linux-kernel - Re: [RFC][PATCH] n_tty : Loss of sync following a buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <47D721A8.10300@microgate.com>
Date:	Tue, 11 Mar 2008 18:19:52 -0600
From:	Paul Fulghum <paulkf@...rogate.com>
To:	rupesh.sugathan@...il.com
CC:	linux-kernel@...r.kernel.org, Alan Cox <alan@...rguk.ukuu.org.uk>
Subject: Re: [RFC][PATCH] n_tty : Loss of sync following a buffer overflow

Rupesh Sugathan wrote:
> There seems to be a synchronization issue with the n_tty.c driver when
> working in canonical mode.
> The n_tty rightly discards data received following a buffer overflow and
> hence the tty->read_cnt is not updated. However, the newline characters
> received following a buffer overflow seems to increment the tty-
> canon_data index. This may result in a loss of sync between the tty-
> canon_data & tty->read_cnt while processing read in the read_chan().
> This loss of sync might be irrecoverable even when the data is later
> received at a slower rate.
> 
> ----
> I am not very sure if there is any deliberate rationale to process the
> newlines even when the buffer has overflown. Please comment and review
> the patch
> 
> diff -pu a/drivers/char/n_tty.c b/drivers/char/n_tty.c

Some more information:

This is not purely theoretical. Rupesh is actually
working a problem where he has seen the N_TTY buffer overflow
and the canonical state variables get out of sync with read_cnt, etc.

This patch seems obviously correct, if N_TTY drops a
char due to a full buffer the rest of the character
processing should not take place. Particularly in this
case where the extra processing leaves the tty structure
in an inconsistent state.

--
Paul Fulghum
Microgate Systems, Ltd



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/