From: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Jiri Slaby <jslaby@suse.com>, LKML <linux-kernel@vger.kernel.org>,
Peter Hurley <peter@hurleysoftware.com>,
Vegard Nossum <vegard.nossum@oracle.com>,
syzkaller <syzkaller@googlegroups.com>
Subject: Re: tty: use-after-free in n_tty_receive_buf_fast
Date: Mon, 5 Sep 2016 22:43:56 +0100 [thread overview]
Message-ID: <20160905224356.6d3538ea@lxorguk.ukuu.org.uk> (raw)
In-Reply-To: <CACT4Y+ZdpmG9Ut5k+f1cAFV8vn4vWKZn0yeHfcw52WyVqcTDog@mail.gmail.com>
On Sat, 3 Sep 2016 14:42:08 +0200
Dmitry Vyukov <dvyukov@google.com> wrote:
> Hello,
>
> The following program causes use-after-free in n_tty_receive_buf_fast:
>
> https://gist.githubusercontent.com/dvyukov/ac81bed0238f280ddf9067e6234cd8b0/raw/791c07ac0cdb27e2e399464d68fa0234d2aa8bd1/gistfile1.txt
>
Known bug. It's even been documented as broken since 2012, although it's
always been broken. Apparently nobody cares about fixing it although now
the tty buffers belong to the tty_port it is fixable if and when someone
dares to fix the mess that is the console locking code (because you have
to ensure the keyboard, selection and any other queue sources have to be
serialized).
TIOCSTI is broken as well and needs to be dealt with at the same time - in
fact you can currently get a three way race between select, console input
and TIOCSTI if you really want to screw up (and you don't need root for
any of them).
Alan
prev parent reply other threads:[~2016-09-05 21:44 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-03 12:42 Dmitry Vyukov
2016-09-05 21:43 ` One Thousand Gnomes [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160905224356.6d3538ea@lxorguk.ukuu.org.uk \
--to=gnomes@lxorguk.ukuu.org.uk \
--cc=dvyukov@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=jslaby@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=peter@hurleysoftware.com \
--cc=syzkaller@googlegroups.com \
--cc=vegard.nossum@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®