linux-kernel - Re: [PATCH] tty: Fix race condition between __tty_buffer_request_room and flush_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 22 Apr 2014 11:55:52 +0100
From:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
To:	Manfred Schlaegl <manfred.schlaegl@....at>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jslaby@...e.cz>,
	Peter Hurley <peter@...leysoftware.com>,
	Alan Cox <alan@...hat.com>, linux-kernel@...r.kernel.org,
	Manfred Schlaegl <manfred.schlaegl@...zinger.com>
Subject: Re: [PATCH] tty: Fix race condition between
 __tty_buffer_request_room and flush_to_ldisc

On Fri, 18 Apr 2014 10:10:17 +0200
Manfred Schlaegl <manfred.schlaegl@....at> wrote:

> On 2014-04-08 14:42, Manfred Schlaegl wrote:
> > The race was introduced while development of linux-3.11 by
> > e8437d7ecbc50198705331449367d401ebb3181f and
> > e9975fdec0138f1b2a85b9624e41660abd9865d4.
> > Originally it was found and reproduced on linux-3.12.15 and
> > linux-3.12.15-rt25, by sending 500 byte blocks with 115kbaud to the
> > target uart in a loop with 100 milliseconds delay.
> > 
> > In short:
> >  1. The consumer flush_to_ldisc is on to remove the head tty_buffer.
> >  2. The producer adds a number of bytes, so that a new tty_buffer must
> > 	be allocated and added by __tty_buffer_request_room.
> >  3. The consumer removes the head tty_buffer element, without handling
> > 	newly committed data.
> 
> Hi!
> 
> Reminder: The Problem is still existent in linux-3.11, 3.12, 3.13. 3.14 and pre 3.15 kernels.
> 
> The lastly delivered patch cleanly applies to pre 3.15 (torvalds tree) and 3.14(.1).

Greg ?? what is happening about this one. We can't just ignore losing
bytes caused by incorrect lock removal. We are seeing breakages in things
like bluetooth over serial which are quite probably down to this problem.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/