Re: tty: panic in tty_ldisc_restore

[Dmitry Vyukov]

On Fri, Mar 3, 2017 at 8:36 AM, Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
> On Thu, Mar 2, 2017 at 8:37 PM, Greg Kroah-Hartman
> <gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>>> >> This is hurting us badly.
>>> >
>>> > Really?  How?  Are you hitting this a lot?  Why now and never before?
>>> > Are you really out of memory?
>>>
>>>
>>> This crashes our test bots a lot.
>>> Why now... I don't have exact answer. Probably a combination of fuzzer
>>> figuring out some magic sequences of syscalls and increased memory
>>> consumption due to something (again maybe due to fuzzer figuring out
>>> how to eat more memory).
>>
>> If the fuzzer is suddenly eating more memory, you should be seeing lots
>> of other problems  right?  This can't be the only thing that has issues
>> with memory allocation failures?
>
>
> I remember 2 or 3 that started happenning roughly at the same time:
> https://groups.google.com/forum/#!msg/syzkaller/tIx42qCVklk/fh0qjUboBgAJ
> https://groups.google.com/forum/#!msg/syzkaller/vp1neyeoA8A/Is8aPdrpBgAJ
> Both were quickly fixed.
> There is strong bias towards failing larger, multi-page allocations.
> so it's not that we are failing _all_ allocations in kernel code.


Mailed the patch officially.
Once I fixed it, fuzzer was able to uncover another race leading to
crashes in tty_ldisc_ref_wait:
https://groups.google.com/d/msg/syzkaller/ZTsV9qLIzGA/opsLjyoEEAAJ