linux-kernel - Re: N_HDLC line discipline: Race condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 21 May 2024 12:47:00 +0200
From: Jiri Slaby <jirislaby@...nel.org>
To: Dianne Skoll <dianne@...ll.ca>, linux-serial@...r.kernel.org,
 linux-kernel@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: N_HDLC line discipline: Race condition

On 25. 04. 24, 20:01, Dianne Skoll wrote:
> Hi,
> 
> I have (somewhat) narrowed down when the kernel bug appeared by installing
> Debian 10, 11 and 12 in KVM virtual machines.
> 
> The bug is NOT present in Debian 10, kernel version 4.19.67.
> 
> The bug IS present in Debian 11, kernel version 5.10.209
> 
> The bug IS present in Debian 12, kernel version 6.1.85
> 
> So I guess it was introduced sometime between 4.19.67 and 5.10.209.  I'll
> take a look to see if I can do a git bisect.
> 
> [To recap, the bug is that the N_HDLC line discipline sometimes
> coalesces two write()s so you get them both back in a single read()
> which is contrary to what it's supposed to do... preserve the write
> boundaries as individual frames.]

I believe it is a correct behavior after all. As you use pty for 
testing, the "framing" is lost during the pty-to-pty pass on the flush 
to ldisc path (receive_buf()).

[ T1056] n_hdlc_send_frames: ptm2 sending frame 0000000081e69927, count=6
[ T1056]        frame 0000000081e69927 completed
[ T1056] n_hdlc_send_frames: ptm2 sending frame 00000000576db119, count=5
[ T1056]        frame 00000000576db119 completed
[  T123] n_hdlc_tty_receive: pts2 buf=00000000a616a2be count=11
[ T1056] n_hdlc_tty_read: pts2 rbuf=00000000a616a2be 
kbuf=000000004abc3c35 offset=0 ret=11

thanks,
-- 
js
suse labs