Messages in this thread | | | Date | Wed, 10 Aug 2022 07:18:24 +0200 | From | Greg KH <> | Subject | Re: [PATCH] tty: n_gsm: fix missing assignment of gsm->receive() in gsmld_attach_gsm() |
| |
On Wed, Aug 10, 2022 at 06:12:52AM +0300, Mazin Al Haddad wrote: > Fixes a bug reported by syzbot.
I do not understand this sentence :(
> A null pointer dereference can > happen when attempting to access the "gsm->receive()" function in > gsmld_receive_buf(). Currently, the "gsm->receive()" function is only set > after a call to the GSMIO_SETCONF ioctl. Since the gsmld_receive_buf() > function can be accessed without the need to call the line discipline > ioctl (GSMIO_SETCONF), the gsm->receive() function will not be set and a > NULL pointer dereference will occur. > > Fix this by setting the gsm->receive() function when the line discipline > is being attached to the terminal device, inside gsmld_attach_gsm(). This > will guarantee that the function is assigned and a call to TIOCSTI, > which calls gsmld_receive_buf(), will not reference a null pointer. > > Call Trace: > <TASK> > gsmld_receive_buf+0x1c2/0x2f0 drivers/tty/n_gsm.c:2861 > tiocsti drivers/tty/tty_io.c:2293 [inline] > tty_ioctl+0xa75/0x15d0 drivers/tty/tty_io.c:2692 > vfs_ioctl fs/ioctl.c:51 [inline] > __do_sys_ioctl fs/ioctl.c:870 [inline] > __se_sys_ioctl fs/ioctl.c:856 [inline] > __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 > do_syscall_x64 arch/x86/entry/common.c:50 [inline] > do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 > entry_SYSCALL_64_after_hwframe+0x63/0xcd > > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open") > Reported-and-tested-by: syzbot+e3563f0c94e188366dbb@syzkaller.appspotmail.com > Signed-off-by: Mazin Al Haddad <mazinalhaddad05@gmail.com>
What commit does this fix?
thanks,
greg k-h
| |