[Bug 255816] tty: Potential DoS on terminal writes by stopping thread inside ttydisc_write()

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255816

            Bug ID: 255816
           Summary: tty: Potential DoS on terminal writes by stopping
                    thread inside ttydisc_write()
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: j.piecuch96 at gmail.com

write() calls on a tty without the IO_NDELAY flag are serialized inside
ttydev_write(). Therefore, a thread writing to a tty without IO_NDELAY has
exclusive access to that tty with respect to other writers not using IO_NDELAY.

Let's assume a thread is writing to a tty without IO_NDELAY. It acquires
exclusive access and calls ttydisc_write(). In ttydisc_write() it may sleep
(interruptibly) on the &tp->t_outwait condition variable. It does _not_
relinquish its exclusive access before sleeping. If it receives a stop signal
while it is sleeping it will additionally become suspended (see
sig_suspend_threads()), so signaling the cv won't make it runnable anymore. The
suspended thread still has exclusive access to the tty, preventing other
threads from writing to it.

There is a mechanism to defer handling of stop signals using sigdeferstop(),
but I don't see it being used anywhere related to tty writes. Perhaps the call
to ttydisc_write() could be put between sigdeferstop(SIGDEFERSTOP_ERESTART) and
sigallowstop()?

-- 
You are receiving this mail because:
You are the assignee for the bug.