Date: Wed, 12 May 2021 15:38:23 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 255816] tty: Potential DoS on terminal writes by stopping thread inside ttydisc_write() Message-ID: <bug-255816-227@https.bugs.freebsd.org/bugzilla/>
index | next in thread | raw e-mail
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255816 Bug ID: 255816 Summary: tty: Potential DoS on terminal writes by stopping thread inside ttydisc_write() Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: j.piecuch96@gmail.com write() calls on a tty without the IO_NDELAY flag are serialized inside ttydev_write(). Therefore, a thread writing to a tty without IO_NDELAY has exclusive access to that tty with respect to other writers not using IO_NDELAY. Let's assume a thread is writing to a tty without IO_NDELAY. It acquires exclusive access and calls ttydisc_write(). In ttydisc_write() it may sleep (interruptibly) on the &tp->t_outwait condition variable. It does _not_ relinquish its exclusive access before sleeping. If it receives a stop signal while it is sleeping it will additionally become suspended (see sig_suspend_threads()), so signaling the cv won't make it runnable anymore. The suspended thread still has exclusive access to the tty, preventing other threads from writing to it. There is a mechanism to defer handling of stop signals using sigdeferstop(), but I don't see it being used anywhere related to tty writes. Perhaps the call to ttydisc_write() could be put between sigdeferstop(SIGDEFERSTOP_ERESTART) and sigallowstop()? -- You are receiving this mail because: You are the assignee for the bug.help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-255816-227>