From patchwork Thu Feb 17 18:45:43 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tim Gardner X-Patchwork-Id: 83468 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id ACC25B70D3 for ; Fri, 18 Feb 2011 05:46:01 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Pq8rP-0008C5-1Y; Thu, 17 Feb 2011 18:45:51 +0000 Received: from mail.tpi.com ([70.99.223.143]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Pq8rL-0008C0-RA for kernel-team@lists.ubuntu.com; Thu, 17 Feb 2011 18:45:48 +0000 Received: from sepang.rtg.net (unknown [10.0.2.5]) by mail.tpi.com (Postfix) with ESMTP id 0644C298BB1 for ; Thu, 17 Feb 2011 10:45:21 -0800 (PST) Received: by sepang.rtg.net (Postfix, from userid 1000) id D9AF4F89F8; Thu, 17 Feb 2011 11:45:43 -0700 (MST) To: kernel-team@lists.ubuntu.com Subject: Maverick CVE: tty: Make tiocgicount a handler, CVE-2010-4076 Message-Id: <20110217184543.D9AF4F89F8@sepang.rtg.net> Date: Thu, 17 Feb 2011 11:45:43 -0700 (MST) From: timg@tpi.com (Tim Gardner) X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com The following changes since commit d19552cc47cd3ad6e1b8b5662b31f943be68262d: Tim Gardner (1): UBUNTU: Bump ABI are available in the git repository at: git://kernel.ubuntu.com/rtg/ubuntu-maverick.git CVE-2010-4076 Alan Cox (1): tty: Make tiocgicount a handler, CVE-2010-4076 drivers/char/tty_io.c | 21 +++++++++++++++++++++ drivers/serial/serial_core.c | 37 +++++++++++++++++-------------------- drivers/usb/serial/usb-serial.c | 13 +++++++++++++ include/linux/tty_driver.h | 9 +++++++++ include/linux/usb/serial.h | 2 ++ 5 files changed, 62 insertions(+), 20 deletions(-) From fa3da07bd08bd979c6b8d98c93acaefcbfeb7d90 Mon Sep 17 00:00:00 2001 From: Alan Cox Date: Thu, 16 Sep 2010 18:21:24 +0100 Subject: [PATCH] tty: Make tiocgicount a handler, CVE-2010-4076 BugLink: http://bugs.launchpad.net/bugs/720189 CVE-2010-4076 Dan Rosenberg noted that various drivers return the struct with uncleared fields. Instead of spending forever trying to stomp all the drivers that get it wrong (and every new driver) do the job in one place. This first patch adds the needed operations and hooks them up, including the needed USB midlayer and serial core plumbing. Signed-off-by: Alan Cox Signed-off-by: Greg Kroah-Hartman (cherry picked from commit d281da7ff6f70efca0553c288bb883e8605b3862) Signed-off-by: Tim Gardner Acked-by: Stefan Bader Acked-by: Brad Figg --- drivers/char/tty_io.c | 21 +++++++++++++++++++++ drivers/serial/serial_core.c | 37 +++++++++++++++++-------------------- drivers/usb/serial/usb-serial.c | 13 +++++++++++++ include/linux/tty_driver.h | 9 +++++++++ include/linux/usb/serial.h | 2 ++ 5 files changed, 62 insertions(+), 20 deletions(-)