Messages in this thread | | | Date | Thu, 5 Apr 2018 14:25:03 +0100 | From | Alan Cox <> | Subject | Re: WARNING in tty_set_ldisc |
| |
rror pointer dereference at tty_ldisc_restore(). > > syzbot is reporting crashes [1] triggered by memory allocation failure at > tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON() > due to panic_on_warn == true, panic_on_warn == false will after all trigger > an OOPS by dereferencing old->ops->num if IS_ERR(old) == true. > > We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY, > N_NULL) to tty_ldisc_failto() in addition to avoiding possible error > pointer dereference. > > If someone reports kernel panic triggered by forcing all memory allocations > for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for > tty_ldisc_restore() case. > > [1] https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7 > > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > Cc: Jiri Slaby <jslaby@suse.com> > Cc: Dmitry Vyukov <dvyukov@google.com> > Cc: Johannes Weiner <hannes@cmpxchg.org> > Cc: Alan Cox <alan@llwyncelyn.cymru> > Cc: Christoph Hellwig <hch@lst.de> > Cc: Michal Hocko <mhocko@suse.com>
Seems reasonable to me
Alan
| |