linux-kernel - possible regression with pty.c commit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090711191556.GA3845@localdomain.by>
Date:	Sat, 11 Jul 2009 22:15:56 +0300
From:	Sergey Senozhatsky <sergey.senozhatsky@...l.by>
To:	Alan Cox <alan@...ux.intel.com>
Cc:	Alan Cox <alan@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org
Subject: possible regression with pty.c commit

Hello,
commit d945cb9cce20ac7143c2de8d88b187f62db99bdc ("pty: Rework the pty layer to use the normal buffering logic")
seems to brake kdesu.

(quote: "Because some su implementations (i.e. the one from Red HatВ®) don't want to 
read the password from stdin, KDE su creates a pty/tty pair and 
executes su with it's standard filedescriptors connected to the tty.")

Revert "pty: Rework the pty layer to use the normal buffering logic"
(commit d945cb9cce20ac7143c2de8d88b187f62db99bdc) makes kdesu work again.

strace /usr/bin/kdesu -u root -c top:
//tons of kde stuff were cut

execve("/usr/bin/kdesu", ["/usr/bin/kdesu", "-u", "root", "-c", "top"], [/* 36 vars */]) = 0
brk(0)                                  = 0x9268000
...
sigreturn()                             = ? (mask now [])
access("/bin/su", X_OK)                 = 0
open("/dev/ptmx", O_RDWR)               = 10
ioctl(10, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(10, TIOCGPTN, [10])               = 0
stat64("/dev/pts/10", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 10), ...}) = 0
ioctl(10, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(10, TIOCGPTN, [10])               = 0
stat64("/dev/pts/10", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 10), ...}) = 0
statfs("/dev/pts/10", {f_type="DEVPTS_SUPER_MAGIC", f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
ioctl(10, TIOCSPTLCK, [0])              = 0
open("/dev/pts/10", O_RDWR)             = 11
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb68c5718) = 4072
close(11)                               = 0
fcntl64(10, F_GETFL)                    = 0x2 (flags O_RDWR)
read(10, "Password: ", 255)             = 10
select(11, [10], NULL, NULL, {0, 100000}) = 0 (Timeout)
kill(4072, SIG_0)                       = 0
open("/dev/pts/10", O_RDWR)             = 11
kill(4072, SIG_0)                       = 0
ioctl(11, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 -opost isig icanon -echo ...}) = 0
close(11)                               = 0
kill(4072, SIG_0)                       = 0
write(10, "**~WRITE_PASSWORD~**", 11)	= 11
write(10, "\n", 1)                      = 1
fcntl64(10, F_GETFL)                    = 0x2 (flags O_RDWR)
read(10, "\n", 255)                     = 1
fcntl64(10, F_GETFL)                    = 0x2 (flags O_RDWR)
read(10, "kdesu_stub\n", 255)           = 11
open("/dev/pts/10", O_RDWR)             = 11
ioctl(11, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 -opost isig icanon echo ...}) = 0
ioctl(11, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 -opost isig icanon echo ...}) = 0
ioctl(11, SNDCTL_TMR_START or TCSETS, {B38400 -opost isig icanon -echo ...}) = 0
ioctl(11, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 -opost isig icanon -echo ...}) = 0
close(11)                               = 0
write(10, "stop", 4)                    = 4
write(10, "\n", 1)                      = 1
fcntl64(10, F_GETFL)                    = 0x2 (flags O_RDWR)
read(10, 0xbf840858, 255)               = -1 EIO (Input/output error)		<<<<<<<<<
--- SIGCHLD (Child exited) @ 0 (0) ---
write(5, "\0", 1)                       = 1
sigreturn()                             = ? (mask now [])
.....


As for "bug 13522: BUG: scheduling while atomic" - I'll test it.


	Sergey
Download attachment "signature.asc" of type "application/pgp-signature" (316 bytes)