Commit 598c2d41 authored Apr 16, 2018 by Tetsuo Handa Committed by Greg Kroah-Hartman Apr 23, 2018

tty: Avoid possible error pointer dereference at tty_ldisc_restore().

syzbot is reporting crashes [1] triggered by memory allocation failure at
tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON()
due to panic_on_warn == true, panic_on_warn == false will after all trigger
an OOPS by dereferencing old->ops->num if IS_ERR(old) == true.

We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY,
N_NULL) to tty_ldisc_failto() in addition to avoiding possible error
pointer dereference.

If someone reports kernel panic triggered by forcing all memory allocations
for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for
tty_ldisc_restore() case.

[1] https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7



Reported-by:  <syzbot+40b7287c2dc987c48c81@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jslaby@suse.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Alan Cox <alan@llwyncelyn.cymru>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Michal Hocko <mhocko@suse.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 17a16542

drivers/tty/tty_ldisc.c

+5 −8

Original line number	Diff line number	Diff line
		@@ -527,19 +527,16 @@ static int tty_ldisc_failto(struct tty_struct *tty, int ld)
		static void tty_ldisc_restore(struct tty_struct tty, struct tty_ldisc old)
		{
		/* There is an outstanding reference here so this is safe */
		old = tty_ldisc_get(tty, old->ops->num);
		WARN_ON(IS_ERR(old));
		tty->ldisc = old;
		tty_set_termios_ldisc(tty, old->ops->num);
		if (tty_ldisc_open(tty, old) < 0) {
		tty_ldisc_put(old);
		if (tty_ldisc_failto(tty, old->ops->num) < 0) {
		const char *name = tty_name(tty);

		pr_warn("Falling back ldisc for %s.\n", name);
		/* The traditional behaviour is to fall back to N_TTY, we
		want to avoid falling back to N_NULL unless we have no
		choice to avoid the risk of breaking anything */
		if (tty_ldisc_failto(tty, N_TTY) < 0 &&
		tty_ldisc_failto(tty, N_NULL) < 0)
		panic("Couldn't open N_NULL ldisc for %s.",
		tty_name(tty));
		panic("Couldn't open N_NULL ldisc for %s.", name);
		}
		}

Admin message