• Peter Hurley's avatar
    tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) · 5c17c861
    Peter Hurley authored
    ioctl(TIOCGETD) retrieves the line discipline id directly from the
    ldisc because the line discipline id (c_line) in termios is untrustworthy;
    userspace may have set termios via ioctl(TCSETS*) without actually
    changing the line discipline via ioctl(TIOCSETD).
    
    However, directly accessing the current ldisc via tty->ldisc is
    unsafe; the ldisc ptr dereferenced may be stale if the line discipline
    is changing via ioctl(TIOCSETD) or hangup.
    
    Wait for the line discipline reference (just like read() or write())
    to retrieve the "current" line discipline id.
    
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarPeter Hurley <peter@hurleysoftware.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    5c17c861
tty_io.c 89.6 KB