Messages in this thread | | | Date | Sat, 19 Jan 2019 10:11:08 +0100 | From | Greg Kroah-Hartman <> | Subject | Re: [BUG] tiocsti() NULL dereference if ld->ops->receive_buf==NULL |
| |
On Fri, Jan 18, 2019 at 08:09:07PM +0100, Jann Horn wrote: > Hi! > > When a line discipline doesn't have a ->receive_buf handler, tiocsti() > attempts to call a NULL pointer. Both tty_n_tracesink and > spk_ttyio_ldisc_ops don't have such a handler. > > To reproduce, build a kernel with CONFIG_SPEAKUP=y and > CONFIG_SPEAKUP_SYNTH_SOFT=y, set speakup.synth=soft in the kernel > command line, and run the following code as root:
<snip>
Ugh, thanks for finding this. I'll look at it later this afternoon...
greg k-h
| |