linux-kernel - tty layer NULL pointer reference with 4.10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 10 Mar 2017 14:37:01 -0800
From:   Andi Kleen <ak@...ux.intel.com>
To:     peter@...leysoftware.com, gregkh@...uxfoundation.org,
        linux-kernel@...r.kernel.org
Subject: tty layer NULL pointer reference with 4.10

Hi,

I had a large systems with lots of cores stop responding to new ssh
requests. It turned out it crashed in the tty layer. The system
has a serial console and had some active sshs and screen

[24922.097093] BUG: unable to handle kernel paging request at 0000000000002260
[24922.111164] IP: n_tty_receive_buf_common+0x6d/0xc60
[24922.122869] PGD 0 
[24922.138890] Oops: 0000 [#1] SMP
[24922.148268] Modules linked in:
[24922.157613] CPU: 0 PID: 9947 Comm: kworker/u449:1 Not tainted 4.10.0-g70afbe1-dirty #9
[24922.189392] Workqueue: events_unbound flush_to_ldisc
[24922.200888] task: ffff88084eda8000 task.stack: ffffc9002502c000
[24922.213484] RIP: 0010:n_tty_receive_buf_common+0x6d/0xc60
[24922.225700] RSP: 0018:ffffc9002502fd30 EFLAGS: 00010297
[24922.237444] RAX: 0000000000000000 RBX: ffff88105cf72800 RCX: 00000000000000d8
[24922.251407] RDX: 0000000080000000 RSI: ffff88085f00b448 RDI: ffff88105cf728c0
[24922.265229] RBP: ffffc9002502fdc8 R08: 0000000000000001 R09: 0000000000000000
[24922.279328] R10: 000015a7c208b8ba R11: ffff88085f29d400 R12: ffff88085f00b548
[24922.293085] R13: 00000000000000d8 R14: ffff88105deb5800 R15: ffff88085de5c008
[24922.306790] FS:  0000000000000000(0000) GS:ffff88085f400000(0000) knlGS:0000000000000000
[24922.321635] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[24922.333765] CR2: 0000000000002260 CR3: 0000000001e0a000 CR4: 00000000007406f0
[24922.347455] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[24922.361097] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[24922.374599] PKRU: 55555554
[24922.383213] Call Trace:
[24922.391330]  ? account_entity_dequeue+0x65/0xa0
[24922.401747]  n_tty_receive_buf2+0x14/0x20
[24922.411513]  tty_ldisc_receive_buf+0x22/0x50
[24922.421492]  tty_port_default_receive_buf+0x45/0x60
[24922.432138]  flush_to_ldisc+0x99/0xb0
[24922.441357]  process_one_work+0x16c/0x420
[24922.450885]  worker_thread+0x4b/0x480
[24922.459976]  kthread+0x101/0x140
[24922.468481]  ? process_one_work+0x420/0x420
[24922.478078]  ? kthread_park+0x90/0x90
[24922.487495]  ret_from_fork+0x29/0x40
[24922.496259] Code: ff ff e8 57 b1 43 00 48 8d 83 00 02 00 00 c7 45 c0 00 00 00 00 48 89 45 80 48 8d 83 28 02 00 00 48 89 85 78 ff ff ff 48 8b 45 b8 <48> 8b b8 60 22 00 00 48 8b 30 8b 8b 10 01 00 00 89 f8 29 f0 f6 
[24922.527211] RIP: n_tty_receive_buf_common+0x6d/0xc60 RSP: ffffc9002502fd30
[24922.539855] CR2: 0000000000002260
[24922.559634] ---[ end trace dab97c7b5cf9c543 ]---

-Andi