linux-kernel - Re: [PATCH] IRQ handling race and spurious IIR read in serial/8250.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <18845.40059.190188.291643@mariner.uk.xensource.com>
Date:	Thu, 19 Feb 2009 17:52:59 +0000
From:	Ian Jackson <Ian.Jackson@...citrix.com>
To:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Cc:	Anders Kaseorg <andersk@....EDU>,
	"xen-devel@...ts.xensource.com" <xen-devel@...ts.xensource.com>,
	Markus Armbruster <armbru@...hat.com>
Subject: Re: [PATCH] IRQ handling race and spurious IIR read in serial/8250.c

I wrote:
> In drivers/serial/8250.c in Linux there are two bugs:
>  1. UART_BUG_TXEN can be spuriously set, due to an IRQ race
>  2. The workaround then applied by the kernel is itself buggy

Markus Armbruster has also experienced this problem in a Xen
environment and has confirmed that my patch fixes it.

I think at the very least this change:

> Proposed initial band-aid fix (against 2.6.28.4):
> 
> Do not read IIR in serial8250_start_tx when UART_BUG_TXEN
> 
> Reading the IIR clears some oustanding interrupts so it is not safe.
> Instead, simply transmit immediately if the buffer is empty without
> regard to IIR.
> 
> Signed-off-by: Ian Jackson <ian.jackson@...citrix.com>

should be made right away.

Ian.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/