summaryrefslogtreecommitdiff
path: root/drivers/usb/host/xhci-ring.c
diff options
context:
space:
mode:
authorPeter Hurley <peter@hurleysoftware.com>2016-01-10 22:40:55 -0800
committerJiri Slaby <jslaby@suse.cz>2016-02-23 17:54:31 +0100
commit4e6d2e76232ae19658064746fd5e5d800b8b5964 (patch)
treeea393a375841a1e4a72239995cee7580b2726430 /drivers/usb/host/xhci-ring.c
parente13eaeb04dd5241d33104fef290afe750e0b4358 (diff)
downloadlwn-4e6d2e76232ae19658064746fd5e5d800b8b5964.tar.gz
lwn-4e6d2e76232ae19658064746fd5e5d800b8b5964.zip
tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
commit 5c17c861a357e9458001f021a7afa7aab9937439 upstream. ioctl(TIOCGETD) retrieves the line discipline id directly from the ldisc because the line discipline id (c_line) in termios is untrustworthy; userspace may have set termios via ioctl(TCSETS*) without actually changing the line discipline via ioctl(TIOCSETD). However, directly accessing the current ldisc via tty->ldisc is unsafe; the ldisc ptr dereferenced may be stale if the line discipline is changing via ioctl(TIOCSETD) or hangup. Wait for the line discipline reference (just like read() or write()) to retrieve the "current" line discipline id. Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'drivers/usb/host/xhci-ring.c')
0 files changed, 0 insertions, 0 deletions