On Mon, Nov 06, 2017 at 01:33:09PM +0100, Greg KH wrote:
> >
> > I just saw the same crash running syzkaller. It was preceded by a fault
> > injection in tty_ldisc_get() here:
> >
> > ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL);
> > if (ld == NULL) {
> > put_ldops(ldops);
> > return ERR_PTR(-ENOMEM);
> > }
> >
> > So then it panics at:
> >
> > if (IS_ERR(ld))
> > panic("n_tty: init_tty");
> >
> > It seems that syzkaller needs to do a better job reproducing and reporting
> > bugs
> > that are only reproducible with fault injection. But either way, this is a
> > bug;
> > panic() is not an acceptable way of handling kmalloc failure.
>
> That's a well-known issue, it's pretty much impossible to unwind safely
> from here. If you don't have enough memory at boot to get a tty_ldisc,
> you have bigger problems.
>
> thanks,
>
> greg k-h
It's not just running at boot though. It's also being hit by the fuzzer at
runtime, via ptmx_open().
Eric
