linux-kernel - Re: Crash when specifying non-existent serial port in speakup / tty

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20201105122134.GA6084@camel2.lan>
Date:   Thu, 5 Nov 2020 13:21:34 +0100
From:   Matthias Reichl <hias@...us.com>
To:     Samuel Thibault <samuel.thibault@...-lyon.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jiri Slaby <jirislaby@...nel.org>, speakup@...ux-speakup.org,
        linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: Crash when specifying non-existent serial port in speakup /
 tty_kopen

On Wed, Nov 04, 2020 at 10:30:05PM +0100, Samuel Thibault wrote:
> Matthias Reichl, le mer. 04 nov. 2020 22:15:05 +0100, a ecrit:
> > > This looks like only a warning, did it actually crash?
> > 
> > Yes, scroll down a bit, the null pointer oops followed almost
> > immediately after that
> > 
> > [   49.979043] BUG: kernel NULL pointer dereference, address: 0000000000000090
> 
> Ah, [   50.102938]  tty_init_dev+0xb5/0x1d0
> 
> probably the trailing release_tty call that does
> 
> tty->port->itty = NULL;
> (itty is after a struct tty_bufhead + the tty pointer, that looks
> plausible).
> 
> so probably an if (tty->port) in release_tty could help?

Thanks a lot, good catch! This is indeed where the crash happens
and checking for tty->port in release_tty() prevents that.
I'll send a patch.

so long,

Hias