lkml.org 
[lkml]   [2019]   [Feb]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 50/83] isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
    Date
    From: Jia-Ju Bai <baijiaju1990@gmail.com>

    [ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ]

    The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be
    concurrently executed.

    isdn_tty_tiocmset
    isdn_tty_modem_hup
    line 719: kfree(info->dtmf_state);
    line 721: kfree(info->silence_state);
    line 723: kfree(info->adpcms);
    line 725: kfree(info->adpcmr);

    isdn_tty_set_termios
    isdn_tty_modem_hup
    line 719: kfree(info->dtmf_state);
    line 721: kfree(info->silence_state);
    line 723: kfree(info->adpcms);
    line 725: kfree(info->adpcmr);

    Thus, some concurrency double-free bugs may occur.

    These possible bugs are found by a static tool written by myself and
    my manual code review.

    To fix these possible bugs, the mutex lock "modem_info_mutex" used in
    isdn_tty_tiocmset() is added in isdn_tty_set_termios().

    Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/isdn/i4l/isdn_tty.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
    index b730037a0e2d..9cff667b2d24 100644
    --- a/drivers/isdn/i4l/isdn_tty.c
    +++ b/drivers/isdn/i4l/isdn_tty.c
    @@ -1456,15 +1456,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
    {
    modem_info *info = (modem_info *) tty->driver_data;

    + mutex_lock(&modem_info_mutex);
    if (!old_termios)
    isdn_tty_change_speed(info);
    else {
    if (tty->termios.c_cflag == old_termios->c_cflag &&
    tty->termios.c_ispeed == old_termios->c_ispeed &&
    - tty->termios.c_ospeed == old_termios->c_ospeed)
    + tty->termios.c_ospeed == old_termios->c_ospeed) {
    + mutex_unlock(&modem_info_mutex);
    return;
    + }
    isdn_tty_change_speed(info);
    }
    + mutex_unlock(&modem_info_mutex);
    }

    /*
    --
    2.19.1
    \
     
     \ /
      Last update: 2019-02-13 03:54    [W:2.521 / U:0.336 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site