[4.10-rc6][regression][tty] Crash in n_tty_receive_buf_common()

[Shawn Starr]

Hello kernel devs,


Triggered an interesting kernel panic while in KVM in a old Windows 2008R2 VM to connect to some legacy server, X froze, manages to capture oops with magic emergency key sync.


Feb  3 03:03:27 segfault kernel: [ 2785.908618] BUG: unable to handle kernel paging request at 0000000000002260
Feb  3 03:03:27 segfault kernel: [ 2785.908706] IP: n_tty_receive_buf_common+0x70/0xd80
Feb  3 03:03:27 segfault kernel: [ 2785.908741] PGD 0
Feb  3 03:03:27 segfault kernel: [ 2785.908742]
Feb  3 03:03:27 segfault kernel: [ 2785.908774] Oops: 0000 [#1] SMP
Feb  3 03:03:27 segfault kernel: [ 2785.908799] Modules linked in: tun ebtable_filter ebtables ip6table_filter ip6_tables bridge stp llc toshiba_acpi industrialio toshiba_haps hp_accel lis3lv02d input_polldev arc4 iwlmvm intel_rapl x86_pkg_temp_thermal mac80211 intel_powerclamp coretemp snd_usb_audio kvm_intel snd_hda_codec_realtek kvm snd_hda_codec_generic snd_hda_codec_hdmi uvcvideo videobuf2_vmalloc snd_hda_intel videobuf2_memops videobuf2_v4l2 snd_usbmidi_lib snd_rawmidi vfat snd_soc_rt5640 videobuf2_core snd_hda_codec videodev irqbypass dell_wmi dell_laptop snd_soc_rl6231 sparse_keymap snd_soc_core dell_smbios dcdbas media dell_smm_hwmon iTCO_wdt mei_wdt ppdev iTCO_vendor_support crct10dif_pclmul fat snd_hda_core crc32_pclmul ghash_clmulni_intel intel_cstate snd_compress intel_uncore snd_pcm_dmaengine snd_hwdep ac97_bus pcspkr
Feb  3 03:03:27 segfault kernel: [ 2785.909272]  intel_rapl_perf iwlwifi snd_seq snd_seq_device snd_pcm i2c_i801 cfg80211 ie31200_edac joydev edac_core snd_soc_sst_acpi snd_timer snd elan_i2c wmi i2c_designware_platform i2c_designware_core snd_soc_sst_match mei_me tpm_tis tpm_tis_core dell_rbtn rfkill video parport_pc dw_dmac soundcore mei tpm parport dell_smo8800 shpchp lpc_ich spi_pxa2xx_platform nfsd auth_rpcgss nfs_acl lockd grace sunrpc binfmt_misc amdkfd amd_iommu_v2 amdgpu i2c_algo_bit drm_kms_helper ttm drm netconsole sdhci_pci sdhci_acpi sdhci crc32c_intel serio_raw mmc_core fjes i2c_hid e1000e ptp pps_core
Feb  3 03:03:27 segfault kernel: [ 2785.909654] CPU: 0 PID: 159 Comm: kworker/u16:2 Not tainted 4.10.0-rc6+ #1
Feb  3 03:03:27 segfault kernel: [ 2785.909659] Hardware name: Dell Inc. Precision M6800/05NG6V, BIOS A16 12/01/2015
Feb  3 03:03:27 segfault kernel: [ 2785.909664] Workqueue: events_unbound flush_to_ldisc
Feb  3 03:03:27 segfault kernel: [ 2785.909668] task: ffff9fc3496b3b00 task.stack: ffffc3a8c3c8c000
Feb  3 03:03:27 segfault kernel: [ 2785.909673] RIP: 0010:n_tty_receive_buf_common+0x70/0xd80
Feb  3 03:03:27 segfault kernel: [ 2785.909675] RSP: 0018:ffffc3a8c3c8fd48 EFLAGS: 00010297
Feb  3 03:03:27 segfault kernel: [ 2785.909678] RAX: 0000000000000000 RBX: ffff9fc252b33000 RCX: 0000000000000010
Feb  3 03:03:27 segfault kernel: [ 2785.909681] RDX: 0000000080000000 RSI: ffff9fc252b33020 RDI: ffff9fc1c839f8c0
Feb  3 03:03:27 segfault kernel: [ 2785.909683] RBP: ffffc3a8c3c8fde8 R08: 0000000000000001 R09: 0000000000000000
Feb  3 03:03:27 segfault kernel: [ 2785.909685] R10: 0000000000000000 R11: 0000000000000aac R12: ffff9fc1a7be5808
Feb  3 03:03:27 segfault kernel: [ 2785.909687] R13: ffff9fc3379535d0 R14: ffff9fc1a7be5828 R15: ffff9fc1c839f800
Feb  3 03:03:27 segfault kernel: [ 2785.909691] FS:  0000000000000000(0000) GS:ffff9fc36dc00000(0000) knlGS:0000000000000000
Feb  3 03:03:27 segfault kernel: [ 2785.909693] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Feb  3 03:03:27 segfault kernel: [ 2785.909695] CR2: 0000000000002260 CR3: 000000067ce09000 CR4: 00000000001426b0
Feb  3 03:03:27 segfault kernel: [ 2785.909697] Call Trace:
Feb  3 03:03:27 segfault kernel: [ 2785.909705]  n_tty_receive_buf2+0x14/0x20
Feb  3 03:03:27 segfault kernel: [ 2785.909709]  tty_ldisc_receive_buf+0x22/0x50
Feb  3 03:03:27 segfault kernel: [ 2785.909713]  flush_to_ldisc+0xc6/0xe0
Feb  3 03:03:27 segfault kernel: [ 2785.909719]  process_one_work+0x197/0x450
Feb  3 03:03:27 segfault kernel: [ 2785.909723]  worker_thread+0x4e/0x4a0
Feb  3 03:03:27 segfault kernel: [ 2785.909728]  kthread+0x101/0x140
Feb  3 03:03:27 segfault kernel: [ 2785.909732]  ? process_one_work+0x450/0x450
Feb  3 03:03:27 segfault kernel: [ 2785.909737]  ? kthread_park+0x90/0x90
Feb  3 03:03:27 segfault kernel: [ 2785.909760]  ret_from_fork+0x2c/0x40
Feb  3 03:03:27 segfault kernel: [ 2785.909761] Code: ff ff e8 d4 3d 33 00 49 8d 87 00 02 00 00 c7 45 b4 00 00 00 00 48 89 45 80 49 8d 87 28 02 00 00 48 89 85 78 ff ff ff 48 8b 45 b8 <48> 8b b8 60 22 00 00 48 8b 30 41 8b 8f 10 01 00 00 8d 97 00 10
Feb  3 03:03:27 segfault kernel: [ 2785.909800] RIP: n_tty_receive_buf_common+0x70/0xd80 RSP: ffffc3a8c3c8fd48
Feb  3 03:03:27 segfault kernel: [ 2785.909801] CR2: 0000000000002260
Feb  3 03:03:27 segfault kernel: [ 2785.909803] ---[ end trace e8b859cad4b16c5b ]---

Thanks,
Shawn