Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-25 04:11:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
3ea7286139
linux/drivers/tty
History
Peter Hurley 9ce119f318 tty: Fix GPF in flush_to_ldisc() 
A line discipline which does not define a receive_buf() method can
can cause a GPF if data is ever received [1]. Oddly, this was known
to the author of n_tracesink in 2011, but never fixed.

[1] GPF report
    BUG: unable to handle kernel NULL pointer dereference at           (null)
    IP: [<          (null)>]           (null)
    PGD 3752d067 PUD 37a7b067 PMD 0
    Oops: 0010 [#1] SMP KASAN
    Modules linked in:
    CPU: 2 PID: 148 Comm: kworker/u10:2 Not tainted 4.4.0-rc2+ #51
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
    Workqueue: events_unbound flush_to_ldisc
    task: ffff88006da94440 ti: ffff88006db60000 task.ti: ffff88006db60000
    RIP: 0010:[<0000000000000000>]  [<          (null)>]           (null)
    RSP: 0018:ffff88006db67b50  EFLAGS: 00010246
    RAX: 0000000000000102 RBX: ffff88003ab32f88 RCX: 0000000000000102
    RDX: 0000000000000000 RSI: ffff88003ab330a6 RDI: ffff88003aabd388
    RBP: ffff88006db67c48 R08: ffff88003ab32f9c R09: ffff88003ab31fb0
    R10: ffff88003ab32fa8 R11: 0000000000000000 R12: dffffc0000000000
    R13: ffff88006db67c20 R14: ffffffff863df820 R15: ffff88003ab31fb8
    FS:  0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000000 CR3: 0000000037938000 CR4: 00000000000006e0
    Stack:
     ffffffff829f46f1 ffff88006da94bf8 ffff88006da94bf8 0000000000000000
     ffff88003ab31fb0 ffff88003aabd438 ffff88003ab31ff8 ffff88006430fd90
     ffff88003ab32f9c ffffed0007557a87 1ffff1000db6cf78 ffff88003ab32078
    Call Trace:
     [<ffffffff8127cf91>] process_one_work+0x8f1/0x17a0 kernel/workqueue.c:2030
     [<ffffffff8127df14>] worker_thread+0xd4/0x1180 kernel/workqueue.c:2162
     [<ffffffff8128faaf>] kthread+0x1cf/0x270 drivers/block/aoe/aoecmd.c:1302
     [<ffffffff852a7c2f>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468
    Code:  Bad RIP value.
    RIP  [<          (null)>]           (null)
     RSP <ffff88006db67b50>
    CR2: 0000000000000000
    ---[ end trace a587f8947e54d6ea ]---

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-12 23:05:28 -08:00
..
hvc TTY/Serial driver patches for 4.4-rc1 2015-11-04 21:35:12 -08:00
ipwireless Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2015-04-14 09:50:27 -07:00
serial serial: earlycon: Add missing spinlock initialization 2015-12-12 23:05:28 -08:00
vt tty: vt: Fix !TASK_RUNNING diagnostic warning from paste_selection() 2015-07-23 18:08:29 -07:00
amiserial.c tty: amiserial.c: move assignment out of if () block 2015-05-10 19:04:16 +02:00
bfin_jtag_comm.c
cyclades.c tty: Remove ASYNC_CLOSING checks in open()/hangup() methods 2015-10-17 21:11:29 -07:00
ehv_bytechan.c
goldfish.c staging: goldfish: Fix pointer cast for 32 bits 2015-05-31 11:40:14 +09:00
isicom.c
Kconfig ttyFDC: Implement KGDB IO operations. 2015-03-31 12:04:13 +02:00
Makefile TTY: Add MIPS EJTAG Fast Debug Channel TTY driver 2015-03-31 12:04:12 +02:00
metag_da.c tty/metag_da: Avoid module_init/module_exit in non-modular code 2015-06-16 14:12:31 -04:00
mips_ejtag_fdc.c ttyFDC: Fix build problems due to use of module_{init,exit} 2015-10-17 21:29:21 -07:00
moxa.c
moxa.h
mxser.c
mxser.h
n_gsm.c tty: Convert use of __constant_htons to htons 2015-07-23 15:10:25 -07:00
n_hdlc.c pty: Fix input race when closing 2015-05-10 19:26:37 +02:00
n_r3964.c tty: r3964: Replace/remove bogus tty lock use 2015-10-17 21:11:29 -07:00
n_tracerouter.c n_tracerouter: stop including <asm-generic/bug> 2015-10-15 00:21:10 +02:00
n_tracesink.c n_tracesink: stop including <asm-generic/bug> 2015-10-15 00:21:11 +02:00
n_tracesink.h
n_tty.c n_tty: Fix poll() after buffer-limited eof push read 2015-12-12 21:42:31 -08:00
nozomi.c drivers/tty/nozomi.c: rename CONFIG_MAGIC 2015-05-10 19:19:06 +02:00
pty.c drivers/tty: make pty.c slightly more explicitly non-modular 2015-10-04 17:27:56 +01:00
rocket_int.h
rocket.c tty: Remove tty_port::close_wait 2015-10-17 21:11:29 -07:00
rocket.h tty: rocket: fix comment of ROCKET_SPD_HI 2015-05-24 12:49:16 -07:00
synclink_gt.c tty: Remove ASYNC_CLOSING checks in open()/hangup() methods 2015-10-17 21:11:29 -07:00
synclink.c tty: synclink, fix indentation 2015-10-17 21:14:06 -07:00
synclinkmp.c tty: Remove ASYNC_CLOSING checks in open()/hangup() methods 2015-10-17 21:11:29 -07:00
sysrq.c drivers/tty: make sysrq.c slightly more explicitly non-modular 2015-10-04 17:27:56 +01:00
tty_audit.c tty: audit: Fix audit source 2015-11-20 16:19:54 -08:00
tty_buffer.c tty: Fix GPF in flush_to_ldisc() 2015-12-12 23:05:28 -08:00
tty_io.c tty: Fix tty_send_xchar() lock order inversion 2015-11-20 16:19:54 -08:00
tty_ioctl.c tty: Fix tty_send_xchar() lock order inversion 2015-11-20 16:19:54 -08:00
tty_ldisc.c tty: Fix direct use of tty buffer work 2015-11-20 16:19:54 -08:00
tty_ldsem.c tty: tty_ldsem.c: move assignment out of if () block 2015-05-10 19:04:18 +02:00
tty_mutex.c
tty_port.c tty: Abstract tty buffer work 2015-10-17 21:32:21 -07:00