linux-kernel - Re: [BUG] tiocsti() NULL dereference if ld->ops->receive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 19 Jan 2019 10:11:08 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Jann Horn <jannh@...gle.com>
Cc:     Jiri Slaby <jslaby@...e.com>,
        kernel list <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] tiocsti() NULL dereference if ld->ops->receive_buf==NULL

On Fri, Jan 18, 2019 at 08:09:07PM +0100, Jann Horn wrote:
> Hi!
> 
> When a line discipline doesn't have a ->receive_buf handler, tiocsti()
> attempts to call a NULL pointer. Both tty_n_tracesink and
> spk_ttyio_ldisc_ops don't have such a handler.
> 
> To reproduce, build a kernel with CONFIG_SPEAKUP=y and
> CONFIG_SPEAKUP_SYNTH_SOFT=y, set speakup.synth=soft in the kernel
> command line, and run the following code as root:

<snip>

Ugh, thanks for finding this.  I'll look at it later this afternoon...

greg k-h