From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932608AbdKFR0J (ORCPT ); Mon, 6 Nov 2017 12:26:09 -0500 Received: from mail-it0-f49.google.com ([209.85.214.49]:44448 "EHLO mail-it0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932454AbdKFR0I (ORCPT ); Mon, 6 Nov 2017 12:26:08 -0500 X-Google-Smtp-Source: ABhQp+Rd8bOKhjpz7JJa6AjYToT8PpuBz/aC9LWcSwgDaMPDoGFoCUks0HxgZdVkxsX01G0dogSJUw== Date: Mon, 6 Nov 2017 09:26:04 -0800 From: Eric Biggers To: Greg KH Cc: syzbot , jslaby@suse.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: kernel panic: n_tty: init_tty Message-ID: <20171106172604.GB50562@gmail.com> References: <94eb2c0630b4161a5e055d38a2e3@google.com> <20171105103434.GC1487@kroah.com> <20171105220439.GA11631@zzz.localdomain> <20171106123309.GA14071@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171106123309.GA14071@kroah.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Nov 06, 2017 at 01:33:09PM +0100, Greg KH wrote: > > > > I just saw the same crash running syzkaller. It was preceded by a fault > > injection in tty_ldisc_get() here: > > > > ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL); > > if (ld == NULL) { > > put_ldops(ldops); > > return ERR_PTR(-ENOMEM); > > } > > > > So then it panics at: > > > > if (IS_ERR(ld)) > > panic("n_tty: init_tty"); > > > > It seems that syzkaller needs to do a better job reproducing and reporting bugs > > that are only reproducible with fault injection. But either way, this is a bug; > > panic() is not an acceptable way of handling kmalloc failure. > > That's a well-known issue, it's pretty much impossible to unwind safely > from here. If you don't have enough memory at boot to get a tty_ldisc, > you have bigger problems. > > thanks, > > greg k-h It's not just running at boot though. It's also being hit by the fuzzer at runtime, via ptmx_open(). Eric