[PATCH 1/1] Char: moxa, prevent opening unavailable ports

[PATCH 1/1] Char: moxa, prevent opening unavailable ports

[Jiri Slaby]

From: Dirk Eibach <eibach@gdsys.de>

In moxa.c there are 32 minor numbers reserved for each device. The
number of ports actually available per device is stored in
moxa_board_conf->numPorts. This number is not considered in moxa_open().
Opening a port that is not available results in a kernel oops.
This patch adds a test to moxa_open() that prevents opening unavailable
ports.

Signed-off-by: Dirk Eibach <eibach@gdsys.de>
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
---
 drivers/char/moxa.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index 4a4cab7..65b6ff2 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -1184,6 +1184,11 @@ static int moxa_open(struct tty_struct *tty, struct file *filp)
 		return -ENODEV;
 	}
 
+	if (port % MAX_PORTS_PER_BOARD >= brd->numPorts) {
+		mutex_unlock(&moxa_openlock);
+		return -ENODEV;
+	}
+
 	ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
 	ch->port.count++;
 	tty->driver_data = ch;
-- 
1.6.3.2

Re: [PATCH 1/1] Char: moxa, prevent opening unavailable ports

[Andrew Morton]

On Tue,  9 Jun 2009 16:33:01 +0200
Jiri Slaby <jirislaby@gmail.com> wrote:

> From: Dirk Eibach <eibach@gdsys.de>
> 
> In moxa.c there are 32 minor numbers reserved for each device. The
> number of ports actually available per device is stored in
> moxa_board_conf->numPorts. This number is not considered in moxa_open().
> Opening a port that is not available results in a kernel oops.
> This patch adds a test to moxa_open() that prevents opening unavailable
> ports.
> 
> Signed-off-by: Dirk Eibach <eibach@gdsys.de>
> Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
> ---
>  drivers/char/moxa.c |    5 +++++
>  1 files changed, 5 insertions(+), 0 deletions(-)
> 
> diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
> index 4a4cab7..65b6ff2 100644
> --- a/drivers/char/moxa.c
> +++ b/drivers/char/moxa.c
> @@ -1184,6 +1184,11 @@ static int moxa_open(struct tty_struct *tty, struct file *filp)
>  		return -ENODEV;
>  	}
>  
> +	if (port % MAX_PORTS_PER_BOARD >= brd->numPorts) {
> +		mutex_unlock(&moxa_openlock);
> +		return -ENODEV;
> +	}
> +
>  	ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
>  	ch->port.count++;
>  	tty->driver_data = ch;

Looks good to me.  But please, let's avoid adding the
multiple-return-statement hand grenade?

--- a/drivers/char/moxa.c~char-moxa-prevent-opening-unavailable-ports
+++ a/drivers/char/moxa.c
@@ -1184,6 +1184,11 @@ static int moxa_open(struct tty_struct *
 		return -ENODEV;
 	}
 
+	if (port % MAX_PORTS_PER_BOARD >= brd->numPorts) {
+		retval = -ENODEV;
+		goto out_unlock;
+	}
+
 	ch = &brd->ports[port % MAX_PORTS_PER_BOARD];
 	ch->port.count++;
 	tty->driver_data = ch;
@@ -1208,8 +1213,8 @@ static int moxa_open(struct tty_struct *
 				moxa_close_port(tty);
 	} else
 		ch->port.flags |= ASYNC_NORMAL_ACTIVE;
+out_unlock:
 	mutex_unlock(&moxa_openlock);
-
 	return retval;
 }
 
_



btw, what's this code in moxa_open() doing?

	if (port == MAX_PORTS) {
		return capable(CAP_SYS_ADMIN) ? 0 : -EPERM;
	}

why does it return 0 if CAP_SYS_ADMIN?				

Re: [PATCH 1/1] Char: moxa, prevent opening unavailable ports

[Jiri Slaby]

On 06/09/2009 09:27 PM, Andrew Morton wrote:
> btw, what's this code in moxa_open() doing?
> 
> 	if (port == MAX_PORTS) {
> 		return capable(CAP_SYS_ADMIN) ? 0 : -EPERM;
> 	}
> 
> why does it return 0 if CAP_SYS_ADMIN?				

There is some global stats ioctl crap on that port number available only
to users with permissions. Look at moxa_ioctl, there is:

        if (tty->index == MAX_PORTS) {
                if (cmd != MOXA_GETDATACOUNT && cmd != MOXA_GET_IOQUEUE &&
                                cmd != MOXA_GETMSTATUS)
                        return -EINVAL;

Of course, there is also alloc_tty_driver(MAX_PORTS + 1).

Re: [PATCH 1/1] Char: moxa, prevent opening unavailable ports

[Alan Cox]

> btw, what's this code in moxa_open() doing?
> 
> 	if (port == MAX_PORTS) {
> 		return capable(CAP_SYS_ADMIN) ? 0 : -EPERM;
> 	}
> 
> why does it return 0 if CAP_SYS_ADMIN?				

0-MAX_PORTS-1  = tty devices
MAX_PORTS = magic secret control channel

Alan