linux-kernel - Re: [lkp] [tty] 761ed4a945: BUG: unable to handle kernel NULL pointer dereference at 000000000000046c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 9 Sep 2016 23:00:11 +0100
From:   One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
To:     Rob Herring <robh@...nel.org>
Cc:     kernel test robot <xiaolong.ye@...el.com>,
        Alan Cox <alan@...ux.intel.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Peter Hurley <peter@...leysoftware.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>, LKP ML <lkp@...org>
Subject: Re: [lkp] [tty] 761ed4a945: BUG: unable to handle kernel NULL
 pointer dereference at 000000000000046c

On Fri, 9 Sep 2016 11:40:47 -0500
Rob Herring <robh@...nel.org> wrote:

> On Wed, Sep 7, 2016 at 3:47 PM, Rob Herring <robh@...nel.org> wrote:
> > On Tue, Sep 6, 2016 at 1:33 AM, kernel test robot <xiaolong.ye@...el.com> wrote:  
> >>
> >> FYI, we noticed the following commit:
> >>
> >> https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> >> commit 761ed4a94582ab291aa24dcbea4e01e8936488c8 ("tty: serial_core: convert uart_close to use tty_port_close")
> >>
> >> in testcase: boot
> >>
> >> on test machine: qemu-system-x86_64 -enable-kvm -cpu host -smp 2 -m 4G  
> >
> > Is the rootfs used in this test available to help me reproduce?  
> 
> I reproduced this now. There's a couple of ways to fix this, so I'm
> looking for some advice. The problem is tty_port->ops.shutdown()
> doesn't get called for a port marked as a console. So interrupts can
> still fire and then uart_tx_stopped() called after tty_struct becomes
> NULL. I can add a NULL check in uart_tx_stopped to fix that. There are
> possibly other spots that need a similar fix. That's going to be
> needed anyway as I remove dependencies on tty_struct. The 2nd
> possibility is just not marking the tty_port as a console. That seems
> wrong, but is what we had before this change. A third option is move
> the console handling in tty_port_shutdown into the tty_port drivers.
> That seems the wrong direction too. Thoughts?

The uart layer handles console itself so I'd suggest the quick fix for
now. The other reason for that is that if we can open/close/write to a
tty port without a tty most of the existing magic crap for consoles goes
away because a console can just open and close the tty port directly.

Alan