linux-kernel - [PATCH v2 0/2] tty/serial: Fix tcsetattr() TCSADRAIN/FLUSH and write() races

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230317113318.31327-1-ilpo.jarvinen@linux.intel.com>
Date:   Fri, 17 Mar 2023 13:33:16 +0200
From:   Ilpo Järvinen <ilpo.jarvinen@...ux.intel.com>
To:     linux-serial@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jiri Slaby <jirislaby@...nel.org>,
        David Laight <David.Laight@...LAB.COM>
Cc:     linux-kernel@...r.kernel.org,
        Ilpo Järvinen <ilpo.jarvinen@...ux.intel.com>
Subject: [PATCH v2 0/2] tty/serial: Fix tcsetattr() TCSADRAIN/FLUSH and write() races

Fix two races related TCSADRAIN/FLUSH. One in tty core and the other
that can occur when 8250 UART is using DMA for Tx.

These might be slightly controversial as it requires userspace to race
write() with tcsetattr() to trigger these races. But since the races
still seem fixable on kernel side, I made these patches.

v2:
- Switch DMA Tx running / LSR Tx empty checks order due to fast/slowness
- Calculate the result in serial8250_tx_empty() directly

Ilpo Järvinen (2):
  tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH
  serial: 8250: Fix serial8250_tx_empty() race with DMA Tx

 drivers/tty/serial/8250/8250.h      | 12 ++++++++
 drivers/tty/serial/8250/8250_port.c |  7 +++--
 drivers/tty/tty.h                   |  2 ++
 drivers/tty/tty_io.c                |  4 +--
 drivers/tty/tty_ioctl.c             | 45 +++++++++++++++++++++--------
 5 files changed, 53 insertions(+), 17 deletions(-)

-- 
2.30.2