Greg and Jiri, are you OK with this patch? Alan Cox wrote: > > syzbot is reporting crashes [1] triggered by memory allocation failure at > > tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON() > > due to panic_on_warn == true, panic_on_warn == false will after all trigger > > an OOPS by dereferencing old->ops->num if IS_ERR(old) == true. > > > > We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY, > > N_NULL) to tty_ldisc_failto() in addition to avoiding possible error > > pointer dereference. > > > > If someone reports kernel panic triggered by forcing all memory allocations > > for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for > > tty_ldisc_restore() case. > > > > [1] > > https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7 > > > > Signed-off-by: Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp> > > Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org> > > Cc: Jiri Slaby <jsl...@suse.com> > > Cc: Dmitry Vyukov <dvyu...@google.com> > > Cc: Johannes Weiner <han...@cmpxchg.org> > > Cc: Alan Cox <alan@llwyncelyn.cymru> > > Cc: Christoph Hellwig <h...@lst.de> > > Cc: Michal Hocko <mho...@suse.com> > > Seems reasonable to me > > Alan >
>From 023cf07f799d0efd160ec1c1617d5b8902577765 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp> Date: Thu, 5 Apr 2018 11:27:06 +0900 Subject: [PATCH] tty: Avoid possible error pointer dereference at tty_ldisc_restore(). syzbot is reporting crashes [1] triggered by memory allocation failure at tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON() due to panic_on_warn == true, panic_on_warn == false will after all trigger an OOPS by dereferencing old->ops->num if IS_ERR(old) == true. We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY, N_NULL) to tty_ldisc_failto() in addition to avoiding possible error pointer dereference. If someone reports kernel panic triggered by forcing all memory allocations for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for tty_ldisc_restore() case. [1] https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7 Signed-off-by: Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp> Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org> Cc: Jiri Slaby <jsl...@suse.com> Cc: Dmitry Vyukov <dvyu...@google.com> Cc: Johannes Weiner <han...@cmpxchg.org> Cc: Alan Cox <alan@llwyncelyn.cymru> Cc: Christoph Hellwig <h...@lst.de> Cc: Michal Hocko <mho...@suse.com> --- drivers/tty/tty_ldisc.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c index 08ddb2c..de007e1 100644 --- a/drivers/tty/tty_ldisc.c +++ b/drivers/tty/tty_ldisc.c @@ -527,19 +527,16 @@ static int tty_ldisc_failto(struct tty_struct *tty, int ld) static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old) { /* There is an outstanding reference here so this is safe */ - old = tty_ldisc_get(tty, old->ops->num); - WARN_ON(IS_ERR(old)); - tty->ldisc = old; - tty_set_termios_ldisc(tty, old->ops->num); - if (tty_ldisc_open(tty, old) < 0) { - tty_ldisc_put(old); + if (tty_ldisc_failto(tty, old->ops->num) < 0) { + const char *name = tty_name(tty); + + pr_warn("Falling back ldisc for %s.\n", name); /* The traditional behaviour is to fall back to N_TTY, we want to avoid falling back to N_NULL unless we have no choice to avoid the risk of breaking anything */ if (tty_ldisc_failto(tty, N_TTY) < 0 && tty_ldisc_failto(tty, N_NULL) < 0) - panic("Couldn't open N_NULL ldisc for %s.", - tty_name(tty)); + panic("Couldn't open N_NULL ldisc for %s.", name); } } -- 1.8.3.1
