linux-kernel - [PATCH] tty: fix data race in n_tty_receive_buf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1514987332-14122-1-git-send-email-gkohli@codeaurora.org>
Date:   Wed,  3 Jan 2018 19:18:52 +0530
From:   Gaurav Kohli <gkohli@...eaurora.org>
To:     jslaby@...e.com, gregkh@...uxfoundation.org, mikey@...ling.org
Cc:     linux-kernel@...r.kernel.org, Gaurav Kohli <gkohli@...eaurora.org>
Subject: [PATCH] tty: fix data race in n_tty_receive_buf_common

There can be a race, if receive_buf call comes before
tty initialization completes in n_tty_open and tty->disc_data
may be NULL.

CPU0                                        cpu1
----                                        ----
 000|n_tty_receive_buf_common()     n_tty_open()
-001|n_tty_receive_buf2()           tty_ldisc_open.isra.3()
-002|tty_ldisc_receive_buf(inline)  tty_ldisc_setup()

If tty->disc_data is NULL, then return from flush_to_ldisc

Signed-off-by: Gaurav Kohli <gkohli@...eaurora.org>

diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 25d7368..5d49183 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -35,6 +35,9 @@ static int tty_port_default_receive_buf(struct tty_port *port,
 	if (!disc)
 		return 0;
 
+	if (!tty->disc_data)
+		return 0;
+
 	ret = tty_ldisc_receive_buf(disc, p, (char *)f, count);
 
 	tty_ldisc_deref(disc);
-- 
1.9.1