lkml.org 
[lkml]   [2019]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 016/230] isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ]

    The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be
    concurrently executed.

    isdn_tty_tiocmset
    isdn_tty_modem_hup
    line 719: kfree(info->dtmf_state);
    line 721: kfree(info->silence_state);
    line 723: kfree(info->adpcms);
    line 725: kfree(info->adpcmr);

    isdn_tty_set_termios
    isdn_tty_modem_hup
    line 719: kfree(info->dtmf_state);
    line 721: kfree(info->silence_state);
    line 723: kfree(info->adpcms);
    line 725: kfree(info->adpcmr);

    Thus, some concurrency double-free bugs may occur.

    These possible bugs are found by a static tool written by myself and
    my manual code review.

    To fix these possible bugs, the mutex lock "modem_info_mutex" used in
    isdn_tty_tiocmset() is added in isdn_tty_set_termios().

    Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/isdn/i4l/isdn_tty.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
    index 2175225af7421..8291e9cc949ad 100644
    --- a/drivers/isdn/i4l/isdn_tty.c
    +++ b/drivers/isdn/i4l/isdn_tty.c
    @@ -1459,15 +1459,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
    {
    modem_info *info = (modem_info *) tty->driver_data;

    + mutex_lock(&modem_info_mutex);
    if (!old_termios)
    isdn_tty_change_speed(info);
    else {
    if (tty->termios.c_cflag == old_termios->c_cflag &&
    tty->termios.c_ispeed == old_termios->c_ispeed &&
    - tty->termios.c_ospeed == old_termios->c_ospeed)
    + tty->termios.c_ospeed == old_termios->c_ospeed) {
    + mutex_unlock(&modem_info_mutex);
    return;
    + }
    isdn_tty_change_speed(info);
    }
    + mutex_unlock(&modem_info_mutex);
    }

    /*
    --
    2.19.1


    \
     
     \ /
      Last update: 2019-03-22 14:16    [W:3.475 / U:0.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site