linux-kernel - Re: [PATCH v2] USB: cdc-acm: Prevent data loss when filling tty buffer.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110322180545.54df2fa0@lxorguk.ukuu.org.uk>
Date:	Tue, 22 Mar 2011 18:05:45 +0000
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Toby Gray <toby.gray@...lvnc.com>
Cc:	Johan Hovold <jhovold@...il.com>,
	Oliver Neukum <oliver@...kum.name>,
	Greg Kroah-Hartman <gregkh@...e.de>, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] USB: cdc-acm: Prevent data loss when filling tty
 buffer.

> Is there a mechanism preventing a different thread from running 
> n_tty_read between n_tty_receive_buf finding receive_room to be below 
> the threshold and tty_throttle being called? If not then isn't there a 
> race condition when the following happens:

n_tty_receive is single threaded and is going to get run in preference to
user threads.

>          1. n_tty_receive_buf fills up the buffer so that the free space 
> is below TTY_THRESHOLD_THROTTLE
>          2. n_tty_receive_buf comes to the check at the end and decide 
> that it needs to call tty_throttle
>          3. Thread rescheduling happens and a different thread runs 
> n_tty_read which empties the buffer
>          4. After emptying the buffer n_tty_read calls tty_unthrottle, 
> which does nothing as the throttling bit isn't set
>          5. The n_tty_receive_buf thread is executed again, calling 
> tty_throttle, causing throttling, but with an empty buffer.
> 
> Or have I not understood a complexity in the interactions within n_tty.c?

Looks possible - historically it would have been safe but not any more.
The scenario I think would have to be two thread of execution in parallel
on two processors at the same moment and with near perfect timing but I
don't see why it can't happen.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/