kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/tty
History
Peter Hurley 4c564a5c20 tty: Fix GPF in flush_to_ldisc() 
commit 9ce119f318 upstream.

A line discipline which does not define a receive_buf() method can
can cause a GPF if data is ever received [1]. Oddly, this was known
to the author of n_tracesink in 2011, but never fixed.

[1] GPF report
    BUG: unable to handle kernel NULL pointer dereference at           (null)
    IP: [<          (null)>]           (null)
    PGD 3752d067 PUD 37a7b067 PMD 0
    Oops: 0010 [#1] SMP KASAN
    Modules linked in:
    CPU: 2 PID: 148 Comm: kworker/u10:2 Not tainted 4.4.0-rc2+ #51
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
    Workqueue: events_unbound flush_to_ldisc
    task: ffff88006da94440 ti: ffff88006db60000 task.ti: ffff88006db60000
    RIP: 0010:[<0000000000000000>]  [<          (null)>]           (null)
    RSP: 0018:ffff88006db67b50  EFLAGS: 00010246
    RAX: 0000000000000102 RBX: ffff88003ab32f88 RCX: 0000000000000102
    RDX: 0000000000000000 RSI: ffff88003ab330a6 RDI: ffff88003aabd388
    RBP: ffff88006db67c48 R08: ffff88003ab32f9c R09: ffff88003ab31fb0
    R10: ffff88003ab32fa8 R11: 0000000000000000 R12: dffffc0000000000
    R13: ffff88006db67c20 R14: ffffffff863df820 R15: ffff88003ab31fb8
    FS:  0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000000 CR3: 0000000037938000 CR4: 00000000000006e0
    Stack:
     ffffffff829f46f1 ffff88006da94bf8 ffff88006da94bf8 0000000000000000
     ffff88003ab31fb0 ffff88003aabd438 ffff88003ab31ff8 ffff88006430fd90
     ffff88003ab32f9c ffffed0007557a87 1ffff1000db6cf78 ffff88003ab32078
    Call Trace:
     [<ffffffff8127cf91>] process_one_work+0x8f1/0x17a0 kernel/workqueue.c:2030
     [<ffffffff8127df14>] worker_thread+0xd4/0x1180 kernel/workqueue.c:2162
     [<ffffffff8128faaf>] kthread+0x1cf/0x270 drivers/block/aoe/aoecmd.c:1302
     [<ffffffff852a7c2f>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468
    Code:  Bad RIP value.
    RIP  [<          (null)>]           (null)
     RSP <ffff88006db67b50>
    CR2: 0000000000000000
    ---[ end trace a587f8947e54d6ea ]---

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
History 2016-01-25 10:43:37 +00:00
..
hvc xen/events: don't bind non-percpu VIRQs with percpu chip 2015-06-02 12:08:17 +01:00
ipwireless tty: Fix low_latency BUG 2014-02-28 16:31:00 -08:00
serial serial: 8250_pci: Correct uartclk for xr17v35x expansion chips 2015-11-16 11:27:21 +00:00
vt vt: provide notifications on selection changes 2015-03-02 13:17:02 +00:00
amiserial.c tty/amiserial: avoid interruptible_sleep_on 2014-01-07 17:05:21 -08:00
bfin_jtag_comm.c TTY: bfin_jtag_comm: fix incorrect placement of __initdata tag 2013-09-30 19:09:37 -07:00
cyclades.c tty: an overflow of multiplication in drivers/tty/cyclades.c 2013-12-20 12:21:57 -08:00
ehv_bytechan.c drivers: clean-up prom.h implicit includes 2013-10-09 20:04:04 -05:00
goldfish.c goldfish: clean up the checkpatch warnings 2014-05-15 13:20:42 -07:00
isicom.c TTY: switch tty_flip_buffer_push 2013-01-15 22:30:15 -08:00
Kconfig drivers/tty: ehv_bytechan fails to build as a module 2014-01-09 17:52:12 -06:00
Makefile tty: Add timed, writer-prioritized rw semaphore 2013-05-20 12:30:32 -07:00
metag_da.c tree-wide: use reinit_completion instead of INIT_COMPLETION 2013-11-15 09:32:21 +09:00
moxa.c TTY: add tty_port_tty_hangup helper 2013-03-18 16:24:29 -07:00
moxa.h tty: move a number of tty drivers from drivers/char/ to drivers/tty/ 2011-02-22 16:14:56 -08:00
mxser.c tty: mxser: Fix build warning introduced by dfc7b837c7 (Re: linux-next: build warning after merge of the tty.current tree) 2013-05-22 10:26:02 -07:00
mxser.h Fix common misspellings 2011-03-31 11:26:23 -03:00
n_gsm.c tty/n_gsm.c: fix a memory leak when gsmtty is removed 2015-05-28 10:00:01 +01:00
n_hdlc.c drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc 2014-05-28 13:33:18 -07:00
n_r3964.c tty: Always handle NULL flag ptr 2013-12-08 16:56:05 -08:00
n_tracerouter.c n_tracerouter and n_tracesink ldisc additions. 2011-05-13 16:31:00 -07:00
n_tracesink.c n_tracerouter and n_tracesink ldisc additions. 2011-05-13 16:31:00 -07:00
n_tracesink.h n_tracerouter and n_tracesink ldisc additions. 2011-05-13 16:31:00 -07:00
n_tty.c n_tty: Fix poll() after buffer-limited eof push read 2016-01-25 10:43:37 +00:00
nozomi.c tty: Remove unnecessary semicolons 2013-10-16 13:08:16 -07:00
pty.c tty: Prevent untrappable signals from malicious program 2015-03-02 13:17:02 +00:00
rocket.c tty: remove DEFINE_PCI_DEVICE_TABLE macro 2013-12-08 17:09:07 -08:00
rocket.h tty: move a number of tty drivers from drivers/char/ to drivers/tty/ 2011-02-22 16:14:56 -08:00
rocket_int.h tty: move a number of tty drivers from drivers/char/ to drivers/tty/ 2011-02-22 16:14:56 -08:00
synclink.c synclink: fix info leak in ioctl 2014-03-17 16:13:23 -07:00
synclink_gt.c tty: synclink: avoid sleep_on race 2014-01-07 17:05:21 -08:00
synclinkmp.c synclink: fix info leak in ioctl 2014-03-17 16:13:23 -07:00
sysrq.c tty: remove platform_sysrq_reset_seq 2015-07-15 10:01:19 +01:00
tty_audit.c audit: anchor all pid references in the initial pid namespace 2014-03-20 10:11:55 -04:00
tty_buffer.c tty: Fix GPF in flush_to_ldisc() 2016-01-25 10:43:37 +00:00
tty_io.c tty: fix up atime/mtime mess, take four 2015-03-18 15:07:20 +00:00
tty_ioctl.c TTY: fix tty_wait_until_sent on 64-bit machines 2015-03-18 15:07:29 +00:00
tty_ldisc.c tty: delete non-required instances of include <linux/init.h> 2014-01-07 17:05:21 -08:00
tty_ldsem.c lockdep: Make held_lock->check and "int check" argument bool 2014-02-09 21:18:54 +01:00
tty_mutex.c tty: tty_mutex.c: Fixed coding style warning (using printk) 2012-10-24 11:34:51 -07:00
tty_port.c tty: delete non-required instances of include <linux/init.h> 2014-01-07 17:05:21 -08:00