linux-kernel - Re: [lkp] [tty] 761ed4a945: BUG: unable to handle kernel NULL pointer dereference at 000000000000046c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 9 Sep 2016 11:40:47 -0500
From:   Rob Herring <robh@...nel.org>
To:     kernel test robot <xiaolong.ye@...el.com>,
        Alan Cox <alan@...ux.intel.com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Peter Hurley <peter@...leysoftware.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>, LKP ML <lkp@...org>
Subject: Re: [lkp] [tty] 761ed4a945: BUG: unable to handle kernel NULL pointer
 dereference at 000000000000046c

On Wed, Sep 7, 2016 at 3:47 PM, Rob Herring <robh@...nel.org> wrote:
> On Tue, Sep 6, 2016 at 1:33 AM, kernel test robot <xiaolong.ye@...el.com> wrote:
>>
>> FYI, we noticed the following commit:
>>
>> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
>> commit 761ed4a94582ab291aa24dcbea4e01e8936488c8 ("tty: serial_core: convert uart_close to use tty_port_close")
>>
>> in testcase: boot
>>
>> on test machine: qemu-system-x86_64 -enable-kvm -cpu host -smp 2 -m 4G
>
> Is the rootfs used in this test available to help me reproduce?

I reproduced this now. There's a couple of ways to fix this, so I'm
looking for some advice. The problem is tty_port->ops.shutdown()
doesn't get called for a port marked as a console. So interrupts can
still fire and then uart_tx_stopped() called after tty_struct becomes
NULL. I can add a NULL check in uart_tx_stopped to fix that. There are
possibly other spots that need a similar fix. That's going to be
needed anyway as I remove dependencies on tty_struct. The 2nd
possibility is just not marking the tty_port as a console. That seems
wrong, but is what we had before this change. A third option is move
the console handling in tty_port_shutdown into the tty_port drivers.
That seems the wrong direction too. Thoughts?

Rob