speakup: Reject setting the speakup line discipline outside of speakup
PATCH 1/1 speakup: Reject setting the speakup line discipline outside of speakup
[backport of 5.10 commit f0992098cadb4c9c6a00703b66cafe604e178fea]
Speakup exposing a line discipline allows userland to try to use it, while it is deemed to be useless, and thus uselessly exposes potential bugs. One of them is simply that in such a case if the line sends data, spk_ttyio_receive_buf2 is called and crashes since spk_ttyio_synth is NULL.
This change restricts the use of the speakup line discipline to speakup drivers, thus avoiding such kind of issues altogether.
drivers/staging/speakup/spk_ttyio.c +23 -15
@@ -47,28 +47,20 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty) {struct spk_ldisc_data *ldisc_data; +if (tty != speakup_tty) +/* Somebody tried to use this line discipline outside speakup */ +return -ENODEV ; +if (tty->ops->write ==NULL )return -EOPNOTSUPP ; -mutex_lock (&speakup_tty_mutex); -if (speakup_tty) { -mutex_unlock (&speakup_tty_mutex); -return -EBUSY ; - } - speakup_tty = tty; - ldisc_data =kmalloc (sizeof (struct spk_ldisc_data ),GFP_KERNEL ); -if (!ldisc_data) { - speakup_tty =NULL ; -mutex_unlock (&speakup_tty_mutex); -pr_err ("speakup: Failed to allocate ldisc_data.\n" ); +if (!ldisc_data)return -ENOMEM ; - }sema_init (&ldisc_data->sem,0 ); ldisc_data->buf_free = true; - speakup_tty->disc_data = ldisc_data; -mutex_unlock (&speakup_tty_mutex); + tty->disc_data = ldisc_data;return 0 ; }
@@ -191,9 +184,25 @@ static int spk_ttyio_initialise_ldisc(struct spk_synth *synth)tty_unlock (tty); +mutex_lock (&speakup_tty_mutex); + speakup_tty = tty; ret =tty_set_ldisc (tty,N_SPEAKUP );if (ret) -pr_err ("speakup: Failed to set N_SPEAKUP on tty\n" ); + speakup_tty =NULL ; +mutex_unlock (&speakup_tty_mutex); + +if (!ret) +/* Success */ +return 0 ; + +pr_err ("speakup: Failed to set N_SPEAKUP on tty\n" ); + +tty_lock (tty); +if (tty->ops->close) + tty->ops->close (tty,NULL ); +tty_unlock (tty); + +tty_kclose (tty);return ret; }
Quoted 11 lines · Samuel Thibault
[backport of 5.10 commit
f0992098cadb4c9c6a00703b66cafe604e178fea]Speakup exposing a line discipline allows userland to try to use it, while it is deemed to be useless, and thus uselessly exposes potential bugs. One of them is simply that in such a case if the line sends data,
spk_ttyio_receive_buf2is called and crashes sincespk_ttyio_synthis NULL.This change restricts the use of the speakup line discipline to speakup drivers, thus avoiding such kind of issues altogether.
Quoted 6 lines
Reported-by Shisong Qin <[email protected]>Signed-off-by Samuel Thibault <[email protected]>Tested-by Shisong Qin <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Both of these worked, thanks!
greg k-h