tty layer NULL pointer reference with 4.10

tty layer NULL pointer reference with 4.10

[Andi Kleen]

Hi,

I had a large systems with lots of cores stop responding to new ssh
requests. It turned out it crashed in the tty layer. The system
has a serial console and had some active sshs and screen

[24922.097093] BUG: unable to handle kernel paging request at 0000000000002260
[24922.111164] IP: n_tty_receive_buf_common+0x6d/0xc60
[24922.122869] PGD 0 
[24922.138890] Oops: 0000 [#1] SMP
[24922.148268] Modules linked in:
[24922.157613] CPU: 0 PID: 9947 Comm: kworker/u449:1 Not tainted 4.10.0-g70afbe1-dirty #9
[24922.189392] Workqueue: events_unbound flush_to_ldisc
[24922.200888] task: ffff88084eda8000 task.stack: ffffc9002502c000
[24922.213484] RIP: 0010:n_tty_receive_buf_common+0x6d/0xc60
[24922.225700] RSP: 0018:ffffc9002502fd30 EFLAGS: 00010297
[24922.237444] RAX: 0000000000000000 RBX: ffff88105cf72800 RCX: 00000000000000d8
[24922.251407] RDX: 0000000080000000 RSI: ffff88085f00b448 RDI: ffff88105cf728c0
[24922.265229] RBP: ffffc9002502fdc8 R08: 0000000000000001 R09: 0000000000000000
[24922.279328] R10: 000015a7c208b8ba R11: ffff88085f29d400 R12: ffff88085f00b548
[24922.293085] R13: 00000000000000d8 R14: ffff88105deb5800 R15: ffff88085de5c008
[24922.306790] FS:  0000000000000000(0000) GS:ffff88085f400000(0000) knlGS:0000000000000000
[24922.321635] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[24922.333765] CR2: 0000000000002260 CR3: 0000000001e0a000 CR4: 00000000007406f0
[24922.347455] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[24922.361097] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[24922.374599] PKRU: 55555554
[24922.383213] Call Trace:
[24922.391330]  ? account_entity_dequeue+0x65/0xa0
[24922.401747]  n_tty_receive_buf2+0x14/0x20
[24922.411513]  tty_ldisc_receive_buf+0x22/0x50
[24922.421492]  tty_port_default_receive_buf+0x45/0x60
[24922.432138]  flush_to_ldisc+0x99/0xb0
[24922.441357]  process_one_work+0x16c/0x420
[24922.450885]  worker_thread+0x4b/0x480
[24922.459976]  kthread+0x101/0x140
[24922.468481]  ? process_one_work+0x420/0x420
[24922.478078]  ? kthread_park+0x90/0x90
[24922.487495]  ret_from_fork+0x29/0x40
[24922.496259] Code: ff ff e8 57 b1 43 00 48 8d 83 00 02 00 00 c7 45 c0 00 00 00 00 48 89 45 80 48 8d 83 28 02 00 00 48 89 85 78 ff ff ff 48 8b 45 b8 <48> 8b b8 60 22 00 00 48 8b 30 8b 8b 10 01 00 00 89 f8 29 f0 f6 
[24922.527211] RIP: n_tty_receive_buf_common+0x6d/0xc60 RSP: ffffc9002502fd30
[24922.539855] CR2: 0000000000002260
[24922.559634] ---[ end trace dab97c7b5cf9c543 ]---

-Andi

Re: tty layer NULL pointer reference with 4.10

[Andi Kleen]

Andi Kleen <ak@linux.intel.com> writes:

> Hi,
>
> I had a large systems with lots of cores stop responding to new ssh
> requests. It turned out it crashed in the tty layer. The system
> has a serial console and had some active sshs and screen

Correction. This may have been a linux-next kernel, not 4.10

I'll see if I can reproduce it again.

-Andi

>
> [24922.097093] BUG: unable to handle kernel paging request at 0000000000002260
> [24922.111164] IP: n_tty_receive_buf_common+0x6d/0xc60
> [24922.122869] PGD 0 
> [24922.138890] Oops: 0000 [#1] SMP
> [24922.148268] Modules linked in:
> [24922.157613] CPU: 0 PID: 9947 Comm: kworker/u449:1 Not tainted 4.10.0-g70afbe1-dirty #9
> [24922.189392] Workqueue: events_unbound flush_to_ldisc
> [24922.200888] task: ffff88084eda8000 task.stack: ffffc9002502c000
> [24922.213484] RIP: 0010:n_tty_receive_buf_common+0x6d/0xc60
> [24922.225700] RSP: 0018:ffffc9002502fd30 EFLAGS: 00010297
> [24922.237444] RAX: 0000000000000000 RBX: ffff88105cf72800 RCX: 00000000000000d8
> [24922.251407] RDX: 0000000080000000 RSI: ffff88085f00b448 RDI: ffff88105cf728c0
> [24922.265229] RBP: ffffc9002502fdc8 R08: 0000000000000001 R09: 0000000000000000
> [24922.279328] R10: 000015a7c208b8ba R11: ffff88085f29d400 R12: ffff88085f00b548
> [24922.293085] R13: 00000000000000d8 R14: ffff88105deb5800 R15: ffff88085de5c008
> [24922.306790] FS:  0000000000000000(0000) GS:ffff88085f400000(0000) knlGS:0000000000000000
> [24922.321635] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [24922.333765] CR2: 0000000000002260 CR3: 0000000001e0a000 CR4: 00000000007406f0
> [24922.347455] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [24922.361097] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [24922.374599] PKRU: 55555554
> [24922.383213] Call Trace:
> [24922.391330]  ? account_entity_dequeue+0x65/0xa0
> [24922.401747]  n_tty_receive_buf2+0x14/0x20
> [24922.411513]  tty_ldisc_receive_buf+0x22/0x50
> [24922.421492]  tty_port_default_receive_buf+0x45/0x60
> [24922.432138]  flush_to_ldisc+0x99/0xb0
> [24922.441357]  process_one_work+0x16c/0x420
> [24922.450885]  worker_thread+0x4b/0x480
> [24922.459976]  kthread+0x101/0x140
> [24922.468481]  ? process_one_work+0x420/0x420
> [24922.478078]  ? kthread_park+0x90/0x90
> [24922.487495]  ret_from_fork+0x29/0x40
> [24922.496259] Code: ff ff e8 57 b1 43 00 48 8d 83 00 02 00 00 c7 45
> c0 00 00 00 00 48 89 45 80 48 8d 83 28 02 00 00 48 89 85 78 ff ff ff
> 48 8b 45 b8 <48> 8b b8 60 22 00 00 48 8b 30 8b 8b 10 01 00 00 89 f8 29
> f0 f6
> [24922.527211] RIP: n_tty_receive_buf_common+0x6d/0xc60 RSP: ffffc9002502fd30
> [24922.539855] CR2: 0000000000002260
> [24922.559634] ---[ end trace dab97c7b5cf9c543 ]---
>
> -Andi