* [gentoo-commits] linux-patches r2795 - in genpatches-2.6/trunk: 3.2 3.4
@ 2014-05-16 20:00 Tom Wijsman (tomwij)
0 siblings, 0 replies; only message in thread
From: Tom Wijsman (tomwij) @ 2014-05-16 20:00 UTC (permalink / raw
To: gentoo-commits
Author: tomwij
Date: 2014-05-16 20:00:58 +0000 (Fri, 16 May 2014)
New Revision: 2795
Modified:
genpatches-2.6/trunk/3.2/0000_README
genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
genpatches-2.6/trunk/3.4/0000_README
genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
Log:
Fixed broken backports by using the CVE-2014-0196 patch from the stable queue for branches 3.2 and 3.4.
Modified: genpatches-2.6/trunk/3.2/0000_README
===================================================================
--- genpatches-2.6/trunk/3.2/0000_README 2014-05-16 14:06:12 UTC (rev 2794)
+++ genpatches-2.6/trunk/3.2/0000_README 2014-05-16 20:00:58 UTC (rev 2795)
@@ -273,7 +273,7 @@
Desc: Linux 3.2.58
Patch: 1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
-From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4291086b1f081b869c6d79e5b7441633dc3ace00
+From: https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/commit/?id=19f9438d73833ed532c3ba4955f9c981c9af16f2
Desc: n_tty: Fix n_tty_write crash when echoing in raw mode
Patch: 1500_XATTR_USER_PREFIX.patch
Modified: genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 14:06:12 UTC (rev 2794)
+++ genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 20:00:58 UTC (rev 2795)
@@ -1,8 +1,9 @@
-From 4291086b1f081b869c6d79e5b7441633dc3ace00 Mon Sep 17 00:00:00 2001
From: Peter Hurley <peter@hurleysoftware.com>
Date: Sat, 3 May 2014 14:04:59 +0200
Subject: n_tty: Fix n_tty_write crash when echoing in raw mode
+commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.
+
The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
@@ -55,26 +56,22 @@
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
-Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/n_tty.c | 2 ++
+ 1 file changed, 2 insertions(+)
-diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index 41fe8a0..fe9d129 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
-@@ -2353,8 +2353,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
- if (tty->ops->flush_chars)
+@@ -1996,7 +1996,9 @@ static ssize_t n_tty_write(struct tty_st
tty->ops->flush_chars(tty);
} else {
-+ struct n_tty_data *ldata = tty->disc_data;
-+
while (nr > 0) {
-+ mutex_lock(&ldata->output_lock);
++ mutex_lock(&tty->output_lock);
c = tty->ops->write(tty, b, nr);
-+ mutex_unlock(&ldata->output_lock);
++ mutex_unlock(&tty->output_lock);
if (c < 0) {
retval = c;
goto break_out;
---
-cgit v0.10.1
-
Modified: genpatches-2.6/trunk/3.4/0000_README
===================================================================
--- genpatches-2.6/trunk/3.4/0000_README 2014-05-16 14:06:12 UTC (rev 2794)
+++ genpatches-2.6/trunk/3.4/0000_README 2014-05-16 20:00:58 UTC (rev 2795)
@@ -400,7 +400,7 @@
Desc: Linux 3.4.90
Patch: 1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
-From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4291086b1f081b869c6d79e5b7441633dc3ace00
+From: https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/commit/?id=19f9438d73833ed532c3ba4955f9c981c9af16f2
Desc: n_tty: Fix n_tty_write crash when echoing in raw mode
Patch: 1500_XATTR_USER_PREFIX.patch
Modified: genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 14:06:12 UTC (rev 2794)
+++ genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 20:00:58 UTC (rev 2795)
@@ -1,8 +1,9 @@
-From 4291086b1f081b869c6d79e5b7441633dc3ace00 Mon Sep 17 00:00:00 2001
From: Peter Hurley <peter@hurleysoftware.com>
Date: Sat, 3 May 2014 14:04:59 +0200
Subject: n_tty: Fix n_tty_write crash when echoing in raw mode
+commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.
+
The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
@@ -55,26 +56,22 @@
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
-Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+---
+ drivers/tty/n_tty.c | 2 ++
+ 1 file changed, 2 insertions(+)
-diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index 41fe8a0..fe9d129 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
-@@ -2353,8 +2353,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
- if (tty->ops->flush_chars)
+@@ -1996,7 +1996,9 @@ static ssize_t n_tty_write(struct tty_st
tty->ops->flush_chars(tty);
} else {
-+ struct n_tty_data *ldata = tty->disc_data;
-+
while (nr > 0) {
-+ mutex_lock(&ldata->output_lock);
++ mutex_lock(&tty->output_lock);
c = tty->ops->write(tty, b, nr);
-+ mutex_unlock(&ldata->output_lock);
++ mutex_unlock(&tty->output_lock);
if (c < 0) {
retval = c;
goto break_out;
---
-cgit v0.10.1
-
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2014-05-16 20:01 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-05-16 20:00 [gentoo-commits] linux-patches r2795 - in genpatches-2.6/trunk: 3.2 3.4 Tom Wijsman (tomwij)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox