linux-kernel - Re: fs, tty: WARNING in devpts_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 03 Sep 2016 11:40:14 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Peter Hurley <peter@...leysoftware.com>,
        Al Viro <viro@...iv.linux.org.uk>,
        LKML <linux-kernel@...r.kernel.org>,
        Jiri Slaby <jslaby@...e.com>,
        syzkaller <syzkaller@...glegroups.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: fs, tty: WARNING in devpts_get_priv

Dmitry Vyukov <dvyukov@...gle.com> writes:

> Hello,
>
> The following program triggers WARNING in devpts_get_priv:

Unless I am missing part of the history this problem exists on 4.6 and
up.

Yes it looks like we need to stop supporting ptys that are not
on /dev/pts.

The fix is possibly as simple as:

diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 51e0d32883ba..704c5cd548b6 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -852,8 +852,10 @@ static void __init unix98_pty_init(void)
 
        if (tty_register_driver(ptm_driver))
                panic("Couldn't register Unix98 ptm driver");
+#if 0
        if (tty_register_driver(pts_driver))
                panic("Couldn't register Unix98 pts driver");
+#endif
 
        /* Now create the /dev/ptmx special device */
        tty_default_fops(&ptmx_fops);

Or possibly we don't want to do:
	tty_set_operations(pts_driver, &pty_unix98_ops);
But instead do:
	tty_set_operations(pts_driver, &hung_up_tty_fops);

And in fs/devpts/inode force the use of pty_unix98_ops on the
inodes.

Opinions?

Eric



> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <unistd.h>
> #include <fcntl.h>
> #include <sys/stat.h>
> #include <sys/types.h>
>
> int main()
> {
>   mknodat(AT_FDCWD, "./bus", S_IFCHR, makedev(136, 49));
>   openat(AT_FDCWD, "./bus", O_RDONLY);
>   return 0;
> }
>
>
> WARNING: CPU: 0 PID: 9491 at fs/devpts/inode.c:588 devpts_get_priv+0xb9/0xe0
> CPU: 0 PID: 9491 Comm: syz-executor Not tainted 4.8.0-rc3-next-20160825+ #8
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>  ffffffff886b6fe0 ffff880033917768 ffffffff82db38d9 ffffffff021d0000
>  fffffbfff10d6dfc ffffffff8708f000 ffff880033917840 ffffffff8715e100
>  dffffc0000000000 0000000000000009 ffff880033917830 ffffffff816cf888
> Call Trace:
>  [<     inline     >] __dump_stack lib/dump_stack.c:15
>  [<ffffffff82db38d9>] dump_stack+0x12e/0x185 lib/dump_stack.c:51
>  [<ffffffff816cf888>] panic+0x1e4/0x3fb kernel/panic.c:179
>  [<ffffffff813863b4>] __warn+0x1c4/0x1e0 kernel/panic.c:542
>  [<ffffffff8138659c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
>  [<ffffffff81a2aff9>] devpts_get_priv+0xb9/0xe0 fs/devpts/inode.c:588
>  [<ffffffff83241c4f>] pts_unix98_lookup+0x3f/0x70 drivers/tty/pty.c:648
>  [<     inline     >] tty_driver_lookup_tty drivers/tty/tty_io.c:1371
>  [<     inline     >] tty_open_by_driver drivers/tty/tty_io.c:2038
>  [<ffffffff83228171>] tty_open+0x871/0x10a0 drivers/tty/tty_io.c:2108
>  [<ffffffff8187020e>] chrdev_open+0x22e/0x5c0 fs/char_dev.c:392
>  [<ffffffff8185ad25>] do_dentry_open+0x6f5/0xd30 fs/open.c:747
>  [<ffffffff8185e445>] vfs_open+0x105/0x220 fs/open.c:860
>  [<     inline     >] do_last fs/namei.c:3374
>  [<ffffffff81895909>] path_openat+0x12f9/0x2ab0 fs/namei.c:3497
>  [<ffffffff8189a7ac>] do_filp_open+0x18c/0x250 fs/namei.c:3532
>  [<ffffffff8185ed4c>] do_sys_open+0x1fc/0x440 fs/open.c:1047
>  [<     inline     >] SYSC_openat fs/open.c:1074
>  [<ffffffff8185f000>] SyS_openat+0x30/0x40 fs/open.c:1068
>  [<ffffffff86e10700>] entry_SYSCALL_64_fastpath+0x23/0xc1
>
>
> On 0f98f121e1670eaa2a2fbb675e07d6ba7f0e146f of linux-next.