linux-kernel - fs, tty: WARNING in devpts_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+azMw7QE1hF=aUhsx2-Fo9v0W3QVmgRjOGvci6angyxMA@mail.gmail.com>
Date:   Sat, 3 Sep 2016 11:51:08 +0200
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     "Eric W. Biederman" <ebiederm@...ssion.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Peter Hurley <peter@...leysoftware.com>,
        Al Viro <viro@...iv.linux.org.uk>,
        LKML <linux-kernel@...r.kernel.org>, Jiri Slaby <jslaby@...e.com>
Subject: fs, tty: WARNING in devpts_get_priv

Hello,

The following program triggers WARNING in devpts_get_priv:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>

int main()
{
  mknodat(AT_FDCWD, "./bus", S_IFCHR, makedev(136, 49));
  openat(AT_FDCWD, "./bus", O_RDONLY);
  return 0;
}


WARNING: CPU: 0 PID: 9491 at fs/devpts/inode.c:588 devpts_get_priv+0xb9/0xe0
CPU: 0 PID: 9491 Comm: syz-executor Not tainted 4.8.0-rc3-next-20160825+ #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffffffff886b6fe0 ffff880033917768 ffffffff82db38d9 ffffffff021d0000
 fffffbfff10d6dfc ffffffff8708f000 ffff880033917840 ffffffff8715e100
 dffffc0000000000 0000000000000009 ffff880033917830 ffffffff816cf888
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82db38d9>] dump_stack+0x12e/0x185 lib/dump_stack.c:51
 [<ffffffff816cf888>] panic+0x1e4/0x3fb kernel/panic.c:179
 [<ffffffff813863b4>] __warn+0x1c4/0x1e0 kernel/panic.c:542
 [<ffffffff8138659c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
 [<ffffffff81a2aff9>] devpts_get_priv+0xb9/0xe0 fs/devpts/inode.c:588
 [<ffffffff83241c4f>] pts_unix98_lookup+0x3f/0x70 drivers/tty/pty.c:648
 [<     inline     >] tty_driver_lookup_tty drivers/tty/tty_io.c:1371
 [<     inline     >] tty_open_by_driver drivers/tty/tty_io.c:2038
 [<ffffffff83228171>] tty_open+0x871/0x10a0 drivers/tty/tty_io.c:2108
 [<ffffffff8187020e>] chrdev_open+0x22e/0x5c0 fs/char_dev.c:392
 [<ffffffff8185ad25>] do_dentry_open+0x6f5/0xd30 fs/open.c:747
 [<ffffffff8185e445>] vfs_open+0x105/0x220 fs/open.c:860
 [<     inline     >] do_last fs/namei.c:3374
 [<ffffffff81895909>] path_openat+0x12f9/0x2ab0 fs/namei.c:3497
 [<ffffffff8189a7ac>] do_filp_open+0x18c/0x250 fs/namei.c:3532
 [<ffffffff8185ed4c>] do_sys_open+0x1fc/0x440 fs/open.c:1047
 [<     inline     >] SYSC_openat fs/open.c:1074
 [<ffffffff8185f000>] SyS_openat+0x30/0x40 fs/open.c:1068
 [<ffffffff86e10700>] entry_SYSCALL_64_fastpath+0x23/0xc1


On 0f98f121e1670eaa2a2fbb675e07d6ba7f0e146f of linux-next.