From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (unknown [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 0AD271381FA for ; Fri, 16 May 2014 20:01:03 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 37336E0AE7; Fri, 16 May 2014 20:01:02 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id A8188E0AE7 for ; Fri, 16 May 2014 20:01:01 +0000 (UTC) Received: from flycatcher.gentoo.org (unknown [81.93.255.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id A0B603400FA for ; Fri, 16 May 2014 20:01:00 +0000 (UTC) Received: by flycatcher.gentoo.org (Postfix, from userid 2335) id 4D98F2004C; Fri, 16 May 2014 20:00:59 +0000 (UTC) To: gentoo-commits@lists.gentoo.org From: "Tom Wijsman (tomwij)" Subject: [gentoo-commits] linux-patches r2795 - in genpatches-2.6/trunk: 3.2 3.4 X-VCS-Repository: linux-patches X-VCS-Revision: 2795 X-VCS-Files: genpatches-2.6/trunk/3.2/0000_README genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch genpatches-2.6/trunk/3.4/0000_README genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch X-VCS-Directories: 3.2 3.4 X-VCS-Committer: tomwij X-VCS-Committer-Name: Tom Wijsman Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Message-Id: <20140516200059.4D98F2004C@flycatcher.gentoo.org> Date: Fri, 16 May 2014 20:00:59 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: d4322f79-d033-49b2-8578-d59227af171a X-Archives-Hash: aef1e1c8bc0acb964949f714aa26b1d9 Author: tomwij Date: 2014-05-16 20:00:58 +0000 (Fri, 16 May 2014) New Revision: 2795 Modified: genpatches-2.6/trunk/3.2/0000_README genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch genpatches-2.6/trunk/3.4/0000_README genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch Log: Fixed broken backports by using the CVE-2014-0196 patch from the stable queue for branches 3.2 and 3.4. Modified: genpatches-2.6/trunk/3.2/0000_README =================================================================== --- genpatches-2.6/trunk/3.2/0000_README 2014-05-16 14:06:12 UTC (rev 2794) +++ genpatches-2.6/trunk/3.2/0000_README 2014-05-16 20:00:58 UTC (rev 2795) @@ -273,7 +273,7 @@ Desc: Linux 3.2.58 Patch: 1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch -From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4291086b1f081b869c6d79e5b7441633dc3ace00 +From: https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/commit/?id=19f9438d73833ed532c3ba4955f9c981c9af16f2 Desc: n_tty: Fix n_tty_write crash when echoing in raw mode Patch: 1500_XATTR_USER_PREFIX.patch Modified: genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch =================================================================== --- genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 14:06:12 UTC (rev 2794) +++ genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 20:00:58 UTC (rev 2795) @@ -1,8 +1,9 @@ -From 4291086b1f081b869c6d79e5b7441633dc3ace00 Mon Sep 17 00:00:00 2001 From: Peter Hurley Date: Sat, 3 May 2014 14:04:59 +0200 Subject: n_tty: Fix n_tty_write crash when echoing in raw mode +commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream. + The tty atomic_write_lock does not provide an exclusion guarantee for the tty driver if the termios settings are LECHO & !OPOST. And since it is unexpected and not allowed to call TTY buffer helpers like @@ -55,26 +56,22 @@ Signed-off-by: Jiri Slaby Cc: Linus Torvalds Cc: Alan Cox -Cc: Signed-off-by: Greg Kroah-Hartman +[bwh: Backported to 3.2: output_lock is a member of struct tty_struct] +Signed-off-by: Ben Hutchings +--- + drivers/tty/n_tty.c | 2 ++ + 1 file changed, 2 insertions(+) -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index 41fe8a0..fe9d129 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c -@@ -2353,8 +2353,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file, - if (tty->ops->flush_chars) +@@ -1996,7 +1996,9 @@ static ssize_t n_tty_write(struct tty_st tty->ops->flush_chars(tty); } else { -+ struct n_tty_data *ldata = tty->disc_data; -+ while (nr > 0) { -+ mutex_lock(&ldata->output_lock); ++ mutex_lock(&tty->output_lock); c = tty->ops->write(tty, b, nr); -+ mutex_unlock(&ldata->output_lock); ++ mutex_unlock(&tty->output_lock); if (c < 0) { retval = c; goto break_out; --- -cgit v0.10.1 - Modified: genpatches-2.6/trunk/3.4/0000_README =================================================================== --- genpatches-2.6/trunk/3.4/0000_README 2014-05-16 14:06:12 UTC (rev 2794) +++ genpatches-2.6/trunk/3.4/0000_README 2014-05-16 20:00:58 UTC (rev 2795) @@ -400,7 +400,7 @@ Desc: Linux 3.4.90 Patch: 1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch -From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4291086b1f081b869c6d79e5b7441633dc3ace00 +From: https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/commit/?id=19f9438d73833ed532c3ba4955f9c981c9af16f2 Desc: n_tty: Fix n_tty_write crash when echoing in raw mode Patch: 1500_XATTR_USER_PREFIX.patch Modified: genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch =================================================================== --- genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 14:06:12 UTC (rev 2794) +++ genpatches-2.6/trunk/3.4/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch 2014-05-16 20:00:58 UTC (rev 2795) @@ -1,8 +1,9 @@ -From 4291086b1f081b869c6d79e5b7441633dc3ace00 Mon Sep 17 00:00:00 2001 From: Peter Hurley Date: Sat, 3 May 2014 14:04:59 +0200 Subject: n_tty: Fix n_tty_write crash when echoing in raw mode +commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream. + The tty atomic_write_lock does not provide an exclusion guarantee for the tty driver if the termios settings are LECHO & !OPOST. And since it is unexpected and not allowed to call TTY buffer helpers like @@ -55,26 +56,22 @@ Signed-off-by: Jiri Slaby Cc: Linus Torvalds Cc: Alan Cox -Cc: Signed-off-by: Greg Kroah-Hartman +[bwh: Backported to 3.2: output_lock is a member of struct tty_struct] +Signed-off-by: Ben Hutchings +--- + drivers/tty/n_tty.c | 2 ++ + 1 file changed, 2 insertions(+) -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index 41fe8a0..fe9d129 100644 --- a/drivers/tty/n_tty.c +++ b/drivers/tty/n_tty.c -@@ -2353,8 +2353,12 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file, - if (tty->ops->flush_chars) +@@ -1996,7 +1996,9 @@ static ssize_t n_tty_write(struct tty_st tty->ops->flush_chars(tty); } else { -+ struct n_tty_data *ldata = tty->disc_data; -+ while (nr > 0) { -+ mutex_lock(&ldata->output_lock); ++ mutex_lock(&tty->output_lock); c = tty->ops->write(tty, b, nr); -+ mutex_unlock(&ldata->output_lock); ++ mutex_unlock(&tty->output_lock); if (c < 0) { retval = c; goto break_out; --- -cgit v0.10.1 -