Re: [PATCH 090/173] USB: serial/kobil_sct, fix potential tty NULLdereference

[Alan Cox]

> >> Ok, but this doesn't fix the bug (the URB should be killed or something
> >> similar in that kernel), it only makes the window smaller.
> >
> > OK I get it now, it requires patch 4a90f09b which is quite not some
> > suitable material for -longterm.
> 
> Yeah and perhaps some other changes (like adding hangup support).
> 
> > Do you think it's better to completely remove this patch than making
> > one think the risk of bug is gone while it is not ? Unless we find
> > something more reliable, I'd rather drop the patch.
> 
> To be honest I don't know what's better :). Maybe I would incline to the 
> drop-it side, but leaving up to you.

I'm not sure why a .27 is still maintained to be honest but the reality
is that the lack of tty refcounting on hangup in old kernels is
exploitable in many cases via vhangup() and other approaches combined
with lack of NULL page protection. In several places NULL tty means
NULL->method() is invoked which on an old kernel where a user process has
mapped user virtual address zero means you just got owned.

This is all well known stuff. SELinux will mitigate fairly effectively on
some vendors systems.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/