linux/drivers/tty
Peter Hurley 5c17c861a3 tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
ioctl(TIOCGETD) retrieves the line discipline id directly from the
ldisc because the line discipline id (c_line) in termios is untrustworthy;
userspace may have set termios via ioctl(TCSETS*) without actually
changing the line discipline via ioctl(TIOCSETD).

However, directly accessing the current ldisc via tty->ldisc is
unsafe; the ldisc ptr dereferenced may be stale if the line discipline
is changing via ioctl(TIOCSETD) or hangup.

Wait for the line discipline reference (just like read() or write())
to retrieve the "current" line discipline id.

Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-01-26 23:17:54 -08:00
..
hvc TTY/Serial driver patches for 4.4-rc1 2015-11-04 21:35:12 -08:00
ipwireless
serial ARM: SoC driver updates for v4.5 2016-01-20 18:42:30 -08:00
vt vt: Deinline save_screen, save 238 bytes 2015-12-13 19:59:48 -08:00
amiserial.c tty: Remove unused SERIAL_DO_RESTART define 2015-12-13 19:59:48 -08:00
bfin_jtag_comm.c
cyclades.c cyclades: Deinline cyz_is_loaded, save 240 bytes 2015-12-13 19:59:48 -08:00
ehv_bytechan.c
goldfish.c
isicom.c isicom: Deinline drop_dtr, save 112 bytes 2015-12-13 19:59:48 -08:00
Kconfig
Makefile
metag_da.c tty/metag_da: Avoid module_init/module_exit in non-modular code 2015-06-16 14:12:31 -04:00
mips_ejtag_fdc.c ttyFDC: Fix build problems due to use of module_{init,exit} 2015-10-17 21:29:21 -07:00
moxa.c tty: Remove unused SERIAL_DO_RESTART define 2015-12-13 19:59:48 -08:00
moxa.h
mxser.c
mxser.h
n_gsm.c tty: Convert use of __constant_htons to htons 2015-07-23 15:10:25 -07:00
n_hdlc.c
n_r3964.c tty: r3964: Replace/remove bogus tty lock use 2015-10-17 21:11:29 -07:00
n_tracerouter.c n_tracerouter: stop including <asm-generic/bug> 2015-10-15 00:21:10 +02:00
n_tracesink.c n_tracesink: stop including <asm-generic/bug> 2015-10-15 00:21:11 +02:00
n_tracesink.h
n_tty.c Merge 4.4-rc6 into tty-next 2015-12-21 11:06:07 -08:00
nozomi.c
pty.c tty: Remove __func__ from tty_debug() macro 2015-12-13 19:59:48 -08:00
rocket_int.h
rocket.c tty: Remove tty_port::close_wait 2015-10-17 21:11:29 -07:00
rocket.h
synclink_gt.c tty: synclink_gt: Rename tty_driver_name 2015-12-13 19:59:48 -08:00
synclink.c tty: synclink, fix indentation 2015-10-17 21:14:06 -07:00
synclinkmp.c tty: Remove ASYNC_CLOSING checks in open()/hangup() methods 2015-10-17 21:11:29 -07:00
sysrq.c sysrq: Fix warning in sysrq generated crash. 2015-12-29 16:29:18 -08:00
tty_audit.c tty: audit: Fix audit source 2015-11-20 16:19:54 -08:00
tty_buffer.c tty: Fix GPF in flush_to_ldisc() 2015-12-12 23:05:28 -08:00
tty_io.c tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) 2016-01-26 23:17:54 -08:00
tty_ioctl.c tty: Remove __func__ from tty_debug() macro 2015-12-13 19:59:48 -08:00
tty_ldisc.c tty: Prevent ldisc drivers from re-using stale tty fields 2015-12-13 19:59:48 -08:00
tty_ldsem.c tty: Deinline __ldsem_down_write_nested, save 128 bytes 2015-12-13 19:59:48 -08:00
tty_mutex.c tty: Wait interruptibly for tty lock on reopen 2016-01-26 23:17:54 -08:00
tty_port.c tty: Define tty_*() printk macros 2015-12-13 19:59:48 -08:00