Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-02-12 22:18:26 +0100
committerJiri Slaby <jslaby@suse.cz>2019-02-12 22:21:25 +0100
commit7c4554c367b35390fa0090e29d59cd709f53cd74 (patch)
tree39e8afffda42ec1ccd67ff36eb422598dc67b148
parent180e3c71eb2e0c13e60429e92152da0124f7227d (diff)
staging: speakup: fix tty-operation NULL derefs (bnc#1012628).
-rw-r--r--patches.kernel.org/4.20.8-326-staging-speakup-fix-tty-operation-NULL-derefs.patch52
-rw-r--r--series.conf1
2 files changed, 53 insertions, 0 deletions
diff --git a/patches.kernel.org/4.20.8-326-staging-speakup-fix-tty-operation-NULL-derefs.patch b/patches.kernel.org/4.20.8-326-staging-speakup-fix-tty-operation-NULL-derefs.patch
new file mode 100644
index 0000000000..09783a8197
--- /dev/null
+++ b/patches.kernel.org/4.20.8-326-staging-speakup-fix-tty-operation-NULL-derefs.patch
@@ -0,0 +1,52 @@
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 30 Jan 2019 10:49:34 +0100
+Subject: [PATCH] staging: speakup: fix tty-operation NULL derefs
+References: bnc#1012628
+Patch-mainline: 4.20.8
+Git-commit: a1960e0f1639cb1f7a3d94521760fc73091f6640
+
+commit a1960e0f1639cb1f7a3d94521760fc73091f6640 upstream.
+
+The send_xchar() and tiocmset() tty operations are optional. Add the
+missing sanity checks to prevent user-space triggerable NULL-pointer
+dereferences.
+
+Fixes: 6b9ad1c742bf ("staging: speakup: add send_xchar, tiocmset and input functionality for tty")
+Cc: stable <stable@vger.kernel.org> # 4.13
+Cc: Okash Khawaja <okash.khawaja@gmail.com>
+Cc: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/staging/speakup/spk_ttyio.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
+index 979e3ae249c1..033be0ad03e7 100644
+--- a/drivers/staging/speakup/spk_ttyio.c
++++ b/drivers/staging/speakup/spk_ttyio.c
+@@ -265,7 +265,8 @@ static void spk_ttyio_send_xchar(char ch)
+ return;
+ }
+
+- speakup_tty->ops->send_xchar(speakup_tty, ch);
++ if (speakup_tty->ops->send_xchar)
++ speakup_tty->ops->send_xchar(speakup_tty, ch);
+ mutex_unlock(&speakup_tty_mutex);
+ }
+
+@@ -277,7 +278,8 @@ static void spk_ttyio_tiocmset(unsigned int set, unsigned int clear)
+ return;
+ }
+
+- speakup_tty->ops->tiocmset(speakup_tty, set, clear);
++ if (speakup_tty->ops->tiocmset)
++ speakup_tty->ops->tiocmset(speakup_tty, set, clear);
+ mutex_unlock(&speakup_tty_mutex);
+ }
+
+--
+2.20.1
+
diff --git a/series.conf b/series.conf
index 81df309143..f14182b546 100644
--- a/series.conf
+++ b/series.conf
@@ -1062,6 +1062,7 @@
patches.kernel.org/4.20.8-323-usb-dwc3-gadget-Handle-0-xfer-length-for-OUT-E.patch
patches.kernel.org/4.20.8-324-usb-gadget-udc-net2272-Fix-bitwise-and-boolean.patch
patches.kernel.org/4.20.8-325-usb-gadget-musb-fix-short-isoc-packets-with-in.patch
+ patches.kernel.org/4.20.8-326-staging-speakup-fix-tty-operation-NULL-derefs.patch
########################################################
# Build fixes that apply to the vanilla kernel too.