linux-kernel - Re: kernel BUG and freeze on cat /proc/tty/driver/serial

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJJYPdmmaDuW-yhLQbGj9ihfiJOp5K_C_Vn6dCTzmr0A_gaKjg@mail.gmail.com>
Date:	Fri, 2 Sep 2011 20:23:00 +0200
From:	Zdenek Kabelac <zdenek.kabelac@...il.com>
To:	Chuck Ebbert <cebbert@...hat.com>
Cc:	"Mario 'BitKoenig' Holbe" <Mario.Holbe@...ilmenau.de>,
	linux-kernel@...r.kernel.org
Subject: Re: kernel BUG and freeze on cat /proc/tty/driver/serial

2011/3/10 Chuck Ebbert <cebbert@...hat.com>:
> On Wed, 16 Feb 2011 17:17:28 +0100
> "Mario 'BitKoenig' Holbe" <Mario.Holbe@...Ilmenau.DE> wrote:
>
>> reading /proc/tty/driver/serial leads to a NULL pointer dereference
>> BUG and freeze on a serial-console enabled 2.6.35.{4,10,11} and
>> 2.6.37. 2.6.32.28 does fine without BUG and freeze.
>>
>> Fresh boot 2.6.35.11 into emergency...
>> # cat /proc/tty/driver/serial
>> [   73.199568] BUG: unable to handle kernel NULL pointer dereference
>> at 00000099 [   73.227373] IP: [<c11a8969>] tty_ldisc_try+0x10/0x35
>
> The oops is here, in uart_handle_dcd_change() in serial_core.h:
>
>        struct tty_ldisc *ld = tty_ldisc_ref(port->tty);
>
> (port->tty is NULL)
>
> Called from check_modem_status() in 8250.c:
>
>                if (status & UART_MSR_DDCD)
>                        uart_handle_dcd_change(&up->port, status & UART_MSR_DCD);
>
> So apparently the port has no tty, until you run "setserial -g", or else
> that somehow makes the DCD status appear unchanged later when reading
> /proc/tty/driver/serial.


Just noticed the same freeze of my box with 3.1.0-rc4 - thought with
just a little bit different stack trace
(as I've taken only camera snap - here is just list of function) -
happened right after resume.

tty_ldisc_try   NULL pointer dereference

tty_ldisc_ref
check_modem_status
serial8250_get_mctrl
uart_proc_show
? seq_read
? kmem_cache_alloc_trace
? seq_read
seq_read
? sub_preempt_count
? seq_lseek
proc_reg_read
vfs_read
sys_read
system_call_fastpath


Zdenek
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/