[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20200318223810.162440-1-ebiggers@kernel.org>
Date: Wed, 18 Mar 2020 15:38:08 -0700
From: Eric Biggers <ebiggers@...nel.org>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Jiri Slaby <jslaby@...e.com>
Cc: linux-kernel@...r.kernel.org, linux-serial@...r.kernel.org,
syzkaller-bugs@...glegroups.com,
Eric Dumazet <edumazet@...gle.com>,
Nicolas Pitre <nico@...xnic.net>
Subject: [PATCH v2 0/2] vt: fix some vt_ioctl races
Fix VT_DISALLOCATE freeing an in-use virtual console, and fix a
use-after-free in vt_in_use().
Changed since v1:
- Made the vc_data be freed via tty_port refcounting.
- Added patch to fix a use-after-free in vt_in_use().
Eric Biggers (2):
vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console
vt: vt_ioctl: fix use-after-free in vt_in_use()
drivers/tty/vt/vt.c | 14 +++++++++++++-
drivers/tty/vt/vt_ioctl.c | 24 ++++++++++++------------
2 files changed, 25 insertions(+), 13 deletions(-)
--
2.25.1
Powered by blists - more mailing lists