linux-kernel - Re: [PATCH 4/5] TTY: fix tty_wait_until

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 05 Mar 2015 09:31:19 -0500
From:	Peter Hurley <peter@...leysoftware.com>
To:	Johan Hovold <johan@...nel.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
CC:	Jiri Slaby <jslaby@...e.cz>, Samuel Ortiz <samuel@...tiz.org>,
	"David S. Miller" <davem@...emloft.net>,
	Alan Cox <alan@...ux.intel.com>, linux-kernel@...r.kernel.org,
	linux-usb@...r.kernel.org, linux-serial@...r.kernel.org,
	netdev@...r.kernel.org,
	ZIV-Asier Llano Palacios <asier.llano@...lobal.com>,
	stable <stable@...r.kernel.org>
Subject: Re: [PATCH 4/5] TTY: fix tty_wait_until_sent on 64-bit machines

On 03/04/2015 04:39 AM, Johan Hovold wrote:
> Fix overflow bug in tty_wait_until_sent on 64-bit machines, where an
> infinite timeout (0) would be passed to the underlying tty-driver's
> wait_until_sent-operation as a negative timeout (-1), causing it to
> return immediately.

Wow, that is a nasty bug.

> This manifests itself for example as tcdrain() returning immediately,
> drivers not honouring the drain flags when setting terminal attributes,
> or even dropped data on close as a requested infinite closing-wait
> timeout would be ignored.
> 
> The first symptom  was reported by Asier LLANO who noted that tcdrain()
> returned prematurely when using the ftdi_sio usb-serial driver.
> 
> Fix this by passing 0 rather than MAX_SCHEDULE_TIMEOUT (LONG_MAX) to the
> underlying tty driver.
> 
> Note that the serial-core wait_until_sent-implementation is not affected
> by this bug due to a lucky chance (comparison to an unsigned maximum
> timeout), and neither is the cyclades one that had an explicit check for
> negative timeouts, but all other tty drivers appear to be affected.

Reviewed-by: Peter Hurley <peter@...leysoftware.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/