tty: CVE-2019-11486

tty: mark Siemens R3964 line discipline as BROKEN

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2019-11486
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=429977fd9f7153607230a6040ee12510a525e930

Change-Id: Iba01aad6b191590574396a6e06a4e6c554db6274
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

1 files changed, 51 insertions, 0 deletions

diff --git a/patches/cve/CVE-2019-11486-tty-mark-Siemens-R3964-line-discipline-as-BROKEN.patch b/patches/cve/CVE-2019-11486-tty-mark-Siemens-R3964-line-discipline-as-BROKEN.patch
new file mode 100644
index 0000000..aa00934
--- /dev/null
+++ b/patches/cve/CVE-2019-11486-tty-mark-Siemens-R3964-line-discipline-as-BROKEN.patch
@@ -0,0 +1,51 @@
+From 429977fd9f7153607230a6040ee12510a525e930 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 5 Apr 2019 15:39:26 +0200
+Subject: [PATCH] tty: mark Siemens R3964 line discipline as BROKEN
+
+commit c7084edc3f6d67750f50d4183134c4fb5712a5c8 upstream.
+
+The n_r3964 line discipline driver was written in a different time, when
+SMP machines were rare, and users were trusted to do the right thing.
+Since then, the world has moved on but not this code, it has stayed
+rooted in the past with its lovely hand-crafted list structures and
+loads of "interesting" race conditions all over the place.
+
+After attempting to clean up most of the issues, I just gave up and am
+now marking the driver as BROKEN so that hopefully someone who has this
+hardware will show up out of the woodwork (I know you are out there!)
+and will help with debugging a raft of changes that I had laying around
+for the code, but was too afraid to commit as odds are they would break
+things.
+
+Many thanks to Jann and Linus for pointing out the initial problems in
+this codebase, as well as many reviews of my attempts to fix the issues.
+It was a case of whack-a-mole, and as you can see, the mole won.
+
+CVE: CVE-2019-11486
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=429977fd9f7153607230a6040ee12510a525e930]
+
+Reported-by: Jann Horn <jannh@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ drivers/char/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index c28dca0c613d..88316f86cc95 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -380,7 +380,7 @@ config XILINX_HWICAP
+ 
+ config R3964
+        tristate "Siemens R3964 line discipline"
+-       depends on TTY
++       depends on TTY && BROKEN
+        ---help---
+          This driver allows synchronous communication with devices using the
+          Siemens R3964 packet protocol. Unless you are dealing with special
+-- 
+2.20.1
+