linux-kernel - Re: Possible "struct pid" leak from tty

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m1r6rqnwrg.fsf@ebiederm.dsl.xmission.com>
Date:	Thu, 15 Mar 2007 13:15:47 -0600
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	"Catalin Marinas" <catalin.marinas@...il.com>
Cc:	"Linux Kernel Mailing List" <linux-kernel@...r.kernel.org>
Subject: Re: Possible "struct pid" leak from tty_io.c

"Catalin Marinas" <catalin.marinas@...il.com> writes:

> On 14/03/07, Eric W. Biederman <ebiederm@...ssion.com> wrote:
>> How does this look?
>
> It seems to fix the leak. I looked at the logs and proc_set_tty calls
> put_pid twice for pid 245 (the unresolved leak) and get_pid for pid
> 296, which is later passed to put_pid via do_tty_hangup.

I can see where this would.  Now I do have a concern that proc_set_tty.
With my current foggy recollections of the semantics of how SIGHUP is
sent I think both callers of proc_set_tty are buggy.  We steal away
the tty and don't send SIGHUP to the old users of the tty.

For flush_unauthorized files making that case looks fairly easy.
For tiocsctty this it looks more difficult.

I need to carefully read through what the rules are again to be certain.
There are legitimate cases for not sending SIGHUP.

> I still get the "error attempted to write to tty [0x00000000] = NULL"
> when debugging is enabled in tty_io.c but it seems harmless.

Yes.  I think that is the last vestiges of a recent tty layer debugging
session.  The code is 8 dec 2006, and came in when we started testing
for NULL and making a NULL tty there harmless.

I remember walking through disassociate_ctty several months ago and
not finding any bugs, but I might look again.

So anyway I almost have this.

Eric
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/