kernel panic: Couldn't open N_TTY ldisc for ptm0 --- error -12.

kernel panic: Couldn't open N_TTY ldisc for ptm0 --- error -12.

[Jeremy Huang]

Hello,

Syzkaller fuzzer started crashing kernel with the following panics:

R13: 0000000000000000 R14: 00007ff12df759c0 R15: 00007ff12df75700
Kernel panic - not syncing: Couldn't open N_TTY ldisc for ptm0 --- error -12.
CPU: 1 PID: 32595 Comm: syz-executor0 Not tainted 4.11.0-rc1-next-20170308 #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x83/0xba lib/dump_stack.c:52
 panic+0x1af/0x388 kernel/panic.c:180
 tty_ldisc_restore drivers/tty/tty_ldisc.c:520 [inline]
 tty_set_ldisc+0x6f2/0x8a0 drivers/tty/tty_ldisc.c:579
 tiocsetd drivers/tty/tty_io.c:2682 [inline]
 tty_ioctl+0xae5/0x1ff0 drivers/tty/tty_io.c:2939
 vfs_ioctl fs/ioctl.c:45 [inline]
 do_vfs_ioctl+0x18c/0xf80 fs/ioctl.c:685
 SYSC_ioctl fs/ioctl.c:700 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
 entry_SYSCALL_64_fastpath+0x1a/0xa5
RIP: 0033:0x445849
RSP: 002b:00007ff12df74b58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ff12df75700 RCX: 0000000000445849
RDX: 0000000020006ffc RSI: 0000000000005423 RDI: 0000000000000005
RBP: 00007ffd64d68360 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff12df759c0 R15: 00007ff12df75700
Dumping ftrace buffer:
   (ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..

# {Threaded:true Collide:true Repeat:false Procs:1 Sandbox:setuid Repro:false}
mmap(&(0x7f0000000000/0x7000)=nil, (0x7000), 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = openat$ptmx(0xffffffffffffff9c,
&(0x7f0000000000)="2f6465762f70746d7800", 0x0, 0x0)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000007000-0x4)=0x2)
readv(r0, &(0x7f0000002000)=[{&(0x7f0000016000)="", 0x0},
{&(0x7f0000016000)="", 0x0}, {&(0x7f0000016000)="", 0x0},
{&(0x7f0000017000-0xe6)="", 0x0},
{&(0x7f0000017000-0xf5)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
0xf5}], 0x5)

I could crash the kernel over four times as following command:

 ./syz-execprog -executor ./syz-executor -cover=0 -repeat=0 -procs=1 repro.prog

Re: kernel panic: Couldn't open N_TTY ldisc for ptm0 --- error -12.

[Dmitry Vyukov]

Check this thread:
https://groups.google.com/forum/#!msg/syzkaller/ty5IhaYWVp8/aTN_hZ8qBQAJ

On Thu, Mar 9, 2017 at 11:24 AM, Jeremy Huang <jeremyhcw@gmail.com> wrote:
> Hello,
>
> Syzkaller fuzzer started crashing kernel with the following panics:
>
> R13: 0000000000000000 R14: 00007ff12df759c0 R15: 00007ff12df75700
> Kernel panic - not syncing: Couldn't open N_TTY ldisc for ptm0 --- error -12.
> CPU: 1 PID: 32595 Comm: syz-executor0 Not tainted 4.11.0-rc1-next-20170308 #2
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> Call Trace:
>  __dump_stack lib/dump_stack.c:16 [inline]
>  dump_stack+0x83/0xba lib/dump_stack.c:52
>  panic+0x1af/0x388 kernel/panic.c:180
>  tty_ldisc_restore drivers/tty/tty_ldisc.c:520 [inline]
>  tty_set_ldisc+0x6f2/0x8a0 drivers/tty/tty_ldisc.c:579
>  tiocsetd drivers/tty/tty_io.c:2682 [inline]
>  tty_ioctl+0xae5/0x1ff0 drivers/tty/tty_io.c:2939
>  vfs_ioctl fs/ioctl.c:45 [inline]
>  do_vfs_ioctl+0x18c/0xf80 fs/ioctl.c:685
>  SYSC_ioctl fs/ioctl.c:700 [inline]
>  SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691
>  entry_SYSCALL_64_fastpath+0x1a/0xa5
> RIP: 0033:0x445849
> RSP: 002b:00007ff12df74b58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007ff12df75700 RCX: 0000000000445849
> RDX: 0000000020006ffc RSI: 0000000000005423 RDI: 0000000000000005
> RBP: 00007ffd64d68360 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000212 R12: 0000000000000000
> R13: 0000000000000000 R14: 00007ff12df759c0 R15: 00007ff12df75700
> Dumping ftrace buffer:
>    (ftrace buffer empty)
> Kernel Offset: disabled
> Rebooting in 86400 seconds..
>
> # {Threaded:true Collide:true Repeat:false Procs:1 Sandbox:setuid Repro:false}
> mmap(&(0x7f0000000000/0x7000)=nil, (0x7000), 0x3, 0x32, 0xffffffffffffffff, 0x0)
> r0 = openat$ptmx(0xffffffffffffff9c,
> &(0x7f0000000000)="2f6465762f70746d7800", 0x0, 0x0)
> ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000007000-0x4)=0x2)
> readv(r0, &(0x7f0000002000)=[{&(0x7f0000016000)="", 0x0},
> {&(0x7f0000016000)="", 0x0}, {&(0x7f0000016000)="", 0x0},
> {&(0x7f0000017000-0xe6)="", 0x0},
> {&(0x7f0000017000-0xf5)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
> 0xf5}], 0x5)
>
> I could crash the kernel over four times as following command:
>
>  ./syz-execprog -executor ./syz-executor -cover=0 -repeat=0 -procs=1 repro.prog