linux-kernel - [PATCH] ldisc switching on a HUPped pty hangs the caller

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 15 Jan 2010 06:07:52 +0100
From:	Matthias Urlichs <matthias@...ichs.de>
To:	linux-kernel@...r.kernel.org
Subject: [PATCH] ldisc switching on a HUPped pty hangs the caller

Calling vhangup() and then switching line disciplines results in
incomplete clean-up and a wedged process if it then calls ioctl()
on the pty.

Signed-Off-By: Matthias Urlichs <matthias@...ichs.de>

---
I recently upgraded my gateway machine to 2.6.31. This caused
ppp-over-ssh to stop working. Indeed, the PPP process got wedged into
noninterruptible sleep, which this patch fixes.

(The comment, by the way, seems to be wrong. There was no race.) 

The underlying problem, however, turns out to be the vhangup() syscall
which the SSH server emits before exec'ing pppd. This causes the tty's
HUPPED bit to get set, which in turn causes the above error.

Browbeating sshd into not issuing vhangup() (why does it do that,
anyway? Presumably, using PTMX we can be sure that nobody is hogging the
pty in the first place, right?) means that I now have a working ssh
tunnel.

… until somebody forces me to switch to a 'real' VPN. :-P

---

diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index aafdbae..bb92f5e 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -621,9 +621,8 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 		/* We were raced by the hangup method. It will have stomped
 		   the ldisc data and closed the ldisc down */
 		clear_bit(TTY_LDISC_CHANGING, &tty->flags);
-		mutex_unlock(&tty->ldisc_mutex);
-		tty_ldisc_put(new_ldisc);
-		return -EIO;
+		retval = -EIO;
+		goto out;
 	}

 	/* Shutdown the current discipline. */
@@ -652,7 +651,7 @@ int tty_set_ldisc(struct tty_struct *tty, int ldisc)
 	/*
 	 *	Allow ldisc referencing to occur again
 	 */
-
+out:
 	tty_ldisc_enable(tty);
 	if (o_tty)
 		tty_ldisc_enable(o_tty);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/