Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5f0878ac authored by Alan Cox's avatar Alan Cox Committed by Linus Torvalds
Browse files

tty: Fix oops when scanning the polling list for kgdb 



Costantino Leandro found a bug in tty_find_polling_driver and provided a
patch that fixed the crash but not the underlying bug. This fixes the
underlying bug where the list walk corrupts the values it is using on a
match but then reuses them if the open fails.

Signed-off-by: default avatarAlan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 620df3c0

drivers/char/tty_io.c

+7 −6
Original line number Diff line number Diff line
@@ -295,7 +295,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line) 
	struct tty_driver *p, *res = NULL;

	int tty_line = 0;

	int len;

	char *str;

	char *str, *stp;



	for (str = name; *str; str++)

		if ((*str >= '0' && *str <= '9') || *str == ',')
@@ -311,13 +311,14 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line) 
	list_for_each_entry(p, &tty_drivers, tty_drivers) {

		if (strncmp(name, p->name, len) != 0)

			continue;

		if (*str == ',')

			str++;

		if (*str == '\0')

			str = NULL;

		stp = str;

		if (*stp == ',')

			stp++;

		if (*stp == '\0')

			stp = NULL;



		if (tty_line >= 0 && tty_line <= p->num && p->ops &&

		    p->ops->poll_init && !p->ops->poll_init(p, tty_line, str)) {

		    p->ops->poll_init && !p->ops->poll_init(p, tty_line, stp)) {

			res = tty_driver_kref_get(p);

			*line = tty_line;

			break;