linux-kernel - [RFC][PATCH] n_tty : Loss of sync following a buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 11 Mar 2008 13:42:19 -0700
From:	Rupesh Sugathan <rupesh.sugathan@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: [RFC][PATCH] n_tty : Loss of sync following a buffer overflow

From: Rupesh Sugathan <Rupesh.Sugathan@...il.com>

There seems to be a synchronization issue with the n_tty.c driver when
working in canonical mode.
The n_tty rightly discards data received following a buffer overflow and
hence the tty->read_cnt is not updated. However, the newline characters
received following a buffer overflow seems to increment the tty-
>canon_data index. This may result in a loss of sync between the tty-
>canon_data & tty->read_cnt while processing read in the read_chan().
This loss of sync might be irrecoverable even when the data is later
received at a slower rate.

----
I am not very sure if there is any deliberate rationale to process the
newlines even when the buffer has overflown. Please comment and review
the patch

diff -pu a/drivers/char/n_tty.c b/drivers/char/n_tty.c

--- a/drivers/char/n_tty.c	2008-03-10 17:11:54.000000000 -0700
+++ b/drivers/char/n_tty.c	2008-03-10 16:49:23.000000000 -0700
@@ -838,15 +838,17 @@ send_signal:
 				put_tty_queue(c, tty);
 
 		handle_newline:
-			spin_lock_irqsave(&tty->read_lock, flags);
-			set_bit(tty->read_head, tty->read_flags);
-			put_tty_queue_nolock(c, tty);
-			tty->canon_head = tty->read_head;
-			tty->canon_data++;
-			spin_unlock_irqrestore(&tty->read_lock, flags);
-			kill_fasync(&tty->fasync, SIGIO, POLL_IN);
-			if (waitqueue_active(&tty->read_wait))
-				wake_up_interruptible(&tty->read_wait);
+			if (tty->read_cnt < N_TTY_BUF_SIZE) {
+				spin_lock_irqsave(&tty->read_lock, flags);
+				set_bit(tty->read_head, tty->read_flags);
+				put_tty_queue_nolock(c, tty);
+				tty->canon_head = tty->read_head;
+				tty->canon_data++;
+				spin_unlock_irqrestore(&tty->read_lock, flags);
+				kill_fasync(&tty->fasync, SIGIO, POLL_IN);
+				if (waitqueue_active(&tty->read_wait))
+					wake_up_interruptible(&tty->read_wait);
+			}
 			return;
 		}
 	}

Signed-off-by: Rupesh Sugathan <Rupesh.Sugathan@...il.com>



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/