Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 04 Sep 2009 07:58:56 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>, Greg KH <gregkh@...e.de>
Subject: Re: CVE request: kernel: tty: make sure to flush any
 pending work when halting the ldisc

Greg KH wrote:
> On Mon, Aug 31, 2009 at 11:52:21AM +0800, Eugene Teo wrote:
>> The tty ldisc code was rewritten to use proper reference counts (commits 
>> 65b770468e98 and cbe9352fa08f) in order to avoid a race with hangup, but 
>> it also introduced another bug that can result in various problems such 
>> as a NULL pointer dereference in run_timer_softirq() or a BUG() in 
>> worker_thread. More info in the patch.
>>
>> Upstream commit:
>> http://git.kernel.org/linus/5c58ceff103d8a654f24769bb1baaf84a841b0cc
>>
>> Reproducer:
>> http://lkml.org/lkml/2009/8/20/27
>> http://lkml.org/lkml/2009/8/20/68
>>
>> Backtrace:
>> http://lkml.org/lkml/2009/8/20/21
>>
>> I believe this affects kernel versions greater than v2.6.26. The code in 
>> drivers/char/tty_ldisc.c was from drivers/char/tty_io.c before it was 
>> splitted into its own file in v2.6.27-rc1 (commit 01e1abb2). I did not 
>> investigate further.
> 
> Are you sure about this?  It only looks to be a problem in the 2.6.31-rc
> tree, as both of the above referenced patches are in that tree (showed
> up in 2.6.31-rc6).

Right, so this was introduced between v2.6.31-rc1 and v2.6.31-rc4, with 
commit c65c9bc3 and c8d50041. Thanks for clarifying.

> Do you have a backported patch to 2.6.30 that you think fixes the
> problem?

No, I did not investigate further.

Thanks, Eugene

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.