lkml.org 
[lkml]   [2018]   [Apr]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: WARNING in tty_set_ldisc
rror pointer dereference at tty_ldisc_restore().
>
> syzbot is reporting crashes [1] triggered by memory allocation failure at
> tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON()
> due to panic_on_warn == true, panic_on_warn == false will after all trigger
> an OOPS by dereferencing old->ops->num if IS_ERR(old) == true.
>
> We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY,
> N_NULL) to tty_ldisc_failto() in addition to avoiding possible error
> pointer dereference.
>
> If someone reports kernel panic triggered by forcing all memory allocations
> for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for
> tty_ldisc_restore() case.
>
> [1] https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7
>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Jiri Slaby <jslaby@suse.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Johannes Weiner <hannes@cmpxchg.org>
> Cc: Alan Cox <alan@llwyncelyn.cymru>
> Cc: Christoph Hellwig <hch@lst.de>
> Cc: Michal Hocko <mhocko@suse.com>

Seems reasonable to me

Alan

\
 
 \ /
  Last update: 2018-04-05 15:26    [W:0.063 / U:0.224 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site