general protection fault in do_con_write

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 174651bd Linux 4.19.87
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14dc2861e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=d306897dc6e131b7
dashboard link: https://syzkaller.appspot.com/bug?extid=22e5b3df1b4ac3612a61
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135de82ee00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15d0f97ee00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+22e5b3...@syzkaller.appspotmail.com

audit: type=1400 audit(1575352211.729:36): avc: denied { map } for
pid=7661 comm="syz-executor802" path="/root/syz-executor802398089"
dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 7661 Comm: syz-executor802 Not tainted 4.19.87-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:do_con_write.part.0+0xa03/0x1eb0 drivers/tty/vt/vt.c:2736
Code: 76 fe ff ff 41 01 dd e8 eb 0f bd fd 48 8b 85 a8 fe ff ff 80 38 00 0f
85 fe 12 00 00 49 8b 9e a0 03 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 14 20
48 89 d8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85
RSP: 0018:ffff888094e77748 EFLAGS: 00010203
RAX: 0000000020000001 RBX: 000000010000000e RCX: ffffffff83ae0408
RDX: 0000000000000000 RSI: ffffffff83ae0455 RDI: 0000000000000003
RBP: ffff888094e778e0 R08: ffff888095aa8640 R09: 0000000000000004
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: dffffc0000000000
R13: 00000000000007fe R14: ffff888082643540 R15: ffff8880826438cc
FS: 0000000001cce880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4e4432e000 CR3: 000000008e58c000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
do_con_write drivers/tty/vt/vt.c:3121 [inline]
con_put_char+0xfa/0x110 drivers/tty/vt/vt.c:3120
tty_put_char+0xc5/0x160 drivers/tty/tty_io.c:2887
__process_echoes+0x37c/0xa40 drivers/tty/n_tty.c:706
flush_echoes drivers/tty/n_tty.c:827 [inline]
__receive_buf drivers/tty/n_tty.c:1646 [inline]
n_tty_receive_buf_common+0xc13/0x28e0 drivers/tty/n_tty.c:1740
n_tty_receive_buf+0x31/0x40 drivers/tty/n_tty.c:1769
tiocsti drivers/tty/tty_io.c:2194 [inline]
tty_ioctl+0xe91/0x1510 drivers/tty/tty_io.c:2580
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688
ksys_ioctl+0xab/0xd0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710
do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x444099
Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 0f 83 7b d8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffdf92ed988 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000444099
RDX: 0000000020000040 RSI: 0000000000005412 RDI: 0000000000000004
RBP: 00000000006ce018 R08: 00000000004002e0 R09: 00000000004002e0
R10: 000000000000000f R11: 0000000000000246 R12: 0000000000401da0
R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace 1c430a8aee3c1bbb ]---
RIP: 0010:do_con_write.part.0+0xa03/0x1eb0 drivers/tty/vt/vt.c:2736
Code: 76 fe ff ff 41 01 dd e8 eb 0f bd fd 48 8b 85 a8 fe ff ff 80 38 00 0f
85 fe 12 00 00 49 8b 9e a0 03 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 14 20
48 89 d8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85
RSP: 0018:ffff888094e77748 EFLAGS: 00010203
RAX: 0000000020000001 RBX: 000000010000000e RCX: ffffffff83ae0408
RDX: 0000000000000000 RSI: ffffffff83ae0455 RDI: 0000000000000003
RBP: ffff888094e778e0 R08: ffff888095aa8640 R09: 0000000000000004
R10: ffffed1015d04732 R11: ffff8880ae823993 R12: dffffc0000000000
R13: 00000000000007fe R14: ffff888082643540 R15: ffff8880826438cc
FS: 0000000001cce880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4e4432e000 CR3: 000000008e58c000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: fbc5fe7a Linux 4.14.157
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=157b7c41e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=d49d9f4045dcfa5d
dashboard link: https://syzkaller.appspot.com/bug?extid=c2e6f1619d4fab49789a

compiler: gcc (GCC) 9.0.0 20181231 (experimental)

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16737446e00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1499f2eae00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:

Reported-by: syzbot+c2e6f1...@syzkaller.appspotmail.com

audit: type=1400 audit(1575365376.404:36): avc: denied { map } for
pid=7164 comm="syz-executor856" path="/root/syz-executor856563590"

dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN

Modules linked in:
CPU: 1 PID: 7164 Comm: syz-executor856 Not tainted 4.14.157-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011

task: ffff888084eb8400 task.stack: ffff888083818000
RIP: 0010:do_con_write.part.0+0x7d6/0x1b50 drivers/tty/vt/vt.c:2398
RSP: 0018:ffff88808381f840 EFLAGS: 00010203
RAX: 0000000020000001 RBX: 000000010000000e RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff88809ec52c7d
RBP: ffff88808381f990 R08: ffffffff870e59e8 R09: 0000000000000000
R10: 0000000000000000 R11: ffff888084eb8400 R12: dffffc0000000000
R13: 00000000000007fe R14: ffff88809ec52c8c R15: ffff88809ec52900
FS: 000000000181c880(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fc5a9d1a000 CR3: 00000000a7ca0000 CR4: 00000000001406e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

do_con_write drivers/tty/vt/vt.c:2798 [inline]
con_put_char+0xb8/0xc0 drivers/tty/vt/vt.c:2797
tty_put_char+0xac/0x130 drivers/tty/tty_io.c:2879
__process_echoes+0x2ce/0x8a0 drivers/tty/n_tty.c:708
flush_echoes drivers/tty/n_tty.c:829 [inline]
__receive_buf drivers/tty/n_tty.c:1648 [inline]
n_tty_receive_buf_common+0x998/0x2410 drivers/tty/n_tty.c:1742
n_tty_receive_buf+0x31/0x3b drivers/tty/n_tty.c:1771
tiocsti drivers/tty/tty_io.c:2186 [inline]
tty_ioctl+0xded/0x1320 drivers/tty/tty_io.c:2572
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x444099
RSP: 002b:00007ffd0e53c318 EFLAGS: 00000246 ORIG_RAX: 0000000000000010

RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 0000000000444099
RDX: 0000000020000040 RSI: 0000000000005412 RDI: 0000000000000004
RBP: 00000000006ce018 R08: 00000000004002e0 R09: 00000000004002e0
R10: 000000000000000f R11: 0000000000000246 R12: 0000000000401da0
R13: 0000000000401e30 R14: 0000000000000000 R15: 0000000000000000

Code: 66 44 03 ad 30 ff ff ff e8 68 a2 0f fe 48 8b 85 f0 fe ff ff 80 38 00
0f 85 97 11 00 00 49 8b 9f a0 03 00 00 48 89 d8 48 c1 e8 03 <42> 0f b6 14

20 48 89 d8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f

RIP: do_con_write.part.0+0x7d6/0x1b50 drivers/tty/vt/vt.c:2398 RSP:
ffff88808381f840
---[ end trace d4335c0ded3617ee ]---

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 74752b81eae8ae64e97de222320026367e92c4b5
Author: Tetsuo Handa <penguin...@I-love.SAKURA.ne.jp>
Date: Sun Jul 12 11:10:12 2020 +0000

vt: Reject zero-sized screen buffer size.

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1278b9f2900000
start commit: 399849e4 Linux 4.19.131
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=eada6d424d8bae1d
dashboard link: https://syzkaller.appspot.com/bug?extid=22e5b3df1b4ac3612a61
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165e3ccb100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=153e0fe5100000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: vt: Reject zero-sized screen buffer size.

For information about bisection process see: https://goo.gl/tpsmEJ#bisection