Re: tty: use-after-free in n_tty_receive_buf_fast

[One Thousand Gnomes]

On Sat, 3 Sep 2016 14:42:08 +0200
Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:

> Hello,
> 
> The following program causes use-after-free in n_tty_receive_buf_fast:
> 
> https://gist.githubusercontent.com/dvyukov/ac81bed0238f280ddf9067e6234cd8b0/raw/791c07ac0cdb27e2e399464d68fa0234d2aa8bd1/gistfile1.txt
>

Known bug. It's even been documented as broken since 2012, although it's
always been broken. Apparently nobody cares about fixing it although now
the tty buffers belong to the tty_port it is fixable if and when someone
dares to fix the mess that is the console locking code (because you have
to ensure the keyboard, selection and any other queue sources have to be
serialized). 

TIOCSTI is broken as well and needs to be dealt with at the same time - in
fact you can currently get a three way race between select, console input
and TIOCSTI if you really want to screw up (and you don't need root for
any of them).

Alan