Messages in this thread | | | Date | Wed, 27 Apr 2011 00:01:07 +0200 | From | Jiri Slaby <> | Subject | Re: [PATCH 090/173] USB: serial/kobil_sct, fix potential tty NULL dereference |
| |
On 04/26/2011 09:53 PM, Willy Tarreau wrote: > On Tue, Apr 26, 2011 at 12:07:07PM +0200, Jiri Slaby wrote: >> On 04/25/2011 10:04 PM, Willy Tarreau wrote: >>> 2.6.27.59-stable review patch. If anyone has any objections, please let >>> us know. >>> >>> ------------------ >>> >>> From: Jiri Slaby<jslaby@suse.cz> >>> >>> commit 6960f40a954619857e7095a6179eef896f297077 upstream. >>> >>> Make sure that we check the return value of tty_port_tty_get. >>> Sometimes it may return NULL and we later dereference that. >>> >>> The only place here is in kobil_read_int_callback, so fix it. >>> >>> Signed-off-by: Jiri Slaby<jslaby@suse.cz> >>> Cc: Alan Cox<alan@linux.intel.com> >>> Signed-off-by: Greg Kroah-Hartman<gregkh@suse.de> >>> >>> --- >>> drivers/usb/serial/kobil_sct.c | 2 +- >>> 1 file changed, 1 insertion(+), 1 deletion(-) >>> >>> --- a/drivers/usb/serial/kobil_sct.c >>> +++ b/drivers/usb/serial/kobil_sct.c >>> @@ -372,7 +372,7 @@ static void kobil_read_int_callback(stru >>> } >>> >>> tty = port->port.tty; >>> - if (urb->actual_length) { >>> + if (tty&& urb->actual_length) { >> >> Ok, but this doesn't fix the bug (the URB should be killed or something >> similar in that kernel), it only makes the window smaller. > > OK I get it now, it requires patch 4a90f09b which is quite not some > suitable material for -longterm.
Yeah and perhaps some other changes (like adding hangup support).
> Do you think it's better to completely remove this patch than making > one think the risk of bug is gone while it is not ? Unless we find > something more reliable, I'd rather drop the patch.
To be honest I don't know what's better :). Maybe I would incline to the drop-it side, but leaving up to you.
thanks, -- js suse labs
| |