rror pointer dereference at tty_ldisc_restore(). > > syzbot is reporting crashes [1] triggered by memory allocation failure at > tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON() > due to panic_on_warn == true, panic_on_warn == false will after all trigger > an OOPS by dereferencing old->ops->num if IS_ERR(old) == true. > > We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY, > N_NULL) to tty_ldisc_failto() in addition to avoiding possible error > pointer dereference. > > If someone reports kernel panic triggered by forcing all memory allocations > for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for > tty_ldisc_restore() case. > > [1] > https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7 > > Signed-off-by: Tetsuo Handa <[email protected]> > Cc: Greg Kroah-Hartman <[email protected]> > Cc: Jiri Slaby <[email protected]> > Cc: Dmitry Vyukov <[email protected]> > Cc: Johannes Weiner <[email protected]> > Cc: Alan Cox <[email protected]> > Cc: Christoph Hellwig <[email protected]> > Cc: Michal Hocko <[email protected]>
Seems reasonable to me Alan
