linux-kernel - Re: linux-next: Tree for September 3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 4 Sep 2008 00:15:58 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Stephen Rothwell <sfr@...b.auug.org.au>
Cc:	linux-next@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>,
	Yinghai Lu <yhlu.kernel@...il.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	David Woodhouse <dwmw2@...radead.org>,
	Alan Cox <alan@...rguk.ukuu.org.uk>
Subject: Re: linux-next: Tree for September 3

On Wed, 3 Sep 2008 23:01:29 -0700 Andrew Morton <akpm@...ux-foundation.org> wrote:

> I'll see if I cen reproduce the bug I'm
> actually tring to find with E100=n.

OK, this regression[*] bisects down to

commit b689ad2b010f09626a6158e1213a075a1aa9f299
Author: Alan Cox <alan@...hat.com>
Date:   Wed Sep 3 10:12:18 2008 +1000

    tty-kref-get-current-tty
    
    We now return a kref covered tty reference. That ensures the tty structure
    doesn't go away when you have a return from get_current_tty. This is not
    enough to protect you from most of the resources being freed behind your
    back - yet.
    

This got a bit ugly, because tty-kref-get-current-tty fixes a pile of
compilation errors which were introduced in the innediately preceding
patch (tty-kref-modcount, I think).  I roughly fixed those up by hand:

--- a/drivers/char/tty_io.c~b
+++ a/drivers/char/tty_io.c
@@ -1283,7 +1283,7 @@ static int init_dev(struct tty_driver *d
 		o_tty = alloc_tty_struct();
 		if (!o_tty)
 			goto free_mem_out;
-		if (!try_module_get(driver->other)) {
+		if (!try_module_get(driver->owner)) {
 			/* This cannot in fact currently happen */
 			free_tty_struct(o_tty);
 			o_tty = NULL;
@@ -1408,7 +1408,7 @@ end_init:
 free_mem_out:
 	kfree(o_tp);
 	if (o_tty) {
-		module_put(o_tty->driver);
+		module_put(o_tty->driver->owner);
 		free_tty_struct(o_tty);
 	}
 	kfree(ltp);
@@ -1469,7 +1469,7 @@ static void release_one_tty(struct kref 
 	tty->magic = 0;
 	/* FIXME: locking on tty->driver->refcount */
 	tty->driver->refcount--;
-	module_put(driver->owner);
+	module_put(tty->driver->owner);
 
 	file_list_lock();
 	list_del_init(&tty->tty_files);
_


I cannot find any of these patches on a mailing list.

I cannot revert tty-kref-get-current-tty and I can't immediately spot
the bug in it.

I could revert the whole tty tree, but I'd prefer that you do it,
please.  I've been trying for two days to get a -mm out, but I'm
building on a foundation of straw :(


[*] symptoms: there are no login prompts appearing on the VT consoles. 
sshd works OK (will it did, but I had to disable the net driver due to
networking bisect breakage).

config: http://userweb.kernel.org/~akpm/config-sony.txt
dmesg: http://userweb.kernel.org/~akpm/dmesg-sony-2.txt
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/