mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-20 17:41:09 +00:00
tty: protect tty_write from odd low-level tty disciplines
commit3342ff2698
upstream. Al root-caused a new warning from syzbot to the ttyprintk tty driver returning a write count larger than the data the tty layer actually gave it. Which confused the tty write code mightily, and with the new iov_iter based code, caused a WARNING in iov_iter_revert(). syzbot correctly bisected the source of the new warning to commit9bb48c82ac
("tty: implement write_iter"), but the oddity goes back much further, it just didn't get caught by anything before. Reported-by: syzbot+3d2c27c2b7dc2a94814d@syzkaller.appspotmail.com Fixes:9bb48c82ac
("tty: implement write_iter") Debugged-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
00805af45a
commit
ffec7ee218
1 changed files with 4 additions and 1 deletions
|
@ -963,11 +963,14 @@ static inline ssize_t do_tty_write(
|
|||
if (ret <= 0)
|
||||
break;
|
||||
|
||||
written += ret;
|
||||
if (ret > size)
|
||||
break;
|
||||
|
||||
/* FIXME! Have Al check this! */
|
||||
if (ret != size)
|
||||
iov_iter_revert(from, size-ret);
|
||||
|
||||
written += ret;
|
||||
count -= ret;
|
||||
if (!count)
|
||||
break;
|
||||
|
|
Loading…
Reference in a new issue