Peter Hurley 5c17c861a3 tty: Fix unsafe ldisc reference via ioctl(TIOCGETD) ... ioctl(TIOCGETD) retrieves the line discipline id directly from the ldisc because the line discipline id (c_line) in termios is untrustworthy; userspace may have set termios via ioctl(TCSETS*) without actually changing the line discipline via ioctl(TIOCSETD). However, directly accessing the current ldisc via tty->ldisc is unsafe; the ldisc ptr dereferenced may be stale if the line discipline is changing via ioctl(TIOCSETD) or hangup. Wait for the line discipline reference (just like read() or write()) to retrieve the "current" line discipline id. Cc: <stable@vger.kernel.org> Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2016-01-26 23:17:54 -08:00
..
hvc	TTY/Serial driver patches for 4.4-rc1	2015-11-04 21:35:12 -08:00
ipwireless	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2015-04-14 09:50:27 -07:00
serial	ARM: SoC driver updates for v4.5	2016-01-20 18:42:30 -08:00
vt	vt: Deinline save_screen, save 238 bytes	2015-12-13 19:59:48 -08:00
amiserial.c	tty: Remove unused SERIAL_DO_RESTART define	2015-12-13 19:59:48 -08:00
bfin_jtag_comm.c	TTY: bfin_jtag_comm: remove incorrect wait_until_sent operation	2015-03-07 03:44:14 +01:00
cyclades.c	cyclades: Deinline cyz_is_loaded, save 240 bytes	2015-12-13 19:59:48 -08:00
ehv_bytechan.c	tty: remove unused variable sprop	2015-02-03 15:52:13 -08:00
goldfish.c	staging: goldfish: Fix pointer cast for 32 bits	2015-05-31 11:40:14 +09:00
isicom.c	isicom: Deinline drop_dtr, save 112 bytes	2015-12-13 19:59:48 -08:00
Kconfig	ttyFDC: Implement KGDB IO operations.	2015-03-31 12:04:13 +02:00
Makefile	TTY: Add MIPS EJTAG Fast Debug Channel TTY driver	2015-03-31 12:04:12 +02:00
metag_da.c	tty/metag_da: Avoid module_init/module_exit in non-modular code	2015-06-16 14:12:31 -04:00
mips_ejtag_fdc.c	ttyFDC: Fix build problems due to use of module_{init,exit}	2015-10-17 21:29:21 -07:00
moxa.c	tty: Remove unused SERIAL_DO_RESTART define	2015-12-13 19:59:48 -08:00
moxa.h
mxser.c
mxser.h
n_gsm.c	tty: Convert use of __constant_htons to htons	2015-07-23 15:10:25 -07:00
n_hdlc.c	pty: Fix input race when closing	2015-05-10 19:26:37 +02:00
n_r3964.c	tty: r3964: Replace/remove bogus tty lock use	2015-10-17 21:11:29 -07:00
n_tracerouter.c	n_tracerouter: stop including <asm-generic/bug>	2015-10-15 00:21:10 +02:00
n_tracesink.c	n_tracesink: stop including <asm-generic/bug>	2015-10-15 00:21:11 +02:00
n_tracesink.h
n_tty.c	Merge 4.4-rc6 into tty-next	2015-12-21 11:06:07 -08:00
nozomi.c	drivers/tty/nozomi.c: rename CONFIG_MAGIC	2015-05-10 19:19:06 +02:00
pty.c	tty: Remove __func__ from tty_debug() macro	2015-12-13 19:59:48 -08:00
rocket_int.h
rocket.c	tty: Remove tty_port::close_wait	2015-10-17 21:11:29 -07:00
rocket.h	tty: rocket: fix comment of ROCKET_SPD_HI	2015-05-24 12:49:16 -07:00
synclink_gt.c	tty: synclink_gt: Rename tty_driver_name	2015-12-13 19:59:48 -08:00
synclink.c	tty: synclink, fix indentation	2015-10-17 21:14:06 -07:00
synclinkmp.c	tty: Remove ASYNC_CLOSING checks in open()/hangup() methods	2015-10-17 21:11:29 -07:00
sysrq.c	sysrq: Fix warning in sysrq generated crash.	2015-12-29 16:29:18 -08:00
tty_audit.c	tty: audit: Fix audit source	2015-11-20 16:19:54 -08:00
tty_buffer.c	tty: Fix GPF in flush_to_ldisc()	2015-12-12 23:05:28 -08:00
tty_io.c	tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)	2016-01-26 23:17:54 -08:00
tty_ioctl.c	tty: Remove __func__ from tty_debug() macro	2015-12-13 19:59:48 -08:00
tty_ldisc.c	tty: Prevent ldisc drivers from re-using stale tty fields	2015-12-13 19:59:48 -08:00
tty_ldsem.c	tty: Deinline __ldsem_down_write_nested, save 128 bytes	2015-12-13 19:59:48 -08:00
tty_mutex.c	tty: Wait interruptibly for tty lock on reopen	2016-01-26 23:17:54 -08:00
tty_port.c	tty: Define tty_*() printk macros	2015-12-13 19:59:48 -08:00