Date: Wed, 12 May 2021 15:38:23 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 255816] tty: Potential DoS on terminal writes by stopping thread inside ttydisc_write() Message-ID: <bug-255816-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D255816 Bug ID: 255816 Summary: tty: Potential DoS on terminal writes by stopping thread inside ttydisc_write() Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: j.piecuch96@gmail.com write() calls on a tty without the IO_NDELAY flag are serialized inside ttydev_write(). Therefore, a thread writing to a tty without IO_NDELAY has exclusive access to that tty with respect to other writers not using IO_NDE= LAY. Let's assume a thread is writing to a tty without IO_NDELAY. It acquires exclusive access and calls ttydisc_write(). In ttydisc_write() it may sleep (interruptibly) on the &tp->t_outwait condition variable. It does _not_ relinquish its exclusive access before sleeping. If it receives a stop sign= al while it is sleeping it will additionally become suspended (see sig_suspend_threads()), so signaling the cv won't make it runnable anymore.= The suspended thread still has exclusive access to the tty, preventing other threads from writing to it. There is a mechanism to defer handling of stop signals using sigdeferstop(), but I don't see it being used anywhere related to tty writes. Perhaps the c= all to ttydisc_write() could be put between sigdeferstop(SIGDEFERSTOP_ERESTART)= and sigallowstop()? --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-255816-227>