[Bug libc/12167] New: ttyname() and ttyname_r() may return wrong value

[Bug libc/12167] New: ttyname() and ttyname_r() may return wrong value

[miklos at szeredi dot hu]

http://sourceware.org/bugzilla/show_bug.cgi?id=12167

           Summary: ttyname() and ttyname_r() may return wrong value
           Product: glibc
           Version: 2.13
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: miklos@szeredi.hu


On linux 2.6.36:

# mount --bind / /mnt/tmp
# mount -t proc proc /mnt/tmp/proc
# chroot /mnt/tmp
# tty
(unreachable)/dev/tty2

This is caused by commit 8df9d1a4 (vfs: show unreachable paths in getcwd and
proc) explicitly marking files that are unreachable from the current root.

Before this commit the symlink was either junk or contained the path from the
namespace root which may, or may not point to the inode behind the file
descriptor.  Note: *following* the symlink (not reading it) always yielded the
correct file.

In addition these symlinks may contain the string "(deleted)" at the end if the
file was unlinked after it was opened.

The conclusion is that ttyname() should verify that the path returned from
reading the symlink does indeed refer to the same device as the file
descriptor.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12167] ttyname() and ttyname_r() may return wrong value

[miklos at szeredi dot hu]

http://sourceware.org/bugzilla/show_bug.cgi?id=12167

--- Comment #1 from Miklos Szeredi <miklos at szeredi dot hu> 2010-10-28 12:51:15 UTC ---
Created attachment 5093
  --> http://sourceware.org/bugzilla/attachment.cgi?id=5093
Remove code duplication between ttyname_r and ttyname

ttyname can be implemented by allocating a static buffer and calling ttyname_r.
 This removes much code duplication.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12167] ttyname() and ttyname_r() may return wrong value

[miklos at szeredi dot hu]

http://sourceware.org/bugzilla/show_bug.cgi?id=12167

--- Comment #2 from Miklos Szeredi <miklos at szeredi dot hu> 2010-10-28 12:55:45 UTC ---
Created attachment 5094
  --> http://sourceware.org/bugzilla/attachment.cgi?id=5094
Verify in ttyname() that the symlink is valid

This patch verifies the path resulting from reading the symlink in
/proc/self/fd is valid and refer to the same inode as the file descriptor.  If
the original path is unreachable, try if the path from the global root is valid
from this context as well.  If not valid, then fall back to iterating through
the device files under /dev.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12167] ttyname() and ttyname_r() may return wrong value

[drepper.fsp at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=12167

Ulrich Drepper <drepper.fsp at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #3 from Ulrich Drepper <drepper.fsp at gmail dot com> 2010-11-03 04:26:11 UTC ---
I checked in a patch.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/12167] ttyname() and ttyname_r() may return wrong value

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=12167

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.