lkml.org 
[lkml]   [2018]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 065/124] termios, tty/tty_baudrate.c: fix buffer overrun
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: H. Peter Anvin <hpa@zytor.com>

    commit 991a25194097006ec1e0d2e0814ff920e59e3465 upstream.

    On architectures with CBAUDEX == 0 (Alpha and PowerPC), the code in tty_baudrate.c does
    not do any limit checking on the tty_baudrate[] array, and in fact a
    buffer overrun is possible on both architectures. Add a limit check to
    prevent that situation.

    This will be followed by a much bigger cleanup/simplification patch.

    Signed-off-by: H. Peter Anvin (Intel) <hpa@zytor.com>
    Requested-by: Cc: Johan Hovold <johan@kernel.org>
    Cc: Jiri Slaby <jslaby@suse.com>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Richard Henderson <rth@twiddle.net>
    Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
    Cc: Matt Turner <mattst88@gmail.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Kate Stewart <kstewart@linuxfoundation.org>
    Cc: Philippe Ombredanne <pombredanne@nexb.com>
    Cc: Eugene Syromiatnikov <esyr@redhat.com>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/tty/tty_baudrate.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/drivers/tty/tty_baudrate.c
    +++ b/drivers/tty/tty_baudrate.c
    @@ -76,7 +76,7 @@ speed_t tty_termios_baud_rate(struct kte
    else
    cbaud += 15;
    }
    - return baud_table[cbaud];
    + return cbaud >= n_baud_table ? 0 : baud_table[cbaud];
    }
    EXPORT_SYMBOL(tty_termios_baud_rate);

    @@ -112,7 +112,7 @@ speed_t tty_termios_input_baud_rate(stru
    else
    cbaud += 15;
    }
    - return baud_table[cbaud];
    + return cbaud >= n_baud_table ? 0 : baud_table[cbaud];
    #else
    return tty_termios_baud_rate(termios);
    #endif

    \
     
     \ /
      Last update: 2018-11-19 19:19    [W:5.201 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site