linux-kernel - Re: BUG: tty_insert_flip_string_fixed_flag, unable to handle kernel NULL pointer dereference at 00000004

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 6 Jun 2012 00:27:25 +0100
From:	Alan Cox <alan@...rguk.ukuu.org.uk>
To:	Denys Fedoryshchenko <denys@...p.net.lb>
Cc:	<gregkh@...uxfoundation.org>, <linux-kernel@...r.kernel.org>
Subject: Re: BUG: tty_insert_flip_string_fixed_flag, unable to handle kernel
 NULL pointer dereference at 00000004

> [ 5350.556089]  [<c027adc4>] pty_write+0x2c/0x4c
> [ 5350.556089]  [<c0277a44>] n_tty_write+0x24e/0x2d6
> [ 5350.556089]  [<c0144a2b>] ? try_to_wake_up+0x18c/0x18c

Basically the other end hung up just as it went to write.

It's a known race. In the current codebase it's very hard to fix up nicely
as we have to drop tty_lock during a pty close or we deadlock. It's very
hard to hit but your environment sounds rather like my test case for it !

It's one of a series of related bugs (another in n_gsm) that we can't fix
elegantly until the tty locking is fixed - which has been pushed from 3.5
hopefully to 3.6 assuming we can fix a couple of other locking problems
first.

What may reduce it a lot is to change pty_write to do

	struct tty_struct *to = tty->link;

	if (tty->stopped)
		return 0;

	if (to == NULL)
		return -ENODEV;
	to = tty_kref_get(to);
	if (tty->link == NULL) {
		tty_kref_put(to);
		return -ENODEV;
	}
	if (c > 0) {
		...
	}
	tty_kref_put(to);
	return c;
}

Thats a pretty ugly bandaid but I'd be interested to know if it helps, as
that would verify the race you are hitting is the one I think it is.

Alan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/