From: Alan Cox <alan@llwyncelyn.cymru>
To: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Greg KH <gregkh@linuxfoundation.org>,
jslaby@suse.com,
syzbot
<bot+1a77aeddeaf63317949b59c3df98f139a1ca34f9@syzkaller.appspotmail.com>,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
Dmitry Vyukov <dvyukov@google.com>,
Johannes Weiner <hannes@cmpxchg.org>,
Christoph Hellwig <hch@lst.de>, Michal Hocko <mhocko@suse.com>
Subject: Re: WARNING in tty_set_ldisc
Date: Thu, 5 Apr 2018 14:25:03 +0100 [thread overview]
Message-ID: <20180405142503.627552ca@alans-desktop> (raw)
In-Reply-To: <2e8fd7a6-6841-d660-8e1c-17b5a07618fa@I-love.SAKURA.ne.jp>
rror pointer dereference at tty_ldisc_restore().
>
> syzbot is reporting crashes [1] triggered by memory allocation failure at
> tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON()
> due to panic_on_warn == true, panic_on_warn == false will after all trigger
> an OOPS by dereferencing old->ops->num if IS_ERR(old) == true.
>
> We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY,
> N_NULL) to tty_ldisc_failto() in addition to avoiding possible error
> pointer dereference.
>
> If someone reports kernel panic triggered by forcing all memory allocations
> for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for
> tty_ldisc_restore() case.
>
> [1] https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7
>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Jiri Slaby <jslaby@suse.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Johannes Weiner <hannes@cmpxchg.org>
> Cc: Alan Cox <alan@llwyncelyn.cymru>
> Cc: Christoph Hellwig <hch@lst.de>
> Cc: Michal Hocko <mhocko@suse.com>
Seems reasonable to me
Alan
next prev parent reply other threads:[~2018-04-05 13:25 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <001a1141f0c87da52c055d385a4d@google.com>
2017-11-05 10:34 ` WARNING in tty_set_ldisc Greg KH
2017-11-06 12:12 ` Dmitry Vyukov
2018-04-05 10:46 ` Tetsuo Handa
2018-04-05 13:25 ` Alan Cox [this message]
2018-04-16 11:06 ` [PATCH] tty: Avoid possible error pointer dereference at tty_ldisc_restore() Tetsuo Handa
2018-04-23 8:58 ` Greg KH
2018-04-25 11:08 ` Tetsuo Handa
2017-12-22 21:20 ` WARNING in tty_set_ldisc syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180405142503.627552ca@alans-desktop \
--to=alan@llwyncelyn.cymru \
--cc=bot+1a77aeddeaf63317949b59c3df98f139a1ca34f9@syzkaller.appspotmail.com \
--cc=dvyukov@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=hannes@cmpxchg.org \
--cc=hch@lst.de \
--cc=jslaby@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mhocko@suse.com \
--cc=penguin-kernel@I-love.SAKURA.ne.jp \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.