Your message dated Sun, 15 Sep 2013 20:48:42 +0100 with message-id <1379274522.19779.70.camel@deadeye.wl.decadent.org.uk> and subject line Re: linux-image-3.2.0-4-686-pae: tty buffer flush NULL pointer dereference has caused the Debian Bug report #694720, regarding linux-image-3.2.0-4-686-pae: tty buffer flush NULL pointer dereference to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 694720: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694720 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
--- Begin Message ---
- To: Debian Bug Tracking System <submit@bugs.debian.org>
- Subject: linux-image-3.2.0-4-686-pae: tty buffer flush NULL pointer dereference
- From: Ilya Zykov <ilya@ilyx.ru>
- Date: Thu, 29 Nov 2012 17:36:20 +0400
- Message-id: <20121129133620.4027.29315.reportbug@deb7.ilyx.ru>
Package: src:linux Version: 3.2.32-1 Severity: normal Tags: upstream Dear Maintainer, The root of problem is carelessly use buffer flushing, then another thread can write to it. Main kernel accept the other patch for resolve this and relative problem: https://lkml.org/lkml/2012/3/14/552 My patch resolve this problem better and clear. IMHO: https://lkml.org/lkml/2012/11/27/599 -------------------------------------------------------- diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c index 6c9b7cd..4f02f9c 100644 --- a/drivers/tty/tty_buffer.c +++ b/drivers/tty/tty_buffer.c @@ -114,11 +114,14 @@ static void __tty_buffer_flush(struct tty_struct *tty) { struct tty_buffer *thead; - while ((thead = tty->buf.head) != NULL) { - tty->buf.head = thead->next; - tty_buffer_free(tty, thead); + if (tty->buf.head == NULL) + return; + while ((thead = tty->buf.head->next) != NULL) { + tty_buffer_free(tty, tty->buf.head); + tty->buf.head = thead; } - tty->buf.tail = NULL; + WARN_ON(tty->buf.head != tty->buf.tail); + tty->buf.head->read = tty->buf.head->commit; } /** ---------------------------------------------------------------- For reproduce you can use attachement program. Need SMP. --------------------------------------------- !!!! Not execute on important systems !!!! --------------------------------------------- BUG: unable to handle kernel NULL pointer dereference at 00000004 [ 1910.660041] IP: [<c11d2b44>] tty_insert_flip_string_fixed_flag+0x46/0x7c [ 1910.660067] *pdpt = 000000002bf9f001 *pde = 0000000000000000 [ 1910.660070] Oops: 0000 [#1] SMP [ 1910.660076] Modules linked in: isofs udf crc_itu_t bnep rfcomm bluetooth rfkill binfmt_misc nfsd nfs nfs_acl auth_rpcgss fscache lockd sunrpc loop i2c_piix4 psmouse serio_raw evdev virtio_balloon i2c_core pcspkr processor thermal_sys button ext4 crc16 jbd2 mbcache sg sr_mod cdrom virtio_blk virtio_net floppy ata_generic ata_piix libata scsi_mod virtio_pci virtio_ring virtio uhci_hcd ehci_hcd usbcore usb_common [last unloaded: scsi_wait_scan] [ 1910.660102] [ 1910.660104] Pid: 9116, comm: a.out Not tainted 3.2.0-4-686-pae #1 Debian 3.2.32-1 Red Hat KVM [ 1910.660108] EIP: 0060:[<c11d2b44>] EFLAGS: 00010206 CPU: 0 [ 1910.660110] EIP is at tty_insert_flip_string_fixed_flag+0x46/0x7c [ 1910.660112] EAX: f747cc00 EBX: 00000000 ECX: f747cccc EDX: 00000296 [ 1910.660114] ESI: f72be000 EDI: 0000045f EBP: 0000045f ESP: ebe99ed4 [ 1910.660116] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 1910.660118] Process a.out (pid: 9116, ti=ebe98000 task=f7404940 task.ti=ebe98000) [ 1910.660119] Stack: [ 1910.660120] 00000000 f747cc00 0047cc00 ebf31000 f747cc00 0000045f 0000045f c11d3696 [ 1910.660126] 0000045f c12ef76c ebf31000 f72be000 c11cf4fa c14002f0 f7404940 ebf49240 [ 1910.660130] f72be000 ebf3139c ebf310e4 00000000 f7404940 c1031f01 ebf310e8 ebf310e8 [ 1910.660135] Call Trace: [ 1910.660138] [<c11d3696>] ? pty_write+0x24/0x43 [ 1910.660144] [<c11cf4fa>] ? n_tty_write+0x23e/0x2c5 [ 1910.660158] [<c1031f01>] ? try_to_wake_up+0x155/0x155 [ 1910.660161] [<c11cceb6>] ? tty_write+0x161/0x1d3 [ 1910.660163] [<c11cf2bc>] ? process_echoes+0x23b/0x23b [ 1910.660166] [<c11ccd55>] ? tty_write_lock+0x39/0x39 [ 1910.660178] [<c10cc493>] ? vfs_write+0x83/0xd4 [ 1910.660181] [<c10cc653>] ? sys_write+0x3d/0x61 [ 1910.660190] [<c12c16ac>] ? syscall_call+0x7/0xb [ 1910.660195] [<c12c0000>] ? __schedule+0x4b/0x55b [ 1910.660197] Code: 20 b8 00 07 00 00 2b 14 24 81 fa 00 07 00 00 0f 47 d0 8b 44 24 04 e8 d1 fd ff ff 89 c5 8b 44 24 04 85 ed 8b 98 d4 00 00 00 74 2b <8b> 43 04 89 e9 03 43 0c 89 c7 f3 a4 89 e9 8b 53 08 03 53 0c 8a [ 1910.660222] EIP: [<c11d2b44>] tty_insert_flip_string_fixed_flag+0x46/0x7c SS:ESP 0068:ebe99ed4 [ 1910.660226] CR2: 0000000000000004 crash> bt PID: 9116 TASK: f7404940 CPU: 0 COMMAND: "a.out" #0 [ebe99d88] crash_kexec at c106924b #1 [ebe99dd8] oops_end at c12c285a #2 [ebe99de8] no_context at c12bc67f #3 [ebe99e10] bad_area at c12bc7d4 #4 [ebe99e24] do_page_fault at c12c42b6 #5 [ebe99e94] error_code (via page_fault) at c12c229d EAX: f747cc00 EBX: 00000000 ECX: f747cccc EDX: 00000296 EBP: 0000045f DS: 007b ESI: f72be000 ES: 007b EDI: 0000045f GS: 00e0 CS: 0060 EIP: c11d2b44 ERR: ffffffff EFLAGS: 00010206 #6 [ebe99ec8] tty_insert_flip_string_fixed_flag at c11d2b44 #7 [ebe99ef0] pty_write at c11d3691 #8 [ebe99f04] n_tty_write at c11cf4f7 #9 [ebe99f48] tty_write at c11cceb2 #10 [ebe99f7c] vfs_write at c10cc491 #11 [ebe99f94] sys_write at c10cc64e #12 [ebe99fb0] system_call at c12c16a5 EAX: 00000004 EBX: 00000003 ECX: bfdcbfd1 EDX: 0000045f DS: 007b ESI: 00000000 ES: 007b EDI: bfdcc430 SS: 007b ESP: bfdcbfb4 EBP: bfdcc448 GS: 0033 CS: 0073 EIP: b7780416 ERR: 00000004 EFLAGS: 00000246 -- Package-specific info: ** Version: Linux version 3.2.0-4-686-pae (debian-kernel@lists.debian.org) (gcc version 4.6.3 (Debian 4.6.3-12) ) #1 SMP Debian 3.2.32-1 ** Command line: BOOT_IMAGE=/boot/vmlinuz-3.2.0-4-686-pae root=UUID=b11ca6dc-2cbd-401f-b8a4-40123733d71b ro quiet ** Not tainted ** Kernel log: [ 0.732526] Mobile IPv6 [ 0.732529] NET: Registered protocol family 17 [ 0.732532] Registering the dns_resolver key type [ 0.732559] Using IPI No-Shortcut mode [ 0.732633] PM: Hibernation image not present or could not be loaded. [ 0.732642] registered taskstats version 1 [ 0.732967] rtc_cmos 00:01: setting system clock to 2012-11-29 12:43:19 UTC (1354192999) [ 0.732994] Initializing network drop monitor service [ 0.733175] Freeing unused kernel memory: 416k freed [ 0.733619] Write protecting the kernel text: 2844k [ 0.733678] Write protecting the kernel read-only data: 1092k [ 0.733680] NX-protecting the kernel data: 3300k [ 0.811787] udevd[49]: starting version 175 [ 0.911718] usbcore: registered new interface driver usbfs [ 0.911742] usbcore: registered new interface driver hub [ 0.917490] ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 10 [ 0.917577] virtio-pci 0000:00:03.0: setting latency timer to 64 [ 0.917762] virtio-pci 0000:00:04.0: setting latency timer to 64 [ 0.918008] virtio-pci 0000:00:08.0: setting latency timer to 64 [ 0.928672] usbcore: registered new device driver usb [ 0.929994] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 0.930919] uhci_hcd: USB Universal Host Controller Interface driver [ 0.931048] uhci_hcd 0000:00:01.2: setting latency timer to 64 [ 0.931060] uhci_hcd 0000:00:01.2: UHCI Host Controller [ 0.931082] uhci_hcd 0000:00:01.2: new USB bus registered, assigned bus number 1 [ 0.931198] uhci_hcd 0000:00:01.2: irq 11, io base 0x0000c020 [ 0.931302] usb usb1: New USB device found, idVendor=1d6b, idProduct=0001 [ 0.931307] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 0.931309] usb usb1: Product: UHCI Host Controller [ 0.931310] usb usb1: Manufacturer: Linux 3.2.0-4-686-pae uhci_hcd [ 0.931315] usb usb1: SerialNumber: 0000:00:01.2 [ 0.940276] hub 1-0:1.0: USB hub found [ 0.940281] hub 1-0:1.0: 2 ports detected [ 0.948230] SCSI subsystem initialized [ 0.964816] libata version 3.00 loaded. [ 0.966521] ata_piix 0000:00:01.1: version 2.13 [ 0.966640] ata_piix 0000:00:01.1: setting latency timer to 64 [ 0.971696] scsi0 : ata_piix [ 0.978525] scsi1 : ata_piix [ 0.978593] ata1: PATA max MWDMA2 cmd 0x1f0 ctl 0x3f6 bmdma 0xc000 irq 14 [ 0.978596] ata2: PATA max MWDMA2 cmd 0x170 ctl 0x376 bmdma 0xc008 irq 15 [ 1.136512] FDC 0 is a S82078B [ 1.144393] ata2.01: NODEV after polling detection [ 1.144618] ata2.00: ATAPI: QEMU DVD-ROM, 0.12.1, max UDMA/100 [ 1.145021] ata2.00: configured for MWDMA2 [ 1.145518] scsi 1:0:0:0: CD-ROM QEMU QEMU DVD-ROM 0.12 PQ: 0 ANSI: 5 [ 1.162045] virtio-pci 0000:00:04.0: irq 40 for MSI/MSI-X [ 1.162069] virtio-pci 0000:00:04.0: irq 41 for MSI/MSI-X [ 1.174742] virtio-pci 0000:00:03.0: irq 42 for MSI/MSI-X [ 1.174764] virtio-pci 0000:00:03.0: irq 43 for MSI/MSI-X [ 1.174785] virtio-pci 0000:00:03.0: irq 44 for MSI/MSI-X [ 1.191285] sr0: scsi3-mmc drive: 4x/4x xa/form2 tray [ 1.191288] cdrom: Uniform CD-ROM driver Revision: 3.20 [ 1.198559] sr 1:0:0:0: Attached scsi CD-ROM sr0 [ 1.198668] vda: vda1 vda2 < vda5 > [ 1.210219] sr 1:0:0:0: Attached scsi generic sg0 type 5 [ 1.352070] Refined TSC clocksource calibration: 2826.254 MHz. [ 1.510246] PM: Starting manual resume from disk [ 1.510250] PM: Hibernation image partition 254:5 present [ 1.510252] PM: Looking for hibernation image. [ 1.511656] PM: Image not found (code -22) [ 1.511659] PM: Hibernation image not present or could not be loaded. [ 1.542808] EXT4-fs (vda1): INFO: recovery required on readonly filesystem [ 1.542812] EXT4-fs (vda1): write access will be enabled during recovery [ 1.732365] EXT4-fs (vda1): orphan cleanup on readonly fs [ 1.732372] EXT4-fs (vda1): ext4_orphan_cleanup: deleting unreferenced inode 31645 [ 1.732423] EXT4-fs (vda1): ext4_orphan_cleanup: deleting unreferenced inode 131182 [ 1.732436] EXT4-fs (vda1): 2 orphan inodes deleted [ 1.732437] EXT4-fs (vda1): recovery complete [ 1.951019] EXT4-fs (vda1): mounted filesystem with ordered data mode. Opts: (null) [ 3.606746] udevd[309]: starting version 175 [ 4.020821] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input1 [ 4.020826] ACPI: Power Button [PWRF] [ 4.081303] piix4_smbus 0000:00:01.3: SMBus Host Controller at 0xb100, revision 0 [ 4.352093] input: PC Speaker as /devices/platform/pcspkr/input/input2 [ 4.865672] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input3 [ 6.054549] Adding 477180k swap on /dev/vda5. Priority:-1 extents:1 across:477180k [ 6.160335] EXT4-fs (vda1): re-mounted. Opts: (null) [ 6.478815] EXT4-fs (vda1): re-mounted. Opts: errors=remount-ro [ 6.742252] loop: module loaded [ 11.083731] RPC: Registered named UNIX socket transport module. [ 11.083734] RPC: Registered udp transport module. [ 11.083736] RPC: Registered tcp transport module. [ 11.083739] RPC: Registered tcp NFSv4.1 backchannel transport module. [ 11.120655] FS-Cache: Loaded [ 11.153624] FS-Cache: Netfs 'nfs' registered for caching [ 11.180268] Installing knfsd (copyright (C) 1996 okir@monad.swb.de). [ 16.045666] Bluetooth: Core ver 2.16 [ 16.045698] NET: Registered protocol family 31 [ 16.045700] Bluetooth: HCI device and connection manager initialized [ 16.045702] Bluetooth: HCI socket layer initialized [ 16.045704] Bluetooth: L2CAP socket layer initialized [ 16.045708] Bluetooth: SCO socket layer initialized [ 16.099614] Bluetooth: RFCOMM TTY layer initialized [ 16.099619] Bluetooth: RFCOMM socket layer initialized [ 16.099621] Bluetooth: RFCOMM ver 1.11 [ 16.112939] Bluetooth: BNEP (Ethernet Emulation) ver 1.3 [ 16.112942] Bluetooth: BNEP filters: protocol multicast [ 16.765824] mtrr: no MTRR for f0000000,100000 found [ 25.872061] eth0: no IPv6 routers present ** Model information not available ** Loaded modules: bnep rfcomm bluetooth rfkill binfmt_misc nfsd nfs nfs_acl auth_rpcgss fscache lockd sunrpc loop psmouse serio_raw evdev virtio_balloon pcspkr processor thermal_sys i2c_piix4 i2c_core button ext4 crc16 jbd2 mbcache sg sr_mod cdrom virtio_blk virtio_net ata_generic floppy ata_piix libata scsi_mod uhci_hcd ehci_hcd virtio_pci virtio_ring usbcore virtio usb_common ** PCI devices: 00:00.0 Host bridge [0600]: Intel Corporation 440FX - 82441FX PMC [Natoma] [8086:1237] (rev 02) Subsystem: Red Hat, Inc Qemu virtual machine [1af4:1100] Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- 00:01.0 ISA bridge [0601]: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II] [8086:7000] Subsystem: Red Hat, Inc Qemu virtual machine [1af4:1100] Physical Slot: 1 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 00:01.1 IDE interface [0101]: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II] [8086:7010] (prog-if 80 [Master]) Subsystem: Red Hat, Inc Qemu virtual machine [1af4:1100] Physical Slot: 1 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Region 0: [virtual] Memory at 000001f0 (32-bit, non-prefetchable) [size=8] Region 1: [virtual] Memory at 000003f0 (type 3, non-prefetchable) [size=1] Region 2: [virtual] Memory at 00000170 (32-bit, non-prefetchable) [size=8] Region 3: [virtual] Memory at 00000370 (type 3, non-prefetchable) [size=1] Region 4: I/O ports at c000 [size=16] Kernel driver in use: ata_piix 00:01.2 USB controller [0c03]: Intel Corporation 82371SB PIIX3 USB [Natoma/Triton II] [8086:7020] (rev 01) (prog-if 00 [UHCI]) Subsystem: Red Hat, Inc Qemu virtual machine [1af4:1100] Physical Slot: 1 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin D routed to IRQ 11 Region 4: I/O ports at c020 [size=32] Kernel driver in use: uhci_hcd 00:01.3 Bridge [0680]: Intel Corporation 82371AB/EB/MB PIIX4 ACPI [8086:7113] (rev 03) Subsystem: Red Hat, Inc Qemu virtual machine [1af4:1100] Physical Slot: 1 Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Interrupt: pin A routed to IRQ 9 Kernel driver in use: piix4_smbus 00:02.0 VGA compatible controller [0300]: Cirrus Logic GD 5446 [1013:00b8] (prog-if 00 [VGA controller]) Subsystem: Red Hat, Inc Device [1af4:1100] Physical Slot: 2 Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Region 0: Memory at f0000000 (32-bit, prefetchable) [size=32M] Region 1: Memory at f2000000 (32-bit, non-prefetchable) [size=4K] Expansion ROM at f2010000 [disabled] [size=64K] 00:03.0 Ethernet controller [0200]: Red Hat, Inc Virtio network device [1af4:1000] Subsystem: Red Hat, Inc Device [1af4:0001] Physical Slot: 3 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 10 Region 0: I/O ports at c040 [size=32] Region 1: Memory at f2020000 (32-bit, non-prefetchable) [size=4K] Expansion ROM at f2030000 [disabled] [size=64K] Capabilities: <access denied> Kernel driver in use: virtio-pci 00:04.0 SCSI storage controller [0100]: Red Hat, Inc Virtio block device [1af4:1001] Subsystem: Red Hat, Inc Device [1af4:0002] Physical Slot: 4 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 11 Region 0: I/O ports at c080 [size=64] Region 1: Memory at f2040000 (32-bit, non-prefetchable) [size=4K] Capabilities: <access denied> Kernel driver in use: virtio-pci 00:08.0 RAM memory [0500]: Red Hat, Inc Virtio memory balloon [1af4:1002] Subsystem: Red Hat, Inc Device [1af4:0005] Physical Slot: 8 Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap- 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Latency: 0 Interrupt: pin A routed to IRQ 11 Region 0: I/O ports at c0c0 [size=32] Kernel driver in use: virtio-pci ** Sound cards: -- System Information: Debian Release: wheezy/sid APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686) Kernel: Linux 3.2.0-4-686-pae (SMP w/2 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages linux-image-3.2.0-4-686-pae depends on: ii debconf [debconf-2.0] 1.5.46 ii initramfs-tools [linux-initramfs-tool] 0.109 ii kmod 9-2 ii linux-base 3.5 ii module-init-tools 9-2 Versions of packages linux-image-3.2.0-4-686-pae recommends: pn firmware-linux-free <none> ii libc6-i686 2.13-37 Versions of packages linux-image-3.2.0-4-686-pae suggests: pn debian-kernel-handbook <none> ii grub-pc 1.99-23 pn linux-doc-3.2 <none> Versions of packages linux-image-3.2.0-4-686-pae is related to: pn firmware-atheros <none> pn firmware-bnx2 <none> pn firmware-bnx2x <none> pn firmware-brcm80211 <none> pn firmware-intelwimax <none> pn firmware-ipw2x00 <none> pn firmware-ivtv <none> pn firmware-iwlwifi <none> pn firmware-libertas <none> pn firmware-linux <none> pn firmware-linux-nonfree <none> pn firmware-myricom <none> pn firmware-netxen <none> pn firmware-qlogic <none> pn firmware-ralink <none> pn firmware-realtek <none> pn xen-hypervisor <none> -- debconf information excluded#include <stdio.h> #include <fcntl.h> #include <sys/ioctl.h> #include <termios.h> #include <stdlib.h> #define BUF_SIZE 1119 #define ERROR_EXIT_CODE 1 #define parent child_id static int mfd=-1, sfd=-1, parent=1; static char pty_name[24]; static void pty_exit(int ret, char * exit_message){ if (sfd >= 0) close(sfd); if (mfd >= 0) close(mfd); printf("%s %s exit. \n %s",ret?"Error":"Normal", parent?"parent":"child", exit_message?exit_message:""); exit(ret); } static void pty_init(void){ int ptn; if( (mfd=open("/dev/ptmx", O_RDWR )) < 0 ) pty_exit(ERROR_EXIT_CODE,"Couldn't open /dev/ptmx. \n"); if (ioctl(mfd, TIOCGPTN, &ptn) < 0 ) pty_exit(ERROR_EXIT_CODE,"Couldn't get pty number. \n"); snprintf(pty_name, sizeof(pty_name), "/dev/pts/%d", ptn); printf("Slave pty name = %s.\n",pty_name); ptn=0; if (ioctl(mfd, TIOCSPTLCK, &ptn) < 0 ) pty_exit(ERROR_EXIT_CODE,"Couldn't unlock pty slave. \n"); if ( (sfd=open(pty_name, O_RDWR )) < 0 ) pty_exit(ERROR_EXIT_CODE, "Couldn't open pty slave. \n"); } int main(int argc,char *argv[]) { pty_init(); char buf[]={ [0 ... BUF_SIZE-1]='1' }; child_id=fork(); do { if(parent) { if ( write(mfd, buf, BUF_SIZE) < 0 ) pty_exit(ERROR_EXIT_CODE, "Parent's write() error.\n"); } else { //Child if ( tcflush(sfd, TCIFLUSH) < 0 ) pty_exit(ERROR_EXIT_CODE, "Child's tcflush() error.\n"); } } while(1); return 0; //Never }
--- End Message ---
--- Begin Message ---
- To: 694720-done@bugs.debian.org
- Subject: Re: linux-image-3.2.0-4-686-pae: tty buffer flush NULL pointer dereference
- From: Ben Hutchings <ben@decadent.org.uk>
- Date: Sun, 15 Sep 2013 20:48:42 +0100
- Message-id: <1379274522.19779.70.camel@deadeye.wl.decadent.org.uk>
Version: 3.2.41-1 As you know, this went into stable update 3.2.41. Ben. -- Ben Hutchings In a hierarchy, every employee tends to rise to his level of incompetence.Attachment: signature.asc
Description: This is a digitally signed message part
--- End Message ---