser <kirk@...sers.ca>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "speakup@...ux-speakup.org" <speakup@...ux-speakup.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Jiri Slaby <jslaby@...e.com>,
        Samuel Thibault <samuel.thibault@...-lyon.org>,
        Chris Brannon <chris@...-brannons.com>
Subject: Re: [patch 0/3] Re: tty contention resulting from tty_open_by_device
 export

On Tue, Jul 18, 2017 at 12:29:52PM +0100, Okash Khawaja wrote:
> +struct tty_struct *tty_kopen(dev_t device)
> +{
> +       struct tty_struct *tty;
> +       struct tty_driver *driver = NULL;
> +       int index = -1;
> +
> +       mutex_lock(&tty_mutex);
> +       driver = tty_lookup_driver(device, NULL, &index);
> +       if (IS_ERR(driver)) {
> +               mutex_unlock(&tty_mutex);
> +               return ERR_CAST(driver);
> +       }
> +
> +       /* check whether we're reopening an existing tty */
> +       tty = tty_driver_lookup_tty(driver, NULL, index);
> +       if (IS_ERR(tty))
> +               goto out;
> +
> +       if (tty) {
> +               /* drop kref from tty_driver_lookup_tty() */
> +               tty_kref_put(tty);
> +               tty = ERR_PTR(-EBUSY);
> +       } else { /* tty_init_dev returns tty with the tty_lock held */
> +               tty = tty_init_dev(driver, index);
> +               tty_port_set_kopened(tty->port, 1);
                                       ^^^^^^^^^

tty_init_dev() can fail leading to an error pointer dereference here.

> +       }
> +out:
> +       mutex_unlock(&tty_mutex);
> +       tty_driver_kref_put(driver);
> +       return tty;
> +}
> +EXPORT_SYMBOL_GPL(tty_kopen);

regards,
dan carpenter