android_kernel_google_msm/drivers/tty
Peter Hurley 624b54b852 tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
ioctl(TIOCGETD) retrieves the line discipline id directly from the
ldisc because the line discipline id (c_line) in termios is untrustworthy;
userspace may have set termios via ioctl(TCSETS*) without actually
changing the line discipline via ioctl(TIOCSETD).

However, directly accessing the current ldisc via tty->ldisc is
unsafe; the ldisc ptr dereferenced may be stale if the line discipline
is changing via ioctl(TIOCSETD) or hangup.

Wait for the line discipline reference (just like read() or write())
to retrieve the "current" line discipline id.

Bug: 28409131

Change-Id: I3f7a539ab31769f0e926d5c79d56bde652fbaf75
Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-05-24 22:07:31 +00:00
..
hvc Update copyright to The Linux Foundation 2013-03-15 17:07:39 -07:00
ipwireless
serial Update copyright to The Linux Foundation 2013-03-15 17:07:39 -07:00
vt
amiserial.c
bfin_jtag_comm.c
cyclades.c
ehv_bytechan.c
isicom.c
Kconfig
Makefile
moxa.c
moxa.h
mxser.c
mxser.h
n_gsm.c
n_hdlc.c
n_r3964.c
n_smux.c Update copyright to The Linux Foundation 2013-03-15 17:07:39 -07:00
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c n_tty: Fix n_tty_write crash when echoing in raw mode 2016-05-17 16:59:58 +00:00
nozomi.c
pty.c
rocket.c
rocket.h
rocket_int.h
smux_ctl.c Update copyright to The Linux Foundation 2013-03-15 17:07:39 -07:00
smux_debug.c Update copyright to The Linux Foundation 2013-03-15 17:07:39 -07:00
smux_loopback.c Update copyright to The Linux Foundation 2013-03-15 17:07:39 -07:00
smux_loopback.h Update copyright to The Linux Foundation 2013-03-15 17:07:39 -07:00
smux_private.h Update copyright to The Linux Foundation 2013-03-15 17:07:39 -07:00
smux_test.c Update copyright to The Linux Foundation 2013-03-15 17:07:39 -07:00
synclink.c
synclink_gt.c
synclinkmp.c
sysrq.c
tty_audit.c
tty_buffer.c
tty_io.c tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) 2016-05-24 22:07:31 +00:00
tty_ioctl.c
tty_ldisc.c
tty_mutex.c
tty_port.c