From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 23 Nov 2020 08:15:37 +0000 (+0100)
Subject: 4.14-stable patches
X-Git-Tag: v4.4.246~26
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=dd14503475a8c76342235a89537adb262dbebce2;p=thirdparty%2Fkernel%2Fstable-queue.git

4.14-stable patches

added patches:
	speakup-do-not-let-the-line-discipline-be-used-several-times.patch
---

diff --git a/queue-4.14/series b/queue-4.14/series
index c5a3aaf4dd8..583d11c21e7 100644
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -39,3 +39,4 @@ regulator-ti-abb-fix-array-out-of-bound-read-access-.patch
 xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch
 libfs-fix-error-cast-of-negative-value-in-simple_att.patch
 powerpc-uaccess-flush-fix-missing-includes-in-kup-radix.h.patch
+speakup-do-not-let-the-line-discipline-be-used-several-times.patch
diff --git a/queue-4.14/speakup-do-not-let-the-line-discipline-be-used-several-times.patch b/queue-4.14/speakup-do-not-let-the-line-discipline-be-used-several-times.patch
new file mode 100644
index 00000000000..5e5ac2a11ca
--- /dev/null
+++ b/queue-4.14/speakup-do-not-let-the-line-discipline-be-used-several-times.patch
@@ -0,0 +1,76 @@
+From d4122754442799187d5d537a9c039a49a67e57f1 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Tue, 10 Nov 2020 19:35:41 +0100
+Subject: speakup: Do not let the line discipline be used several times
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit d4122754442799187d5d537a9c039a49a67e57f1 upstream.
+
+Speakup has only one speakup_tty variable to store the tty it is managing. This
+makes sense since its codebase currently assumes that there is only one user who
+controls the screen reading.
+
+That however means that we have to forbid using the line discipline several
+times, otherwise the second closure would try to free a NULL ldisc_data, leading to
+
+general protection fault: 0000 [#1] SMP KASAN PTI
+RIP: 0010:spk_ttyio_ldisc_close+0x2c/0x60
+Call Trace:
+ tty_ldisc_release+0xa2/0x340
+ tty_release_struct+0x17/0xd0
+ tty_release+0x9d9/0xcc0
+ __fput+0x231/0x740
+ task_work_run+0x12c/0x1a0
+ do_exit+0x9b5/0x2230
+ ? release_task+0x1240/0x1240
+ ? __do_page_fault+0x562/0xa30
+ do_group_exit+0xd5/0x2a0
+ __x64_sys_exit_group+0x35/0x40
+ do_syscall_64+0x89/0x2b0
+ ? page_fault+0x8/0x30
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Cc: stable@vger.kernel.org
+Reported-by: 秦世松 <qinshisong1205@gmail.com>
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Tested-by: Shisong Qin <qinshisong1205@gmail.com>
+Link: https://lore.kernel.org/r/20201110183541.fzgnlwhjpgqzjeth@function
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/spk_ttyio.c |    9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/staging/speakup/spk_ttyio.c
++++ b/drivers/staging/speakup/spk_ttyio.c
+@@ -48,10 +48,18 @@ static int spk_ttyio_ldisc_open(struct t
+ 
+ 	if (tty->ops->write == NULL)
+ 		return -EOPNOTSUPP;
++
++	mutex_lock(&speakup_tty_mutex);
++	if (speakup_tty) {
++		mutex_unlock(&speakup_tty_mutex);
++		return -EBUSY;
++	}
+ 	speakup_tty = tty;
+ 
+ 	ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL);
+ 	if (!ldisc_data) {
++		speakup_tty = NULL;
++		mutex_unlock(&speakup_tty_mutex);
+ 		pr_err("speakup: Failed to allocate ldisc_data.\n");
+ 		return -ENOMEM;
+ 	}
+@@ -59,6 +67,7 @@ static int spk_ttyio_ldisc_open(struct t
+ 	sema_init(&ldisc_data->sem, 0);
+ 	ldisc_data->buf_free = true;
+ 	speakup_tty->disc_data = ldisc_data;
++	mutex_unlock(&speakup_tty_mutex);
+ 
+ 	return 0;
+ }