evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

isdn: i4l: isdn_tty: Fix some concurrency double-free bugs

Browse source 
[ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ]

The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be
concurrently executed.

isdn_tty_tiocmset
  isdn_tty_modem_hup
    line 719: kfree(info->dtmf_state);
    line 721: kfree(info->silence_state);
    line 723: kfree(info->adpcms);
    line 725: kfree(info->adpcmr);

isdn_tty_set_termios
  isdn_tty_modem_hup
    line 719: kfree(info->dtmf_state);
    line 721: kfree(info->silence_state);
    line 723: kfree(info->adpcms);
    line 725: kfree(info->adpcmr);

Thus, some concurrency double-free bugs may occur.

These possible bugs are found by a static tool written by myself and
my manual code review.

To fix these possible bugs, the mutex lock "modem_info_mutex" used in
isdn_tty_tiocmset() is added in isdn_tty_set_termios().

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Jia-Ju Bai 2019-01-08 21:04:48 +08:00 • committed by Greg Kroah-Hartman
parent 2b285e4460
commit fd8662fa59
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/isdn/i4l/isdn_tty.c
View file

@ -1459,15 +1459,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
{ {
modem_info *info = (modem_info *) tty->driver_data; modem_info *info = (modem_info *) tty->driver_data;
mutex_lock(&modem_info_mutex);
if (!old_termios) if (!old_termios)
isdn_tty_change_speed(info); isdn_tty_change_speed(info);
else { else {
if (tty->termios.c_cflag == old_termios->c_cflag && if (tty->termios.c_cflag == old_termios->c_cflag &&
tty->termios.c_ispeed == old_termios->c_ispeed && tty->termios.c_ispeed == old_termios->c_ispeed &&
tty->termios.c_ospeed == old_termios->c_ospeed) tty->termios.c_ospeed == old_termios->c_ospeed) {
mutex_unlock(&modem_info_mutex);
return; return;
}
isdn_tty_change_speed(info); isdn_tty_change_speed(info);
} }
mutex_unlock(&modem_info_mutex);
} }
/* /*