https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255816
Bug ID: 255816
Summary: tty: Potential DoS on terminal writes by stopping
thread inside ttydisc_write()
Product: Base System
Version: CURRENT
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
write() calls on a tty without the IO_NDELAY flag are serialized inside
ttydev_write(). Therefore, a thread writing to a tty without IO_NDELAY has
exclusive access to that tty with respect to other writers not using IO_NDELAY.
Let's assume a thread is writing to a tty without IO_NDELAY. It acquires
exclusive access and calls ttydisc_write(). In ttydisc_write() it may sleep
(interruptibly) on the &tp->t_outwait condition variable. It does _not_
relinquish its exclusive access before sleeping. If it receives a stop signal
while it is sleeping it will additionally become suspended (see
sig_suspend_threads()), so signaling the cv won't make it runnable anymore. The
suspended thread still has exclusive access to the tty, preventing other
threads from writing to it.
There is a mechanism to defer handling of stop signals using sigdeferstop(),
but I don't see it being used anywhere related to tty writes. Perhaps the call
to ttydisc_write() could be put between sigdeferstop(SIGDEFERSTOP_ERESTART) and
sigallowstop()?
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
