Re: [BUG] tiocsti() NULL dereference if ld->ops->receive_buf==NULL

2019-01-21 Thread Greg Kroah-Hartman
On Mon, Jan 21, 2019 at 04:38:33PM +0100, Jann Horn wrote: > On Sun, Jan 20, 2019 at 10:52 AM Greg Kroah-Hartman > wrote: > > > > On Sat, Jan 19, 2019 at 10:11:08AM +0100, Greg Kroah-Hartman wrote: > > > On Fri, Jan 18, 2019 at 08:09:07PM +0100, Jann Horn wrote: > > > > Hi! > > > > > > > > When a

Re: [BUG] tiocsti() NULL dereference if ld->ops->receive_buf==NULL

2019-01-21 Thread Jann Horn
On Sun, Jan 20, 2019 at 10:52 AM Greg Kroah-Hartman wrote: > > On Sat, Jan 19, 2019 at 10:11:08AM +0100, Greg Kroah-Hartman wrote: > > On Fri, Jan 18, 2019 at 08:09:07PM +0100, Jann Horn wrote: > > > Hi! > > > > > > When a line discipline doesn't have a ->receive_buf handler, tiocsti() > > >

Re: [BUG] tiocsti() NULL dereference if ld->ops->receive_buf==NULL

2019-01-20 Thread Greg Kroah-Hartman
On Sat, Jan 19, 2019 at 10:11:08AM +0100, Greg Kroah-Hartman wrote: > On Fri, Jan 18, 2019 at 08:09:07PM +0100, Jann Horn wrote: > > Hi! > > > > When a line discipline doesn't have a ->receive_buf handler, tiocsti() > > attempts to call a NULL pointer. Both tty_n_tracesink and > >

Re: [BUG] tiocsti() NULL dereference if ld->ops->receive_buf==NULL

2019-01-19 Thread Greg Kroah-Hartman
On Fri, Jan 18, 2019 at 08:09:07PM +0100, Jann Horn wrote: > Hi! > > When a line discipline doesn't have a ->receive_buf handler, tiocsti() > attempts to call a NULL pointer. Both tty_n_tracesink and > spk_ttyio_ldisc_ops don't have such a handler. > > To reproduce, build a kernel with

[BUG] tiocsti() NULL dereference if ld->ops->receive_buf==NULL

2019-01-18 Thread Jann Horn
Hi! When a line discipline doesn't have a ->receive_buf handler, tiocsti() attempts to call a NULL pointer. Both tty_n_tracesink and spk_ttyio_ldisc_ops don't have such a handler. To reproduce, build a kernel with CONFIG_SPEAKUP=y and CONFIG_SPEAKUP_SYNTH_SOFT=y, set speakup.synth=soft in the