linux-kernel - Re: WARNING in tty_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180405142503.627552ca@alans-desktop>
Date:   Thu, 5 Apr 2018 14:25:03 +0100
From:   Alan Cox <alan@...yncelyn.cymru>
To:     Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Cc:     Greg KH <gregkh@...uxfoundation.org>, jslaby@...e.com,
        syzbot 
        <bot+1a77aeddeaf63317949b59c3df98f139a1ca34f9@...kaller.appspotmail.com>,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Johannes Weiner <hannes@...xchg.org>,
        Christoph Hellwig <hch@....de>, Michal Hocko <mhocko@...e.com>
Subject: Re: WARNING in tty_set_ldisc

rror pointer dereference at tty_ldisc_restore().
> 
> syzbot is reporting crashes [1] triggered by memory allocation failure at
> tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON()
> due to panic_on_warn == true, panic_on_warn == false will after all trigger
> an OOPS by dereferencing old->ops->num if IS_ERR(old) == true.
> 
> We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY,
> N_NULL) to tty_ldisc_failto() in addition to avoiding possible error
> pointer dereference.
> 
> If someone reports kernel panic triggered by forcing all memory allocations
> for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for
> tty_ldisc_restore() case.
> 
> [1] https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7
> 
> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Cc: Jiri Slaby <jslaby@...e.com>
> Cc: Dmitry Vyukov <dvyukov@...gle.com>
> Cc: Johannes Weiner <hannes@...xchg.org>
> Cc: Alan Cox <alan@...yncelyn.cymru>
> Cc: Christoph Hellwig <hch@....de>
> Cc: Michal Hocko <mhocko@...e.com>

Seems reasonable to me

Alan