[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090903221121.GA23517@kroah.com>
Date: Thu, 3 Sep 2009 15:11:21 -0700
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>, Greg KH <gregkh@...e.de>
Subject: Re: CVE request: kernel: tty: make sure to flush
any pending work when halting the ldisc
On Mon, Aug 31, 2009 at 11:52:21AM +0800, Eugene Teo wrote:
> The tty ldisc code was rewritten to use proper reference counts (commits
> 65b770468e98 and cbe9352fa08f) in order to avoid a race with hangup, but
> it also introduced another bug that can result in various problems such
> as a NULL pointer dereference in run_timer_softirq() or a BUG() in
> worker_thread. More info in the patch.
>
> Upstream commit:
> http://git.kernel.org/linus/5c58ceff103d8a654f24769bb1baaf84a841b0cc
>
> Reproducer:
> http://lkml.org/lkml/2009/8/20/27
> http://lkml.org/lkml/2009/8/20/68
>
> Backtrace:
> http://lkml.org/lkml/2009/8/20/21
>
> I believe this affects kernel versions greater than v2.6.26. The code in
> drivers/char/tty_ldisc.c was from drivers/char/tty_io.c before it was
> splitted into its own file in v2.6.27-rc1 (commit 01e1abb2). I did not
> investigate further.
Are you sure about this? It only looks to be a problem in the 2.6.31-rc
tree, as both of the above referenced patches are in that tree (showed
up in 2.6.31-rc6).
Do you have a backported patch to 2.6.30 that you think fixes the
problem?
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
