linux-kernel - Re: [Bug #14388] keyboard under X with 2.6.31

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 13 Oct 2009 22:32:12 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Boyan <btanastasov@...oo.co.uk>,
	"Frédéric L. W. Meunier" <fredlwm@...il.com>,
	"Justin P. Mattock" <justinmattock@...il.com>,
	Nix <nix@...eri.org.uk>, Paul Fulghum <paulkf@...rogate.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Kernel Testers List <kernel-testers@...r.kernel.org>,
	Dmitry Torokhov <dmitry.torokhov@...il.com>,
	Ed Tomlinson <edt@....ca>,
	OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
Subject: Re: [Bug #14388] keyboard under X with 2.6.31

> But flush_to_ldisc() itself has a real oddity: it uses "tty->buf.lock" to 
> protect everything, BUT NOT THE ACTUAL CALL TO ->receive_buf()!

Indeed or it deadlocks

> Anyway, the above explanation "feels right". It would easily explain the 
> behavior, because if the ->receive_buf() calls get re-ordered, then the 
> events get re-ordered, and one simple case of that would be to see the key 
> "release" event before the key "press" event.

And you would only see it in X11 because only X11 deals in raw key events.

> The sane fix would be to just run ->receive_buf() under the tty->buf.lock, 
> but I assume we'd have a lot of unhappy ldiscs if we did that (and 
> possibly irq latency problems too).

You bet

However there is nothing stopping you stuffing that lot into a per tty
mutex solely used for serializing those submissions. It can't really be a
mutex for anything else as we call back into the ldisc to send stuff. You
aren't allowed to stuff data into the ldisc unless it can sleep so a
mutex is fine.

I can't help feeling a mutex might be simpler. It would also then fix
tiocsti() which is most definitely broken right now and documented as
racing.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/