linux-kernel - Re: [PATCH] serial: flush ldisc after hangup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 1 Mar 2016 11:01:40 -0800
From:	Peter Hurley <peter@...leysoftware.com>
To:	Josef Bacik <jbacik@...com>, gregkh@...uxfoundation.org,
	jslaby@...e.com, linux-serial@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] serial: flush ldisc after hangup

On 03/01/2016 10:21 AM, Josef Bacik wrote:
> On 03/01/2016 01:17 PM, Peter Hurley wrote:

>> Yeah, the race is that the ldisc should not be attempting i/o to 
>> the driver at all. This problem is fixed in -next already, but in
>> the tty core rather than in each individual tty driver.
>> 
> 
> Great!  Which patch/patches fix this?  I looked at linux-next and
> there's a lot of refactoring stuff, do I need all the things or is
> there a specific one that fixes this problem?  Thanks,

The series that fixes this design problem introduce in 3.10 are these
patches:

  staging: digi: Replace open-coded tty_wakeup()
  serial: 68328: Remove bogus ldisc reset
  bluetooth: hci_ldisc: Remove dead code
  NFC: nci: Remove dead code
  tty: Remove chars_in_buffer() line discipline method
  tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
  n_tty: Fix unsafe reference to "other" ldisc
  tty: Reset c_line from driver's init_termios
  staging/speakup: Use tty_ldisc_ref() for paste kworker
  tty: Fix comments for tty_ldisc_get()
  tty: Fix comments for tty_ldisc_release()
  tty: Prepare for destroying line discipline on hangup
  tty: Handle NULL tty->ldisc
  tty: Move tty_ldisc_kill()
  tty: Use 'disc' for line discipline index name
  tty: Refactor tty_ldisc_reinit() for reuse
  tty: Destroy ldisc instance on hangup

'tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)' and
'tty: Fix unsafe reference to "other" ldisc' have already
made their way to most stable trees, afaict.

I doubt I'll submit any more of this series for stable;
it's just too invasive. I'll probably do it per-driver, like
your patch. Just an fyi.

Regards,
Peter Hurley