Re: [PATCH] tty: Avoid possible error pointer dereference at tty_ldisc_restore().
OK. Patch is in tty.git#tty-linus as 598c2d41ff44889d. #syz fix: tty: Avoid possible error pointer dereference at tty_ldisc_restore().
Re: [PATCH] tty: Avoid possible error pointer dereference at tty_ldisc_restore().
OK. Patch is in tty.git#tty-linus as 598c2d41ff44889d. #syz fix: tty: Avoid possible error pointer dereference at tty_ldisc_restore().
Re: [PATCH] tty: Avoid possible error pointer dereference at tty_ldisc_restore().
On Mon, Apr 16, 2018 at 08:06:34PM +0900, Tetsuo Handa wrote: > Greg and Jiri, are you OK with this patch? Yes, I'll queue it up now, thanks. greg k-h
Re: [PATCH] tty: Avoid possible error pointer dereference at tty_ldisc_restore().
On Mon, Apr 16, 2018 at 08:06:34PM +0900, Tetsuo Handa wrote: > Greg and Jiri, are you OK with this patch? Yes, I'll queue it up now, thanks. greg k-h
[PATCH] tty: Avoid possible error pointer dereference at tty_ldisc_restore().
Greg and Jiri, are you OK with this patch?
Alan Cox wrote:
> > syzbot is reporting crashes [1] triggered by memory allocation failure at
> > tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON()
> > due to panic_on_warn == true, panic_on_warn == false will after all trigger
> > an OOPS by dereferencing old->ops->num if IS_ERR(old) == true.
> >
> > We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY,
> > N_NULL) to tty_ldisc_failto() in addition to avoiding possible error
> > pointer dereference.
> >
> > If someone reports kernel panic triggered by forcing all memory allocations
> > for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for
> > tty_ldisc_restore() case.
> >
> > [1]
> > https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7
> >
> > Signed-off-by: Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp>
> > Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
> > Cc: Jiri Slaby <jsl...@suse.com>
> > Cc: Dmitry Vyukov <dvyu...@google.com>
> > Cc: Johannes Weiner <han...@cmpxchg.org>
> > Cc: Alan Cox <alan@llwyncelyn.cymru>
> > Cc: Christoph Hellwig <h...@lst.de>
> > Cc: Michal Hocko <mho...@suse.com>
>
> Seems reasonable to me
>
> Alan
>
>From 023cf07f799d0efd160ec1c1617d5b8902577765 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp>
Date: Thu, 5 Apr 2018 11:27:06 +0900
Subject: [PATCH] tty: Avoid possible error pointer dereference at
tty_ldisc_restore().
syzbot is reporting crashes [1] triggered by memory allocation failure at
tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON()
due to panic_on_warn == true, panic_on_warn == false will after all trigger
an OOPS by dereferencing old->ops->num if IS_ERR(old) == true.
We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY,
N_NULL) to tty_ldisc_failto() in addition to avoiding possible error
pointer dereference.
If someone reports kernel panic triggered by forcing all memory allocations
for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for
tty_ldisc_restore() case.
[1]
https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7
Signed-off-by: Tetsuo Handa <penguin-ker...@i-love.sakura.ne.jp>
Cc: Greg Kroah-Hartman <gre...@linuxfoundation.org>
Cc: Jiri Slaby <jsl...@suse.com>
Cc: Dmitry Vyukov <dvyu...@google.com>
Cc: Johannes Weiner <han...@cmpxchg.org>
Cc: Alan Cox <alan@llwyncelyn.cymru>
Cc: Christoph Hellwig <h...@lst.de>
Cc: Michal Hocko <mho...@suse.com>
---
drivers/tty/tty_ldisc.c | 13 +
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 08ddb2c..de007e1 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -527,19 +527,16 @@ static int tty_ldisc_failto(struct tty_struct *tty, int
ld)
static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
{
/* There is an outstanding reference here so this is safe */
- old = tty_ldisc_get(tty, old->ops->num);
- WARN_ON(IS_ERR(old));
- tty->ldisc = old;
- tty_set_termios_ldisc(tty, old->ops->num);
- if (tty_ldisc_open(tty, old) < 0) {
- tty_ldisc_put(old);
+ if (tty_ldisc_failto(tty, old->ops->num) < 0) {
+ const char *name = tty_name(tty);
+
+ pr_warn("Falling back ldisc for %s.\n", name);
/* The traditional behaviour is to fall back to N_TTY, we
want to avoid falling back to N_NULL unless we have no
choice to avoid the risk of breaking anything */
if (tty_ldisc_failto(tty, N_TTY) < 0 &&
tty_ldisc_failto(tty, N_NULL) < 0)
- panic("Couldn't open N_NULL ldisc for %s.",
- tty_name(tty));
+ panic("Couldn't open N_NULL ldisc for %s.", name);
}
}
--
1.8.3.1
[PATCH] tty: Avoid possible error pointer dereference at tty_ldisc_restore().
Greg and Jiri, are you OK with this patch?
Alan Cox wrote:
> > syzbot is reporting crashes [1] triggered by memory allocation failure at
> > tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON()
> > due to panic_on_warn == true, panic_on_warn == false will after all trigger
> > an OOPS by dereferencing old->ops->num if IS_ERR(old) == true.
> >
> > We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY,
> > N_NULL) to tty_ldisc_failto() in addition to avoiding possible error
> > pointer dereference.
> >
> > If someone reports kernel panic triggered by forcing all memory allocations
> > for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for
> > tty_ldisc_restore() case.
> >
> > [1]
> > https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7
> >
> > Signed-off-by: Tetsuo Handa
> > Cc: Greg Kroah-Hartman
> > Cc: Jiri Slaby
> > Cc: Dmitry Vyukov
> > Cc: Johannes Weiner
> > Cc: Alan Cox
> > Cc: Christoph Hellwig
> > Cc: Michal Hocko
>
> Seems reasonable to me
>
> Alan
>
>From 023cf07f799d0efd160ec1c1617d5b8902577765 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa
Date: Thu, 5 Apr 2018 11:27:06 +0900
Subject: [PATCH] tty: Avoid possible error pointer dereference at
tty_ldisc_restore().
syzbot is reporting crashes [1] triggered by memory allocation failure at
tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON()
due to panic_on_warn == true, panic_on_warn == false will after all trigger
an OOPS by dereferencing old->ops->num if IS_ERR(old) == true.
We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY,
N_NULL) to tty_ldisc_failto() in addition to avoiding possible error
pointer dereference.
If someone reports kernel panic triggered by forcing all memory allocations
for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for
tty_ldisc_restore() case.
[1]
https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7
Signed-off-by: Tetsuo Handa
Cc: Greg Kroah-Hartman
Cc: Jiri Slaby
Cc: Dmitry Vyukov
Cc: Johannes Weiner
Cc: Alan Cox
Cc: Christoph Hellwig
Cc: Michal Hocko
---
drivers/tty/tty_ldisc.c | 13 +
1 file changed, 5 insertions(+), 8 deletions(-)
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 08ddb2c..de007e1 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -527,19 +527,16 @@ static int tty_ldisc_failto(struct tty_struct *tty, int
ld)
static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
{
/* There is an outstanding reference here so this is safe */
- old = tty_ldisc_get(tty, old->ops->num);
- WARN_ON(IS_ERR(old));
- tty->ldisc = old;
- tty_set_termios_ldisc(tty, old->ops->num);
- if (tty_ldisc_open(tty, old) < 0) {
- tty_ldisc_put(old);
+ if (tty_ldisc_failto(tty, old->ops->num) < 0) {
+ const char *name = tty_name(tty);
+
+ pr_warn("Falling back ldisc for %s.\n", name);
/* The traditional behaviour is to fall back to N_TTY, we
want to avoid falling back to N_NULL unless we have no
choice to avoid the risk of breaking anything */
if (tty_ldisc_failto(tty, N_TTY) < 0 &&
tty_ldisc_failto(tty, N_NULL) < 0)
- panic("Couldn't open N_NULL ldisc for %s.",
- tty_name(tty));
+ panic("Couldn't open N_NULL ldisc for %s.", name);
}
}
--
1.8.3.1
