From mboxrd@z Thu Jan 1 00:00:00 1970 From: Greg Kroah-Hartman Subject: Re: [PATCH stable v2 1/2] termios, tty/tty_baudrate.c: fix buffer overrun Date: Tue, 23 Oct 2018 15:53:51 +0100 Message-ID: <20181023145351.GA28516@kroah.com> References: <20181022161905.26589-1-hpa@zytor.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20181022161905.26589-1-hpa@zytor.com> Sender: stable-owner@vger.kernel.org To: "H. Peter Anvin (Intel)" Cc: linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, Jiri Slaby , Al Viro , Richard Henderson , Ivan Kokshaysky , Matt Turner , Thomas Gleixner , Kate Stewart , Philippe Ombredanne , Eugene Syromiatnikov , linux-alpha@vger.kernel.org, Alan Cox , stable@vger.kernel.org List-Id: linux-serial@vger.kernel.org On Mon, Oct 22, 2018 at 09:19:04AM -0700, H. Peter Anvin (Intel) wrote: > From: "H. Peter Anvin" > > On architectures with CBAUDEX == 0 (Alpha and PowerPC), the code in tty_baudrate.c does > not do any limit checking on the tty_baudrate[] array, and in fact a > buffer overrun is possible on both architectures. Add a limit check to > prevent that situation. > > This will be followed by a much bigger cleanup/simplification patch. > > Signed-off-by: H. Peter Anvin (Intel) > Requested-by: Cc: Johan Hovold > Cc: Greg Kroah-Hartman > Cc: Jiri Slaby > Cc: Al Viro > Cc: Richard Henderson > Cc: Ivan Kokshaysky > Cc: Matt Turner > Cc: Thomas Gleixner > Cc: Kate Stewart > Cc: Philippe Ombredanne > Cc: Greg Kroah-Hartman > Cc: Eugene Syromiatnikov > Cc: > Cc: > Cc: Alan Cox > Cc: > --- > drivers/tty/tty_baudrate.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) As I think Al's big termios cleanups are going to be hitting Linus's tree soon, do you know how these patches interact with that? This patch seems like it will not, so I'll be glad to queue that up after my first round of patches get merged to Linus later this week, but the second one worries me. thanks, greg k-h