From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752131Ab3LQA5c (ORCPT ); Mon, 16 Dec 2013 19:57:32 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:47599 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751019Ab3LQA5U (ORCPT ); Mon, 16 Dec 2013 19:57:20 -0500 Date: Mon, 16 Dec 2013 16:57:19 -0800 From: Greg Kroah-Hartman To: Peter Hurley Cc: Stas Sergeev , Margarita Manterola , linux-kernel@vger.kernel.org, One Thousand Gnomes , Caylan Van Larson , Maximiliano Curia , Pavel Machek , Arkadiusz Miskiewicz Subject: Re: [PATCH v4] n_tty: Fix buffer overruns with larger-than-4k pastes Message-ID: <20131217005719.GA26381@kroah.com> References: <52A79030.9090403@hurleysoftware.com> <1386713522-6959-1-git-send-email-peter@hurleysoftware.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1386713522-6959-1-git-send-email-peter@hurleysoftware.com> User-Agent: Mutt/1.5.22 (2013-10-16) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Dec 10, 2013 at 05:12:02PM -0500, Peter Hurley wrote: > readline() inadvertently triggers an error recovery path when > pastes larger than 4k overrun the line discipline buffer. The > error recovery path discards input when the line discipline buffer > is full and operating in canonical mode and no newline has been > received. Because readline() changes the termios to non-canonical > mode to read the line char-by-char, the line discipline buffer > can become full, and then when readline() restores termios back > to canonical mode for the caller, the now-full line discipline > buffer triggers the error recovery. > > When changing termios from non-canon to canon mode and the read > buffer contains data, simulate an EOF push _without_ the > DISABLED_CHAR in the read buffer. > > Importantly for the readline() problem, the termios can be > changed back to non-canonical mode without changes to the read > buffer occurring; ie., as if the previous termios change had not > happened (as long as no intervening read took place). > > Preserve existing userspace behavior which allows '\0's already > received in non-canon mode to be read as '\0's in canon mode > (rather than trigger add'l EOF pushes or an actual EOF). > > Patch based on original proposal and discussion here > https://bugzilla.kernel.org/show_bug.cgi?id=55991 > by Stas Sergeev > > Reported-by: Margarita Manterola > Cc: Maximiliano Curia > Cc: Pavel Machek > Cc: Arkadiusz Miskiewicz > Acked-by: Stas Sergeev > Signed-off-by: Peter Hurley > --- Is this a 3.13-final thing, or can it wait for 3.14-rc1? thanks, greg k-h