It is currently Sat, 24 Oct 2020 17:52:21 GMT

Author Message
 oops from console subsystem: dereferencing wild pointer
Hi Linus, hi James,
  recently I found that my (2.5.31) system sometime oopses when I hit a key
while looking for results of tasks I started in single-user mode by using
xxx > /dev/ttyXX. Stack trace reveals that oops happens in handle_scancode
in drivers/char/keyboard.c. It does:

        tty = vc->vc_tty;

        if (tty && (!tty->driver_data)) {
                 * We touch the tty structure via the ttytab array
                 * without knowing whether or not tty is open, which
                 * is inherently dangerous.  We currently rely on that
                 * fact that console_open sets tty->driver_data when
                 * it opens it, and clears it when it closes it.
                tty = NULL;

but unfortunately this worked only before we started doing kfree()
on tty structures, when they were statically allocated in console code.
Now, when we release tty, vc->vc_tty points to random memory, and sooner
or later tty memory will be used for something else, and kernel will oops
(in my case L_ECHO(tty) will fail because of tty->termios cannot be

Patch below fixes problem for me, and I also believe that after patch
below we can remove if () shown above from the keyboard.c.

I have no idea how VT code synchronizes, so I did not added any locking
around setting vc_tty (maybe con_close should call
acquire_console_sem/release_console_sem around code which touches
tty->driver_data and clears vc_tty so that other CPUs can stop using
tty struct before pointer will become wild, but it should be already
ensured by checking tty->count != 1). I'm sure that patch below does not
make locking situation worse than it is before applying patch: any
potentially not synchronized code could use wild pointer before, and
it will use NULL pointer now.

You can reproduce oopses without patch below by booting with 'init=/bin/bash',
then do 'echo xxx > /dev/tty2', then start filling all computer memory with
something (dd if=/dev/hda of=/dev/null works for me), switch to VT 2, and
hit key from time to time. Sooner or later oopses appears. If you have
enabled filling kfreed memory with 0x5A, you can skip dd step.

                                                Petr Vandrovec

diff -urdN linux/drivers/char/console.c linux/drivers/char/console.c
--- linux/drivers/char/console.c        2002-08-16 20:17:03.000000000 +0200
+++ linux/drivers/char/console.c        2002-08-16 23:08:50.000000000 +0200
@@ -2395,10 +2395,16 @@

 static void con_close(struct tty_struct *tty, struct file * filp)
+       struct vt_struct *vt;
        if (!tty)
        if (tty->count != 1) return;
        vcs_make_devfs (minor(tty->device) - tty->driver.minor_start, 1);
+       vt = (struct vt_struct*)tty->driver_data;
+       if (vt) {
+               vc_cons[vt->vc_num].d->vc_tty = NULL;
+       }
        tty->driver_data = 0;

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at   http://www.**-**.com/
Please read the FAQ at   http://www.**-**.com/

 Wed, 02 Feb 2005 06:10:07 GMT   
   [ 1 post ] 

Similar Threads

1. compiler/linker options re dereferencing null/uninitialized pointers

2. Dereferencing pointer to incomplete type

3. Dereferencing pointer to incomplete type

4. dereferencing pointer

5. "dereferencing pointer to incomplete type"

6. Dereferencing NULL pointers in AIX

7. dereferencing NULL pointers in AIX

8. [PATCH] pnpbios dereferencing user pointer

9. 2.5.18 -- build failure -- suspend.c:1052: dereferencing pointer to incomplete type

10. 2.5.5 -- filesystems.c:30: In function `sys_nfsservctl': dereferencing pointer to incomplete type

Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Designed by ST Software