tty: fix break race
Get series with b4
b4 am [email protected]Versions newest first · linked by author and title
- v2 Latest2 patches 1 replyIn review
- v11 patch 0 repliesSuperseded
Changes in v2 from the cover letter
- v1 https://lore.kernel.org/stable/[email protected]/T/#t
- Proper check on the tty side, plus check on the USB side.
- Tested syzbot
Patches in v2 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | USB: serial: fix break_ctl() NULL-pointer dereferencedrivers/ | +3 | 0 replies | |
| 2/2 | tty: fix break racedrivers/ | +15 | 0 replies |
Reviews trailers per patch
None of the 2 patches has a Reviewed-by or Acked-by.
| Patch | [email protected] |
|---|---|
| Series | T-b |
| 1/2 | T-b |
| 2/2 | T-b |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.
Cover letter [PATCH v2 0/2] tty: fix break race
A timed break (TCSBRK/TCSBRKP) and the unconditional TIOCSBRK/TIOCCBRK can race against USB disconnect and call break_ctl() after the device is gone, dereferencing freed port data in keyspan_break_ctl().
Both patches are needed: the tty core must not issue break_ctl() to a hung-up tty, and serial_break() must not call the driver after disconnect. This is the same two-layer protection read and write already use.
Changes since v1:
- v1 https://lore.kernel.org/stable/[email protected]/T/#t
- Proper check on the tty side, plus check on the USB side.
- Tested syzbot
Adriano Cordova (2):
USB: serial: fix break_ctl() NULL-pointer dereference
tty: fix break race
drivers/tty/tty_io.c | 19 +++++++++++++++---- drivers/usb/serial/usb-serial.c | 3 +++ 2 files changed, 18 insertions(+), 4 deletions(-)
Signature · 1 line
2.51.0