staging: speakup: fix tty-operation NULL derefs

jhovold · gregkh · commit a1960e0f1639 · 2019-01-30T11:54:01.000+01:00
The send_xchar() and tiocmset() tty operations are optional. Add the missing sanity checks to prevent user-space triggerable NULL-pointer dereferences. Fixes: 6b9ad1c ("staging: speakup: add send_xchar, tiocmset and input functionality for tty") Cc: stable <stable@vger.kernel.org> # 4.13 Cc: Okash Khawaja <okash.khawaja@gmail.com> Cc: Samuel Thibault <samuel.thibault@ens-lyon.org> Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c
@@ -265,7 +265,8 @@ static void spk_ttyio_send_xchar(char ch)
 		return;
 	}
 
-	speakup_tty->ops->send_xchar(speakup_tty, ch);
+	if (speakup_tty->ops->send_xchar)
+		speakup_tty->ops->send_xchar(speakup_tty, ch);
 	mutex_unlock(&speakup_tty_mutex);
 }
 
@@ -277,7 +278,8 @@ static void spk_ttyio_tiocmset(unsigned int set, unsigned int clear)
 		return;
 	}
 
-	speakup_tty->ops->tiocmset(speakup_tty, set, clear);
+	if (speakup_tty->ops->tiocmset)
+		speakup_tty->ops->tiocmset(speakup_tty, set, clear);
 	mutex_unlock(&speakup_tty_mutex);
 }
 

Original file line number	Diff line number	Diff line change
`@@ -265,7 +265,8 @@ static void spk_ttyio_send_xchar(char ch)`
`265`	`265`	`return;`
`266`	`266`	`}`
`267`	`267`
`268`		`- speakup_tty->ops->send_xchar(speakup_tty, ch);`
	`268`	`+ if (speakup_tty->ops->send_xchar)`
	`269`	`+ speakup_tty->ops->send_xchar(speakup_tty, ch);`
`269`	`270`	`mutex_unlock(&speakup_tty_mutex);`
`270`	`271`	`}`
`271`	`272`
`@@ -277,7 +278,8 @@ static void spk_ttyio_tiocmset(unsigned int set, unsigned int clear)`
`277`	`278`	`return;`
`278`	`279`	`}`
`279`	`280`
`280`		`- speakup_tty->ops->tiocmset(speakup_tty, set, clear);`
	`281`	`+ if (speakup_tty->ops->tiocmset)`
	`282`	`+ speakup_tty->ops->tiocmset(speakup_tty, set, clear);`
`281`	`283`	`mutex_unlock(&speakup_tty_mutex);`
`282`	`284`	`}`
`283`	`285`