From 221ba151731133c8b0e1cdb9bfd2a45b3ba8764b Mon Sep 17 00:00:00 2001 From: "salina@us.ibm.com" Date: Tue, 7 May 2013 16:18:09 +0200 Subject: Char: lp, protect LPGETSTATUS with port_mutex The patch fixes a problem in the lp driver that can cause oopses as follows: process A: calls lp_write, which in turn calls parport_ieee1284_write_compat, and that invokes parport_wait_peripheral process B: meanwhile does an ioctl(LPGETSTATUS), which call lp_release_parport when done. This function will set physport->cad = NULL. process A: parport_wait_peripheral tries to dereference physport->cad and dies So, protect that code with the port_mutex in order to protect against simultaneous calls to lp_read/lp_write. Similar protection is probably required for ioctl(LPRESET)... This patch was done by IBM a while back and we (at suse) have that since at least 2004 in our repos. Let's make it upstream. Signed-off-by: okir@suse.de Signed-off-by: Jiri Slaby Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/char/lp.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/char') diff --git a/drivers/char/lp.c b/drivers/char/lp.c index dafd9ac6428f..0913d79424d3 100644 --- a/drivers/char/lp.c +++ b/drivers/char/lp.c @@ -622,9 +622,12 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd, return -EFAULT; break; case LPGETSTATUS: + if (mutex_lock_interruptible(&lp_table[minor].port_mutex)) + return -EINTR; lp_claim_parport_or_block (&lp_table[minor]); status = r_str(minor); lp_release_parport (&lp_table[minor]); + mutex_unlock(&lp_table[minor].port_mutex); if (copy_to_user(argp, &status, sizeof(int))) return -EFAULT; -- cgit v1.2.3 From b5325a02aa84c794cf520d6d68cae4b150988a32 Mon Sep 17 00:00:00 2001 From: "Darrick J. Wong" Date: Fri, 10 May 2013 15:40:13 -0700 Subject: ttyprintk: Fix NULL pointer deref by setting tty_port ops after initializing port tty_port_init() zeroes out the tty port, which means that we have to set the ops pointer /after/, not before this call. Otherwise, tty_port_open will crash when it tries to deref ops, which is now a NULL pointer. Signed-off-by: Darrick J. Wong Signed-off-by: Greg Kroah-Hartman --- drivers/char/ttyprintk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/char') diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c index 4945bd3d18d0..d5d2e4a985aa 100644 --- a/drivers/char/ttyprintk.c +++ b/drivers/char/ttyprintk.c @@ -179,7 +179,6 @@ static int __init ttyprintk_init(void) { int ret = -ENOMEM; - tpk_port.port.ops = &null_ops; mutex_init(&tpk_port.port_write_mutex); ttyprintk_driver = tty_alloc_driver(1, @@ -190,6 +189,7 @@ static int __init ttyprintk_init(void) return PTR_ERR(ttyprintk_driver); tty_port_init(&tpk_port.port); + tpk_port.port.ops = &null_ops; ttyprintk_driver->driver_name = "ttyprintk"; ttyprintk_driver->name = "ttyprintk"; -- cgit v1.2.3