On Sat, 3 Sep 2016 14:42:08 +0200 Dmitry Vyukov <dvyu...@google.com> wrote:
> Hello, > > The following program causes use-after-free in n_tty_receive_buf_fast: > > https://gist.githubusercontent.com/dvyukov/ac81bed0238f280ddf9067e6234cd8b0/raw/791c07ac0cdb27e2e399464d68fa0234d2aa8bd1/gistfile1.txt > Known bug. It's even been documented as broken since 2012, although it's always been broken. Apparently nobody cares about fixing it although now the tty buffers belong to the tty_port it is fixable if and when someone dares to fix the mess that is the console locking code (because you have to ensure the keyboard, selection and any other queue sources have to be serialized). TIOCSTI is broken as well and needs to be dealt with at the same time - in fact you can currently get a three way race between select, console input and TIOCSTI if you really want to screw up (and you don't need root for any of them). Alan
