| Date | Sun, 13 Sep 2015 00:56:10 +0200 | From | Willy Tarreau <> | Subject | [PATCH 2.6.32 04/62] TTY: drop driver reference in tty_open fail path |
| |
2.6.32-longterm review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby <jslaby@suse.cz>
commit c290f8358acaeffd8e0c551ddcc24d1206143376 upstream.
When tty_driver_lookup_tty fails in tty_open, we forget to drop a reference to the tty driver. This was added by commit 4a2b5fddd5 (Move tty lookup/reopen to caller).
Fix that by adding tty_driver_kref_put to the fail path.
I will refactor the code later. This is for the ease of backporting to stable.
Introduced-in: v2.6.28-rc2 Signed-off-by: Jiri Slaby <jslaby@suse.cz> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Acked-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> [bwh: Backported to 2.6.32: adjust filename] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
CVE-2011-5321
Signed-off-by: Willy Tarreau <w@1wt.eu> --- drivers/char/tty_io.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c index cbdd1698..6c71534 100644 --- a/drivers/char/tty_io.c +++ b/drivers/char/tty_io.c @@ -1779,6 +1779,7 @@ got_driver: if (IS_ERR(tty)) { mutex_unlock(&tty_mutex); + tty_driver_kref_put(driver); return PTR_ERR(tty); } } -- 1.7.12.2.21.g234cd45.dirty
|