Peter Hurley 5859b90777 serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485) ...

commit 308bbc9ab8 upstream.

The omap-serial driver emulates RS485 delays using software timers,
but neglects to clamp the input values from the unprivileged
ioctl(TIOCSRS485). Because the software implementation busy-waits,
malicious userspace could stall the cpu for ~49 days.

Clamp the input values to < 100ms.

Fixes: 4a0ac0f55b ("OMAP: add RS485 support")
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2016-02-25 12:01:14 -08:00

..

hvc

Merge tag 'tty-4.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2015-11-04 21:35:12 -08:00

ipwireless

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial

2015-04-14 09:50:27 -07:00

serial

serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485)

2016-02-25 12:01:14 -08:00

vt

tty: vt: Fix !TASK_RUNNING diagnostic warning from paste_selection()

2015-07-23 18:08:29 -07:00

amiserial.c

tty: amiserial.c: move assignment out of if () block

2015-05-10 19:04:16 +02:00

bfin_jtag_comm.c

…

cyclades.c

tty: Remove ASYNC_CLOSING checks in open()/hangup() methods

2015-10-17 21:11:29 -07:00

ehv_bytechan.c

…

goldfish.c

staging: goldfish: Fix pointer cast for 32 bits

2015-05-31 11:40:14 +09:00

isicom.c

…

Kconfig

ttyFDC: Implement KGDB IO operations.

2015-03-31 12:04:13 +02:00

Makefile

TTY: Add MIPS EJTAG Fast Debug Channel TTY driver

2015-03-31 12:04:12 +02:00

metag_da.c

tty/metag_da: Avoid module_init/module_exit in non-modular code

2015-06-16 14:12:31 -04:00

mips_ejtag_fdc.c

ttyFDC: Fix build problems due to use of module_{init,exit}

2015-10-17 21:29:21 -07:00

moxa.c

…

moxa.h

…

mxser.c

…

mxser.h

…

n_gsm.c

tty: Convert use of __constant_htons to htons

2015-07-23 15:10:25 -07:00

n_hdlc.c

pty: Fix input race when closing

2015-05-10 19:26:37 +02:00

n_r3964.c

tty: r3964: Replace/remove bogus tty lock use

2015-10-17 21:11:29 -07:00

n_tracerouter.c

n_tracerouter: stop including <asm-generic/bug>

2015-10-15 00:21:10 +02:00

n_tracesink.c

n_tracesink: stop including <asm-generic/bug>

2015-10-15 00:21:11 +02:00

n_tracesink.h

…

n_tty.c

n_tty: Fix unsafe reference to "other" ldisc

2016-02-17 12:31:02 -08:00

nozomi.c

drivers/tty/nozomi.c: rename CONFIG_MAGIC

2015-05-10 19:19:06 +02:00

pty.c

pty: make sure super_block is still valid in final /dev/tty close

2016-02-25 12:01:14 -08:00

rocket_int.h

…

rocket.c

tty: Remove tty_port::close_wait

2015-10-17 21:11:29 -07:00

rocket.h

tty: rocket: fix comment of ROCKET_SPD_HI

2015-05-24 12:49:16 -07:00

synclink_gt.c

tty: Remove ASYNC_CLOSING checks in open()/hangup() methods

2015-10-17 21:11:29 -07:00

synclink.c

tty: synclink, fix indentation

2015-10-17 21:14:06 -07:00

synclinkmp.c

tty: Remove ASYNC_CLOSING checks in open()/hangup() methods

2015-10-17 21:11:29 -07:00

sysrq.c

drivers/tty: make sysrq.c slightly more explicitly non-modular

2015-10-04 17:27:56 +01:00

tty_audit.c

tty: audit: Fix audit source

2015-11-20 16:19:54 -08:00

tty_buffer.c

tty: Fix GPF in flush_to_ldisc()

2015-12-12 23:05:28 -08:00

tty_io.c

tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)

2016-02-17 12:31:02 -08:00

tty_ioctl.c

tty: Fix tty_send_xchar() lock order inversion

2015-11-20 16:19:54 -08:00

tty_ldisc.c

tty: Fix direct use of tty buffer work

2015-11-20 16:19:54 -08:00

tty_ldsem.c

tty: tty_ldsem.c: move assignment out of if () block

2015-05-10 19:04:18 +02:00

tty_mutex.c

tty: Wait interruptibly for tty lock on reopen

2016-02-17 12:31:02 -08:00

tty_port.c

tty: Abstract tty buffer work

2015-10-17 21:32:21 -07:00