Problem description:
hci_uart_tty_open() is missing check that tty has a write op (a few don't), and you should check this at open and refuse if the ops you need don't exist (eg as SLIP does:
static int slip_open(struct tty_struct *tty)
{
struct slip *sl;
int err;
if (!capable(CAP_NET_ADMIN))
return -EPERM;
if (tty->ops->write == NULL)
return -EOPNOTSUPP;
Fortunately almost no system will have a driver loaded which lacks a write op, but this should be fixed.
Comment 1Eugene Teo (Security Response)
2010-10-11 04:23:47 UTC
Problem description: hci_uart_tty_open() is missing check that tty has a write op (a few don't), and you should check this at open and refuse if the ops you need don't exist (eg as SLIP does: static int slip_open(struct tty_struct *tty) { struct slip *sl; int err; if (!capable(CAP_NET_ADMIN)) return -EPERM; if (tty->ops->write == NULL) return -EOPNOTSUPP; Fortunately almost no system will have a driver loaded which lacks a write op, but this should be fixed.