linux-kernel - Re: [BUG] drivers/tty: read() on a noncanonical blocking tty randomly fails when VMIN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 5 May 2016 11:08:31 +0100
From:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
To:	Peter Hurley <peter@...leysoftware.com>
Cc:	Julio Guerra <julio@...jump.io>,
	"Peter Hurley <peter@...leysoftware.com>; Greg Kroah-Hartman" 
	<gregkh@...uxfoundation.org>, linux-kernel@...r.kernel.org
Subject: Re: [BUG] drivers/tty: read() on a noncanonical blocking tty
 randomly fails when VMIN > received >= buf

On Wed, 4 May 2016 16:07:44 -0700
Peter Hurley <peter@...leysoftware.com> wrote:

> Hi Julio,
> 
> On 05/04/2016 04:00 PM, Julio Guerra wrote:
> > Hi,
> > 
> > When a tty (here a slave pty) is set in noncanonical input and blocking read modes, a read() randomly blocks when:
> > "VMIN > kernel received >= user buffer size > 0".
> > 
> > The standard says that read() should block until VMIN bytes are received [1][2]. Whether this is an implementation defined case not really specified by POSIX or not, it should not behave randomly (otherwise it really should be documented in termios manpage).  
> 
> This is not a bug.
> 
> >From the termios(3) man page:  
> 
>        * MIN > 0; TIME == 0: read(2) blocks until the lesser of MIN bytes or the number of bytes requested are avail‐
>          able, and returns the lesser of these two values.

The standard says

	Case B: MIN>0, TIME=0

	In case B, since the value of TIME is zero, the timer plays no
	role and only MIN is significant. A pending read shall not be
	satisfied until MIN bytes are received (that is, the pending read
	shall block until MIN bytes are received), or a signal is
	received. A program that uses case B to read record-based
	terminal I/O may block indefinitely in the read operation.

That is if you do 


	read(fd, buf, 3)

and MIN is 5, the read should not return until there are 5 bytes in the
queue. The following code is guaranteed to work reliably by the standard
with TIME 0 MIN 5 (ignoring signals for the moment)


	read(fd, buf, 3);
	fcntl(fd, F_SETFL, FNDELAY);
	assert(read(fd, buf, 2) == 2);

Historically this behaviour was useful for things like block transfer
protocols, especially with offloaded serial processing.

So actually I think we do have a bug, the behaviuour is not standards
compliant, and the man page documents the erroneous behaviour.

Alan