linux-kernel - Re: tty: panic in tty_ldisc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CACT4Y+b7NwAEv434VKLKD1FPvkYDhy7+fY7A2ekJA8DxvCQR7Q@mail.gmail.com>
Date:   Sat, 4 Mar 2017 14:04:45 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     Jiri Slaby <jslaby@...e.com>, LKML <linux-kernel@...r.kernel.org>,
        Peter Hurley <peter@...leysoftware.com>,
        One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: tty: panic in tty_ldisc_restore

On Fri, Mar 3, 2017 at 8:36 AM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
> On Thu, Mar 2, 2017 at 8:37 PM, Greg Kroah-Hartman
> <gregkh@...uxfoundation.org> wrote:
>>> >> This is hurting us badly.
>>> >
>>> > Really?  How?  Are you hitting this a lot?  Why now and never before?
>>> > Are you really out of memory?
>>>
>>>
>>> This crashes our test bots a lot.
>>> Why now... I don't have exact answer. Probably a combination of fuzzer
>>> figuring out some magic sequences of syscalls and increased memory
>>> consumption due to something (again maybe due to fuzzer figuring out
>>> how to eat more memory).
>>
>> If the fuzzer is suddenly eating more memory, you should be seeing lots
>> of other problems  right?  This can't be the only thing that has issues
>> with memory allocation failures?
>
>
> I remember 2 or 3 that started happenning roughly at the same time:
> https://groups.google.com/forum/#!msg/syzkaller/tIx42qCVklk/fh0qjUboBgAJ
> https://groups.google.com/forum/#!msg/syzkaller/vp1neyeoA8A/Is8aPdrpBgAJ
> Both were quickly fixed.
> There is strong bias towards failing larger, multi-page allocations.
> so it's not that we are failing _all_ allocations in kernel code.


Mailed the patch officially.
Once I fixed it, fuzzer was able to uncover another race leading to
crashes in tty_ldisc_ref_wait:
https://groups.google.com/d/msg/syzkaller/ZTsV9qLIzGA/opsLjyoEEAAJ