Bug 167288 - FIX for oops in drivers/char/tty_io.c check_tty_count()
FIX for oops in drivers/char/tty_io.c check_tty_count()
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: kernel (Show other bugs)
3.0
i386 Linux
medium Severity high
: ---
: ---
Assigned To: Don Howard
Brian Brock
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-09-01 07:48 EDT by Fernando Luis Vazquez Cao
Modified: 2007-11-30 17:07 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-10-19 14:54:55 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Fernando Luis Vazquez Cao 2005-09-01 07:48:10 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; ja-JP; rv:1.7.10) Gecko/20050822 Firefox/1.0.6 (Debian package 1.0.6-3)

Description of problem:
When I use kon (Kanji cONsole emulator) on a tty different from tty1 the kernel oopses. I first found this problem in Kernel 2.4.20-32.73smp but it seems to persist in recent RHEL3's kernels (I have checked 2.4.21-32). This bug was fixed in vanilla kernel v2.4.23.

What happens is that the debugging function check_tty_count() tries to walk a list_head that has been list_del()'d.

The patch below (included inline due to its brevity) should fix this:

--- drivers/char/tty_io.c.orig  2002-11-29 08:53:12.000000000 +0900
+++ drivers/char/tty_io.c       2005-09-01 16:27:23.000000000 +0900
@@ -1023,7 +1023,7 @@ static void release_mem(struct tty_struc
                }
                o_tty->magic = 0;
                (*o_tty->driver.refcount)--;
-               list_del(&o_tty->tty_files);
+               list_del_init(&o_tty->tty_files);
                free_tty_struct(o_tty);
        }

@@ -1035,7 +1035,7 @@ static void release_mem(struct tty_struc
        }
        tty->magic = 0;
        (*tty->driver.refcount)--;
-       list_del(&tty->tty_files);
+       list_del_init(&tty->tty_files);
        free_tty_struct(tty);
 }

Version-Release number of selected component (if applicable):
kernel-2.4.21-32

How reproducible:
Sometimes

Steps to Reproduce:
1. login to tty2 (not tty1)
2. start kon (Kanji cONsole emulator, console which support Japanese characters)
3. exit kon
4. logout

Actual Results:  The oops below occurs.

Aug 29 19:09:17 aiscprtn01 kernel: Unable to handle kernel NULL pointer dereference at virtual address 0000005c
Aug 29 19:09:17 aiscprtn01 kernel:  printing eip:
Aug 29 19:09:17 aiscprtn01 kernel: c01810d0
Aug 29 19:09:17 aiscprtn01 kernel: *pde = 00000000
Aug 29 19:09:17 aiscprtn01 kernel: Oops: 0000
Aug 29 19:09:17 aiscprtn01 kernel: autofs e1000 st usb-ohci usbcore ext3 jbd ips aic7xxx sd_mod scsi_mod
Aug 29 19:09:17 aiscprtn01 kernel: CPU:    0
Aug 29 19:09:17 aiscprtn01 kernel: EIP:    0010:[<c01810d0>]    Not tainted
Aug 29 19:09:17 aiscprtn01 kernel: EFLAGS: 00010213
Aug 29 19:09:17 aiscprtn01 kernel:
Aug 29 19:09:17 aiscprtn01 kernel: EIP is at check_tty_count [kernel] 0x30 (2.4.20-32.73smp)
Aug 29 19:09:17 aiscprtn01 kernel: eax: f70c29a8   ebx: 00000000   ecx: f70c2000   edx: 00000000
Aug 29 19:09:17 aiscprtn01 kernel: esi: f70c29a8   edi: 00000000   ebp: 00000000   esp: c8065efc
Aug 29 19:09:17 aiscprtn01 kernel: ds: 0018   es: 0018   ss: 0018
Aug 29 19:09:17 aiscprtn01 kernel: Process bash (pid: 3835, stackpage=c8065000)
Aug 29 19:09:17 aiscprtn01 kernel: Stack: f70c2000 f70c2000 c0181510 f70c2000 c025ca5f 00000000 00000efb f70c2000
Aug 29 19:09:17 aiscprtn01 kernel:        00000001 c8064000 c01817df f70c2000 c36b4ce4 c36b0140 c8064000 c011fd9b
Aug 29 19:09:17 aiscprtn01 kernel:        00000001 f55be780 0812369c 00000efb c8064000 c0183285 00000efb f70c2000
Aug 29 19:09:17 aiscprtn01 kernel: Call Trace:   [<c0181510>] do_tty_hangup [kernel] 0x80 (0xc8065f04))
Aug 29 19:09:17 aiscprtn01 kernel: [<c01817df>] disassociate_ctty [kernel] 0x2f (0xc8065f24))
Aug 29 19:09:17 aiscprtn01 kernel: [<c011fd9b>] do_exit [kernel] 0x28b (0xc8065f38))
Aug 29 19:09:17 aiscprtn01 kernel: [<c0183285>] tiocspgrp [kernel] 0x65 (0xc8065f50))
Aug 29 19:09:17 aiscprtn01 kernel: [<c0183688>] tty_ioctl [kernel] 0x278 (0xc8065f64))
Aug 29 19:09:17 aiscprtn01 kernel: [<c0146053>] filp_open [kernel] 0x53 (0xc8065f74))
Aug 29 19:09:17 aiscprtn01 kernel: [<c0108be3>] system_call [kernel] 0x33 (0xc8065fc0))
Aug 29 19:09:17 aiscprtn01 kernel:
Aug 29 19:09:17 aiscprtn01 kernel:
Aug 29 19:09:17 aiscprtn01 kernel: Code: 39 4a 5c 8b 12 8d 43 01 0f 44 d8 39 f2 75 f1 b0 01 86 05 1c

Expected Results:  The system should not crash.

Additional info:
Comment 2 RHEL Product and Program Management 2007-10-19 14:54:55 EDT
This bug is filed against RHEL 3, which is in maintenance phase.
During the maintenance phase, only security errata and select mission
critical bug fixes will be released for enterprise products. Since
this bug does not meet that criteria, it is now being closed.
 
For more information of the RHEL errata support policy, please visit:
http://www.redhat.com/security/updates/errata/
 
If you feel this bug is indeed mission critical, please contact your
support representative. You may be asked to provide detailed
information on how this bug is affecting you.

Note You need to log in before you can comment on or make changes to this bug.