linux-kernel - Re: N_HDLC line discipline: Race condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c937cd80-ecd5-4d41-ad72-668661898039@kernel.org>
Date: Wed, 15 May 2024 12:33:24 +0200
From: Jiri Slaby <jirislaby@...nel.org>
To: Dianne Skoll <dianne@...ll.ca>, linux-serial@...r.kernel.org,
 linux-kernel@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: N_HDLC line discipline: Race condition

Hi,

On 25. 04. 24, 20:01, Dianne Skoll wrote:
> I have (somewhat) narrowed down when the kernel bug appeared by installing
> Debian 10, 11 and 12 in KVM virtual machines.
> 
> The bug is NOT present in Debian 10, kernel version 4.19.67.

I can repro even with 4.19:
posix_openpt = 3
grantpt(3)  = 0
unlockpt(3) = 0
ptsname(3) = /dev/pts/2
open(/dev/pts/2) = 4
ioctl(3, TIOCSETD) = 0
ioctl(4, TIOCSETD) = 0
write(3, Hello , 6) = 6
write(3, world, 5) = 5
read(4, buf, 2048) = 6
buf = |Hello |
read(4, buf, 2048) = 5
buf = |world|
read(4, buf, 2048) = -1
write(3, Hello , 6) = 6
write(3, world, 5) = 5
read(4, buf, 2048) = 11
buf = |Hello world|
HAHA!  Try #2: The two writes were combined in a single read!


Could you recheck?

> The bug IS present in Debian 11, kernel version 5.10.209
> 
> The bug IS present in Debian 12, kernel version 6.1.85
> 
> So I guess it was introduced sometime between 4.19.67 and 5.10.209.  I'll
> take a look to see if I can do a git bisect.

Were you able to do so?

thanks,
-- 
js
suse labs