WARNING in tty_set_termios

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 4d552acf Linux 4.19.34
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11f0f98f200000
kernel config: https://syzkaller.appspot.com/x/.config?x=c95a88291f095edd
dashboard link: https://syzkaller.appspot.com/bug?extid=2b51fc95e5df897f47e5
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2b51fc...@syzkaller.appspotmail.com

autofs4:pid:6436:check_dev_ioctl_version: ioctl control interface version
mismatch: kernel(1.1), user(1.788529152), cmd(0x00009374)
WARNING: CPU: 1 PID: 31380 at drivers/tty/tty_ioctl.c:319
tty_set_termios+0x7a9/0x8d0 drivers/tty/tty_ioctl.c:319
Kernel panic - not syncing: panic_on_warn set ...

autofs4:pid:6436:validate_dev_ioctl: invalid device control module version
supplied for cmd(0x00009374)
CPU: 1 PID: 31380 Comm: kworker/u5:2 Not tainted 4.19.34 #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: hci0 hci_power_on
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x263/0x51d kernel/panic.c:185
__warn.cold+0x20/0x54 kernel/panic.c:540
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296
kobject: 'input1300' (00000000853e87d9): kobject_add_internal:
parent: 'input', set: 'devices'
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:997
RIP: 0010:tty_set_termios+0x7a9/0x8d0 drivers/tty/tty_ioctl.c:319
Code: 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 a3 00
00 00 45 89 a7 d0 03 00 00 e9 47 fe ff ff e8 77 49 05 fe <0f> 0b e9 3a f9
ff ff e8 2b a7 3b fe e9 d2 fa ff ff e8 21 a7 3b fe
RSP: 0018:ffff888084e27990 EFLAGS: 00010293
RAX: ffff888080438540 RBX: ffff888084e27a50 RCX: ffffffff8365e6fd
RDX: 0000000000000000 RSI: ffffffff8365edc9 RDI: 0000000000000005
RBP: ffff888084e27a78 R08: ffff888080438540 R09: fffffbfff15dc791
R10: fffffbfff15dc790 R11: 0000000000000003 R12: ffff888084e27ab8
R13: 0000000000010004 R14: 1ffff110109c4f51 R15: ffff88809bd42240
hci_uart_set_baudrate+0x157/0x1c0 drivers/bluetooth/hci_ldisc.c:378
kobject: 'input1300' (00000000853e87d9): kobject_uevent_env
hci_uart_setup+0xa2/0x490 drivers/bluetooth/hci_ldisc.c:401
hci_dev_do_open+0x67e/0x14b0 net/bluetooth/hci_core.c:1423
kobject: 'input1300' (00000000853e87d9): fill_kobj_path: path
= '/devices/virtual/input/input1300'
kobject: 'input1300' (00000000853e87d9): fill_kobj_path: path
= '/devices/virtual/input/input1300'
hci_power_on+0x10d/0x580 net/bluetooth/hci_core.c:2130
process_one_work+0x98e/0x1760 kernel/workqueue.c:2153
input: syz0 as /devices/virtual/input/input1300
worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x357/0x430 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413
kobject: 'event4' (0000000005a89f78): kobject_add_internal:
parent: 'input1300', set: 'devices'
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following crash on:

HEAD commit: 4d552acf Linux 4.19.34
git tree: linux-4.19.y

console output: https://syzkaller.appspot.com/x/log.txt?x=103f83dd200000

kernel config: https://syzkaller.appspot.com/x/.config?x=c95a88291f095edd
dashboard link: https://syzkaller.appspot.com/bug?extid=2b51fc95e5df897f47e5
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=157dca6b200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=105436f3200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+2b51fc...@syzkaller.appspotmail.com

audit: type=1400 audit(1555462520.522:36): avc: denied { map } for
pid=7992 comm="syz-executor770" path="/root/syz-executor770137773"
dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
WARNING: CPU: 0 PID: 1277 at drivers/tty/tty_ioctl.c:319

tty_set_termios+0x7a9/0x8d0 drivers/tty/tty_ioctl.c:319
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 1277 Comm: kworker/u5:0 Not tainted 4.19.34 #2

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: hci0 hci_power_on
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
panic+0x263/0x51d kernel/panic.c:185
__warn.cold+0x20/0x54 kernel/panic.c:540
report_bug+0x263/0x2b0 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296

do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:997
RIP: 0010:tty_set_termios+0x7a9/0x8d0 drivers/tty/tty_ioctl.c:319
Code: 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 a3 00
00 00 45 89 a7 d0 03 00 00 e9 47 fe ff ff e8 77 49 05 fe <0f> 0b e9 3a f9
ff ff e8 2b a7 3b fe e9 d2 fa ff ff e8 21 a7 3b fe

RSP: 0018:ffff8880a6517990 EFLAGS: 00010293
RAX: ffff8880a650a080 RBX: ffff8880a6517a50 RCX: ffffffff8365e6fd

RDX: 0000000000000000 RSI: ffffffff8365edc9 RDI: 0000000000000005

RBP: ffff8880a6517a78 R08: ffff8880a650a080 R09: fffffbfff15dc791
R10: fffffbfff15dc790 R11: 0000000000000003 R12: ffff8880a6517ab8
R13: 0000000000010004 R14: 1ffff11014ca2f51 R15: ffff888089588380
hci_uart_set_baudrate+0x157/0x1c0 drivers/bluetooth/hci_ldisc.c:378

hci_uart_setup+0xa2/0x490 drivers/bluetooth/hci_ldisc.c:401
hci_dev_do_open+0x67e/0x14b0 net/bluetooth/hci_core.c:1423

hci_power_on+0x10d/0x580 net/bluetooth/hci_core.c:2130
process_one_work+0x98e/0x1760 kernel/workqueue.c:2153

worker_thread+0x98/0xe40 kernel/workqueue.c:2296
kthread+0x357/0x430 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 58b454eb Linux 4.14.112
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13b2535b200000
kernel config: https://syzkaller.appspot.com/x/.config?x=8b0e7ab7678533ab
dashboard link: https://syzkaller.appspot.com/bug?extid=48dba98c0cbeb9aec87d

compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17cd23b7200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117d327b200000

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+48dba9...@syzkaller.appspotmail.com

random: sshd: uninitialized urandom read (32 bytes read)
urandom_read: 1 callbacks suppressed
random: sshd: uninitialized urandom read (32 bytes read)
audit: type=1400 audit(1555586071.572:36): avc: denied { map } for
pid=6831 comm="syz-executor265" path="/root/syz-executor265486647"
dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023

tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1

------------[ cut here ]------------
WARNING: CPU: 0 PID: 1401 at drivers/tty/tty_ioctl.c:318
tty_set_termios+0x74a/0x870 drivers/tty/tty_ioctl.c:318

Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 1401 Comm: kworker/u5:0 Not tainted 4.14.112 #2

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: hci0 hci_power_on
Call Trace:

__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
panic+0x1f2/0x438 kernel/panic.c:182
__warn.cold+0x2f/0x34 kernel/panic.c:546
report_bug+0x216/0x254 lib/bug.c:186
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:944
RIP: 0010:tty_set_termios+0x74a/0x870 drivers/tty/tty_ioctl.c:318
RSP: 0018:ffff8880a6927ad8 EFLAGS: 00010297
RAX: ffff8880a691e580 RBX: ffff8880a6927b80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8880a6927be8 RDI: ffff88821910e038
RBP: ffff8880a6927ba8 R08: dffffc0000000000 R09: ffff8880a6927858
R10: ffff8880a6927ca0 R11: ffff8880a691e580 R12: 1ffff11014d24f60
R13: ffff8880a6927be8 R14: ffff88821910e000 R15: ffff88808864cc00
hci_uart_set_baudrate+0x145/0x190 drivers/bluetooth/hci_ldisc.c:376
hci_uart_setup+0x98/0x430 drivers/bluetooth/hci_ldisc.c:399
hci_dev_do_open+0x57f/0xf90 net/bluetooth/hci_core.c:1384
hci_power_on+0x8d/0x3d0 net/bluetooth/hci_core.c:2080
process_one_work+0x868/0x1610 kernel/workqueue.c:2114
worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248
kthread+0x31c/0x430 kernel/kthread.c:232
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402

Kernel Offset: disabled
Rebooting in 86400 seconds..

---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot suspects this bug was fixed by commit:

commit 56966212e23f82ced10831f7cca02f7339147428
Author: Vladis Dronov <vdr...@redhat.com>
Date: Tue Jul 30 09:33:45 2019 +0000

Bluetooth: hci_uart: check for missing tty operations

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11540cdee00000
start commit: 4d552acf Linux 4.19.34
git tree: linux-4.19.y

kernel config: https://syzkaller.appspot.com/x/.config?x=c95a88291f095edd
dashboard link: https://syzkaller.appspot.com/bug?extid=2b51fc95e5df897f47e5

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=157dca6b200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=105436f3200000

If the result looks correct, please mark the bug fixed by replying with:

#syz fix: Bluetooth: hci_uart: check for missing tty operations

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[vdr...@redhat.com]

[syzbot]

> #syz fix: Bluetooth: hci_uart: check for missing tty operations

I see the command but can't find the corresponding bug.
Please resend the email to syzbo...@syzkaller.appspotmail.com address
that is the sender of the bug report (also present in the Reported-by tag).


> --
> You received this message because you are subscribed to the Google
> Groups "syzkaller-lts-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-lts-b...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-lts-bugs/230cbe2a-8b7a-46f7-aab4-8a5e0c9363ef%40googlegroups.com.

[vdr...@redhat.com]

#syz fix: Bluetooth: hci_uart: check for missing tty operations

[syzbot]

> #syz fix: Bluetooth: hci_uart: check for missing tty operations

I see the command but can't find the corresponding bug.
Please resend the email to syzbo...@syzkaller.appspotmail.com address
that is the sender of the bug report (also present in the Reported-by tag).

> On Tuesday, December 3, 2019 at 10:59:01 AM UTC+1, syzbot wrote:

>> syzbot suspects this bug was fixed by commit:

>> commit 56966212e23f82ced10831f7cca02f7339147428

>> Author: Vladis Dronov <vdr...@redhat.com <javascript:>>

>> Date: Tue Jul 30 09:33:45 2019 +0000

>> Bluetooth: hci_uart: check for missing tty operations

>> bisection log:
>> https://syzkaller.appspot.com/x/bisect.txt?x=11540cdee00000
>> start commit: 4d552acf Linux 4.19.34
>> git tree: linux-4.19.y
>> kernel config:
>> https://syzkaller.appspot.com/x/.config?x=c95a88291f095edd
>> dashboard link:
>> https://syzkaller.appspot.com/bug?extid=2b51fc95e5df897f47e5
>> syz repro:
>> https://syzkaller.appspot.com/x/repro.syz?x=157dca6b200000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=105436f3200000

>> If the result looks correct, please mark the bug fixed by replying with:

>> #syz fix: Bluetooth: hci_uart: check for missing tty operations

>> For information about bisection process see:
>> https://goo.gl/tpsmEJ#bisection

> --
> You received this message because you are subscribed to the Google
> Groups "syzkaller-lts-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-lts-b...@googlegroups.com.
> To view this discussion on the web visit

> https://groups.google.com/d/msgid/syzkaller-lts-bugs/c4f34214-0238-4bc6-8124-5572a0332436%40googlegroups.com.