Author: tomwij Date: 2014-05-16 20:00:58 +0000 (Fri, 16 May 2014) New Revision: 2795
Modified: genpatches-2.6/trunk/3.2/0000_README genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch genpatches-2.6/trunk/3.4/0000_README genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch Log: Fixed broken backports by using the CVE-2014-0196 patch from the stable queue for branches 3.2 and 3.4. Modified: genpatches-2.6/trunk/3.2/0000_README =================================================================== --- genpatches-2.6/trunk/3.2/0000_README 2014-05-16 14:06:12 UTC (rev 2794) +++ genpatches-2.6/trunk/3.2/0000_README 2014-05-16 20:00:58 UTC (rev 2795) @@ -273,7 +273,7 @@ Desc: Linux 3.2.58 Patch: 1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch -From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4291086b1f081b869c6d79e5b7441633dc3ace00 +From: https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/commit/?id=19f9438d73833ed532c3ba4955f9c981c9af16f2 Desc: n_tty: Fix n_tty_write crash when echoing in raw mode Patch: 1500_XATTR_USER_PREFIX.patch Modified: genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch =================================================================== --- genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 14:06:12 UTC (rev 2794) +++ genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 20:00:58 UTC (rev 2795) @@ -1,8 +1,9 @@ -From 4291086b1f081b869c6d79e5b7441633dc3ace00 Mon Sep 17 00:00:00 2001 From: Peter Hurley <[email protected]> Date: Sat, 3 May 2014 14:04:59 +0200 Subject: n_tty: Fix n_tty_write crash when echoing in raw mode +commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream. + The tty atomic_write_lock does not provide an exclusion guarantee for the tty driver if the termios settings are LECHO & !OPOST. And since it is unexpected and not allowed to call TTY buffer helpers like @@ -55,26 +56,22 @@ Signed-off-by: Jiri Slaby <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Alan Cox <[email protected]> -Cc: <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> +[bwh: Backported to 3.2: output_lock is a member of struct tty_struct] +Signed-off-by: Ben Hutchings <[email protected]> +--- + drivers/tty/n_tty.c | 2 ++ + 1 file changed, 2 insertions(+) -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index 41fe8a0..fe9d129 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c -@@ -2353,8 +2353,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file, - if (tty->ops->flush_chars) +@@ -1996,7 +1996,9 @@ static ssize_t n_tty_write(struct tty_st tty->ops->flush_chars(tty); } else { -+ struct n_tty_data *ldata = tty->disc_data; -+ while (nr > 0) { -+ mutex_lock(&ldata->output_lock); ++ mutex_lock(&tty->output_lock); c = tty->ops->write(tty, b, nr); -+ mutex_unlock(&ldata->output_lock); ++ mutex_unlock(&tty->output_lock); if (c < 0) { retval = c; goto break_out; --- -cgit v0.10.1 - Modified: genpatches-2.6/trunk/3.4/0000_README =================================================================== --- genpatches-2.6/trunk/3.4/0000_README 2014-05-16 14:06:12 UTC (rev 2794) +++ genpatches-2.6/trunk/3.4/0000_README 2014-05-16 20:00:58 UTC (rev 2795) @@ -400,7 +400,7 @@ Desc: Linux 3.4.90 Patch: 1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch -From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4291086b1f081b869c6d79e5b7441633dc3ace00 +From: https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/commit/?id=19f9438d73833ed532c3ba4955f9c981c9af16f2 Desc: n_tty: Fix n_tty_write crash when echoing in raw mode Patch: 1500_XATTR_USER_PREFIX.patch Modified: genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch =================================================================== --- genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 14:06:12 UTC (rev 2794) +++ genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 20:00:58 UTC (rev 2795) @@ -1,8 +1,9 @@ -From 4291086b1f081b869c6d79e5b7441633dc3ace00 Mon Sep 17 00:00:00 2001 From: Peter Hurley <[email protected]> Date: Sat, 3 May 2014 14:04:59 +0200 Subject: n_tty: Fix n_tty_write crash when echoing in raw mode +commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream. + The tty atomic_write_lock does not provide an exclusion guarantee for the tty driver if the termios settings are LECHO & !OPOST. And since it is unexpected and not allowed to call TTY buffer helpers like @@ -55,26 +56,22 @@ Signed-off-by: Jiri Slaby <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Alan Cox <[email protected]> -Cc: <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> +[bwh: Backported to 3.2: output_lock is a member of struct tty_struct] +Signed-off-by: Ben Hutchings <[email protected]> +--- + drivers/tty/n_tty.c | 2 ++ + 1 file changed, 2 insertions(+) -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index 41fe8a0..fe9d129 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c -@@ -2353,8 +2353,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file, - if (tty->ops->flush_chars) +@@ -1996,7 +1996,9 @@ static ssize_t n_tty_write(struct tty_st tty->ops->flush_chars(tty); } else { -+ struct n_tty_data *ldata = tty->disc_data; -+ while (nr > 0) { -+ mutex_lock(&ldata->output_lock); ++ mutex_lock(&tty->output_lock); c = tty->ops->write(tty, b, nr); -+ mutex_unlock(&ldata->output_lock); ++ mutex_unlock(&tty->output_lock); if (c < 0) { retval = c; goto break_out; --- -cgit v0.10.1 -
