oss-security - CVE request: kernel: tty: make sure to flush any pending work when halting the ldisc

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4A9B48F5.9010506@kernel.sg>
Date: Mon, 31 Aug 2009 11:52:21 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>, Greg KH <gregkh@...e.de>
Subject: CVE request: kernel: tty: make sure to flush any pending work when
 halting the ldisc

The tty ldisc code was rewritten to use proper reference counts (commits 
65b770468e98 and cbe9352fa08f) in order to avoid a race with hangup, but 
it also introduced another bug that can result in various problems such 
as a NULL pointer dereference in run_timer_softirq() or a BUG() in 
worker_thread. More info in the patch.

Upstream commit:
http://git.kernel.org/linus/5c58ceff103d8a654f24769bb1baaf84a841b0cc

Reproducer:
http://lkml.org/lkml/2009/8/20/27
http://lkml.org/lkml/2009/8/20/68

Backtrace:
http://lkml.org/lkml/2009/8/20/21

I believe this affects kernel versions greater than v2.6.26. The code in 
drivers/char/tty_ldisc.c was from drivers/char/tty_io.c before it was 
splitted into its own file in v2.6.27-rc1 (commit 01e1abb2). I did not 
investigate further.

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.