Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 5 Apr 2018 14:25:03 +0100
From:   Alan Cox <alan@llwyncelyn.cymru>
To:     Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc:     Greg KH <gregkh@linuxfoundation.org>, jslaby@suse.com,
        syzbot 
        <bot+1a77aeddeaf63317949b59c3df98f139a1ca34f9@syzkaller.appspotmail.com>,
        linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
        Dmitry Vyukov <dvyukov@google.com>,
        Johannes Weiner <hannes@cmpxchg.org>,
        Christoph Hellwig <hch@lst.de>, Michal Hocko <mhocko@suse.com>
Subject: Re: WARNING in tty_set_ldisc
Message-ID: <20180405142503.627552ca@alans-desktop>
In-Reply-To: <2e8fd7a6-6841-d660-8e1c-17b5a07618fa@I-love.SAKURA.ne.jp>
References: <001a1141f0c87da52c055d385a4d@google.com>
        <20171105103404.GB1487@kroah.com>
        <2e8fd7a6-6841-d660-8e1c-17b5a07618fa@I-love.SAKURA.ne.jp>
Organization: is over-rated
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

rror pointer dereference at tty_ldisc_restore().
> 
> syzbot is reporting crashes [1] triggered by memory allocation failure at
> tty_ldisc_get() from tty_ldisc_restore(). While syzbot stops at WARN_ON()
> due to panic_on_warn == true, panic_on_warn == false will after all trigger
> an OOPS by dereferencing old->ops->num if IS_ERR(old) == true.
> 
> We can simplify tty_ldisc_restore() as three calls (old->ops->num, N_TTY,
> N_NULL) to tty_ldisc_failto() in addition to avoiding possible error
> pointer dereference.
> 
> If someone reports kernel panic triggered by forcing all memory allocations
> for tty_ldisc_restore() to fail, we can consider adding __GFP_NOFAIL for
> tty_ldisc_restore() case.
> 
> [1] https://syzkaller.appspot.com/bug?id=6ac359c61e71d22e06db7f8f88243feb11d927e7
> 
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Jiri Slaby <jslaby@suse.com>
> Cc: Dmitry Vyukov <dvyukov@google.com>
> Cc: Johannes Weiner <hannes@cmpxchg.org>
> Cc: Alan Cox <alan@llwyncelyn.cymru>
> Cc: Christoph Hellwig <hch@lst.de>
> Cc: Michal Hocko <mhocko@suse.com>

Seems reasonable to me

Alan