Re: fs, tty: WARNING in devpts_get_priv

[Dmitry Vyukov]

Hello,

The following program triggers WARNING in devpts_get_priv:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/types.h>

int main()
{
  mknodat(AT_FDCWD, "./bus", S_IFCHR, makedev(136, 49));
  openat(AT_FDCWD, "./bus", O_RDONLY);
  return 0;
}


WARNING: CPU: 0 PID: 9491 at fs/devpts/inode.c:588 devpts_get_priv+0xb9/0xe0
CPU: 0 PID: 9491 Comm: syz-executor Not tainted 4.8.0-rc3-next-20160825+ #8
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffffffff886b6fe0 ffff880033917768 ffffffff82db38d9 ffffffff021d0000
 fffffbfff10d6dfc ffffffff8708f000 ffff880033917840 ffffffff8715e100
 dffffc0000000000 0000000000000009 ffff880033917830 ffffffff816cf888
Call Trace:
 [<     inline     >] __dump_stack lib/dump_stack.c:15
 [<ffffffff82db38d9>] dump_stack+0x12e/0x185 lib/dump_stack.c:51
 [<ffffffff816cf888>] panic+0x1e4/0x3fb kernel/panic.c:179
 [<ffffffff813863b4>] __warn+0x1c4/0x1e0 kernel/panic.c:542
 [<ffffffff8138659c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585
 [<ffffffff81a2aff9>] devpts_get_priv+0xb9/0xe0 fs/devpts/inode.c:588
 [<ffffffff83241c4f>] pts_unix98_lookup+0x3f/0x70 drivers/tty/pty.c:648
 [<     inline     >] tty_driver_lookup_tty drivers/tty/tty_io.c:1371
 [<     inline     >] tty_open_by_driver drivers/tty/tty_io.c:2038
 [<ffffffff83228171>] tty_open+0x871/0x10a0 drivers/tty/tty_io.c:2108
 [<ffffffff8187020e>] chrdev_open+0x22e/0x5c0 fs/char_dev.c:392
 [<ffffffff8185ad25>] do_dentry_open+0x6f5/0xd30 fs/open.c:747
 [<ffffffff8185e445>] vfs_open+0x105/0x220 fs/open.c:860
 [<     inline     >] do_last fs/namei.c:3374
 [<ffffffff81895909>] path_openat+0x12f9/0x2ab0 fs/namei.c:3497
 [<ffffffff8189a7ac>] do_filp_open+0x18c/0x250 fs/namei.c:3532
 [<ffffffff8185ed4c>] do_sys_open+0x1fc/0x440 fs/open.c:1047
 [<     inline     >] SYSC_openat fs/open.c:1074
 [<ffffffff8185f000>] SyS_openat+0x30/0x40 fs/open.c:1068
 [<ffffffff86e10700>] entry_SYSCALL_64_fastpath+0x23/0xc1


On 0f98f121e1670eaa2a2fbb675e07d6ba7f0e146f of linux-next.