forked from Minki/linux
tty: Fix oops when scanning the polling list for kgdb
Costantino Leandro found a bug in tty_find_polling_driver and provided a patch that fixed the crash but not the underlying bug. This fixes the underlying bug where the list walk corrupts the values it is using on a match but then reuses them if the open fails. Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
620df3c0a5
commit
5f0878acba
@ -295,7 +295,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
|
||||
struct tty_driver *p, *res = NULL;
|
||||
int tty_line = 0;
|
||||
int len;
|
||||
char *str;
|
||||
char *str, *stp;
|
||||
|
||||
for (str = name; *str; str++)
|
||||
if ((*str >= '0' && *str <= '9') || *str == ',')
|
||||
@ -311,13 +311,14 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line)
|
||||
list_for_each_entry(p, &tty_drivers, tty_drivers) {
|
||||
if (strncmp(name, p->name, len) != 0)
|
||||
continue;
|
||||
if (*str == ',')
|
||||
str++;
|
||||
if (*str == '\0')
|
||||
str = NULL;
|
||||
stp = str;
|
||||
if (*stp == ',')
|
||||
stp++;
|
||||
if (*stp == '\0')
|
||||
stp = NULL;
|
||||
|
||||
if (tty_line >= 0 && tty_line <= p->num && p->ops &&
|
||||
p->ops->poll_init && !p->ops->poll_init(p, tty_line, str)) {
|
||||
p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {
|
||||
res = tty_driver_kref_get(p);
|
||||
*line = tty_line;
|
||||
break;
|
||||
|
Loading…
Reference in New Issue
Block a user