On 01/10/2016 03:16 PM, Ben Hutchings wrote:
> On Sat, 2016-01-09 at 20:41 -0800, Peter Hurley wrote:
>> As the function documentation for tty_ldisc_ref_wait() notes, it is
>> only callable from a tty file_operations routine; otherwise there
>> is no guarantee the ref won't be NULL.
>>
>> The key difference with the VT's paste_selection() is that is an ioctl,
>> where __speakup_paste_selection() is completely asynch kworker, kicked
>> off from interrupt context.
>>
>> Fixes: 28a821c30688 ("Staging: speakup: Update __speakup_paste_selection()
>> tty (ab)usage to match vt")
>> Cc: <stable@xxxxxxxxxxxxxxx>
>>
>> Signed-off-by: Peter Hurley <peter@xxxxxxxxxxxxxxxxxx>
>> ---
>> drivers/staging/speakup/selection.c | 4 +++-
>> 1 file changed, 3 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c
>> index aa5ab6c..86c0b9a 100644
>> --- a/drivers/staging/speakup/selection.c
>> +++ b/drivers/staging/speakup/selection.c
>> @@ -142,7 +142,9 @@ static void __speakup_paste_selection(struct work_struct *work)
>> struct tty_ldisc *ld;
>> DECLARE_WAITQUEUE(wait, current);
>>
>> - ld = tty_ldisc_ref_wait(tty);
>> + ld = tty_ldisc_ref(tty);
>> + if (!ld)
>> + return;
>> tty_buffer_lock_exclusive(&vc->port);
>>
>> add_wait_queue(&vc->paste_wait, &wait);
>
> This leaks a reference to the tty. Instead of returning directly, I
> think you need to add a label and goto the tty_kref_put() at the bottom
> of the function.
Ugh, speakup_paste_selection() is a worse hack than I thought it was.
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html