[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4AA05840.6020303@kernel.sg>
Date: Fri, 04 Sep 2009 07:58:56 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>, Greg KH <gregkh@...e.de>
Subject: Re: CVE request: kernel: tty: make sure to flush any
pending work when halting the ldisc
Greg KH wrote:
> On Mon, Aug 31, 2009 at 11:52:21AM +0800, Eugene Teo wrote:
>> The tty ldisc code was rewritten to use proper reference counts (commits
>> 65b770468e98 and cbe9352fa08f) in order to avoid a race with hangup, but
>> it also introduced another bug that can result in various problems such
>> as a NULL pointer dereference in run_timer_softirq() or a BUG() in
>> worker_thread. More info in the patch.
>>
>> Upstream commit:
>> http://git.kernel.org/linus/5c58ceff103d8a654f24769bb1baaf84a841b0cc
>>
>> Reproducer:
>> http://lkml.org/lkml/2009/8/20/27
>> http://lkml.org/lkml/2009/8/20/68
>>
>> Backtrace:
>> http://lkml.org/lkml/2009/8/20/21
>>
>> I believe this affects kernel versions greater than v2.6.26. The code in
>> drivers/char/tty_ldisc.c was from drivers/char/tty_io.c before it was
>> splitted into its own file in v2.6.27-rc1 (commit 01e1abb2). I did not
>> investigate further.
>
> Are you sure about this? It only looks to be a problem in the 2.6.31-rc
> tree, as both of the above referenced patches are in that tree (showed
> up in 2.6.31-rc6).
Right, so this was introduced between v2.6.31-rc1 and v2.6.31-rc4, with
commit c65c9bc3 and c8d50041. Thanks for clarifying.
> Do you have a backported patch to 2.6.30 that you think fixes the
> problem?
No, I did not investigate further.
Thanks, Eugene
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
