From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755833AbbILXRw (ORCPT ); Sat, 12 Sep 2015 19:17:52 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:9320 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932075AbbILXMu (ORCPT ); Sat, 12 Sep 2015 19:12:50 -0400 Message-Id: <20150912225606.736779836@1wt.eu> User-Agent: quilt/0.63-1 Date: Sun, 13 Sep 2015 00:56:10 +0200 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jiri Slaby , Alan Cox , Sukadev Bhattiprolu , Greg Kroah-Hartman , Ben Hutchings , Willy Tarreau Subject: [PATCH 2.6.32 04/62] TTY: drop driver reference in tty_open fail path MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <08d3b586eb2e764308c3de9ee398a17c@local> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ From: Jiri Slaby commit c290f8358acaeffd8e0c551ddcc24d1206143376 upstream. When tty_driver_lookup_tty fails in tty_open, we forget to drop a reference to the tty driver. This was added by commit 4a2b5fddd5 (Move tty lookup/reopen to caller). Fix that by adding tty_driver_kref_put to the fail path. I will refactor the code later. This is for the ease of backporting to stable. Introduced-in: v2.6.28-rc2 Signed-off-by: Jiri Slaby Cc: Alan Cox Acked-by: Sukadev Bhattiprolu Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 2.6.32: adjust filename] Signed-off-by: Ben Hutchings CVE-2011-5321 Signed-off-by: Willy Tarreau --- drivers/char/tty_io.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c index cbdd1698..6c71534 100644 --- a/drivers/char/tty_io.c +++ b/drivers/char/tty_io.c @@ -1779,6 +1779,7 @@ got_driver: if (IS_ERR(tty)) { mutex_unlock(&tty_mutex); + tty_driver_kref_put(driver); return PTR_ERR(tty); } } -- 1.7.12.2.21.g234cd45.dirty