linux-kernel - Re: N_HDLC line discipline: Race condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 23 May 2024 10:01:51 +0200
From: Jiri Slaby <jirislaby@...nel.org>
To: Dianne Skoll <dianne@...ll.ca>
Cc: linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: N_HDLC line discipline: Race condition

On 21. 05. 24, 16:15, Dianne Skoll wrote:
> On Tue, 21 May 2024 12:47:00 +0200
> Jiri Slaby <jirislaby@...nel.org> wrote:
> 
>> I believe it is a correct behavior after all. As you use pty for
>> testing, the "framing" is lost during the pty-to-pty pass on the
>> flush to ldisc path (receive_buf()).
> 
> That might be what's happening, but I don't think it matches the documentation
> in n_hdlc.c.  If you read the comment block near the top of the file,
> it says this:
> 
>   * All HDLC data is frame oriented which means:
>   *
>   * 1. tty write calls represent one complete transmit frame of data
>   *    The device driver should accept the complete frame or none of
>   *    the frame (busy) in the write method. Each write call should have
>   *    a byte count in the range of 2-65535 bytes (2 is min HDLC frame
>   *    with 1 addr byte and 1 ctrl byte). The max byte count of 65535
>   *    should include any crc bytes required. For example, when using
>   *    CCITT CRC32, 4 crc bytes are required, so the maximum size frame
>   *    the application may transmit is limited to 65531 bytes. For CCITT
>   *    CRC16, the maximum application frame size would be 65533.
>   *
>   *
>   * 2. receive callbacks from the device driver represents
>   *    one received frame. The device driver should bypass
>   *    the tty flip buffer and call the line discipline receive
>   *    callback directly to avoid fragmenting or concatenating
>   *    multiple frames into a single receive callback.
>   *
>   *    The HDLC line discipline queues the receive frames in separate
>   *    buffers so complete receive frames can be returned by the
>   *    tty read calls.
>   *
>   * 3. tty read calls returns an entire frame of data or nothing.
> [...] */
> 
> Point 2 says that the driver should avoid fragmenting frames, or concatenating
> frames into a single receive callback.  Doesn't this imply that frame
> boundaries should be preserved when you read() data, which happens reliably
> when you add a small delay between write()'s?

The driver definitely behaves as described. If the ldisc is used on a 
real HW. ptys are a different story -- it's not guaranteed there. Does 
it make sense to use nhdlc on a pty pair? I believe not.

thanks,
-- 
js
suse labs