From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Yang Yingliang <yangyingliang@huawei.com>
Subject: [PATCH 4.14 55/64] serial: 8250: fix null-ptr-deref in serial8250_start_tx()
Date: Mon, 27 Jul 2020 16:04:34 +0200 [thread overview]
Message-ID: <20200727134913.893539507@linuxfoundation.org> (raw)
In-Reply-To: <20200727134911.020675249@linuxfoundation.org>
From: Yang Yingliang <yangyingliang@huawei.com>
commit f4c23a140d80ef5e6d3d1f8f57007649014b60fa upstream.
I got null-ptr-deref in serial8250_start_tx():
[ 78.114630] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 78.123778] Mem abort info:
[ 78.126560] ESR = 0x86000007
[ 78.129603] EC = 0x21: IABT (current EL), IL = 32 bits
[ 78.134891] SET = 0, FnV = 0
[ 78.137933] EA = 0, S1PTW = 0
[ 78.141064] user pgtable: 64k pages, 48-bit VAs, pgdp=00000027d41a8600
[ 78.147562] [0000000000000000] pgd=00000027893f0003, p4d=00000027893f0003, pud=00000027893f0003, pmd=00000027c9a20003, pte=0000000000000000
[ 78.160029] Internal error: Oops: 86000007 [#1] SMP
[ 78.164886] Modules linked in: sunrpc vfat fat aes_ce_blk crypto_simd cryptd aes_ce_cipher crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce ses enclosure sg sbsa_gwdt ipmi_ssif spi_dw_mmio sch_fq_codel vhost_net tun vhost vhost_iotlb tap ip_tables ext4 mbcache jbd2 ahci hisi_sas_v3_hw libahci hisi_sas_main libsas hns3 scsi_transport_sas hclge libata megaraid_sas ipmi_si hnae3 ipmi_devintf ipmi_msghandler br_netfilter bridge stp llc nvme nvme_core xt_sctp sctp libcrc32c dm_mod nbd
[ 78.207383] CPU: 11 PID: 23258 Comm: null-ptr Not tainted 5.8.0-rc6+ #48
[ 78.214056] Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V3.B210.01 03/12/2020
[ 78.222888] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--)
[ 78.228435] pc : 0x0
[ 78.230618] lr : serial8250_start_tx+0x160/0x260
[ 78.235215] sp : ffff800062eefb80
[ 78.238517] x29: ffff800062eefb80 x28: 0000000000000fff
[ 78.243807] x27: ffff800062eefd80 x26: ffff202fd83b3000
[ 78.249098] x25: ffff800062eefd80 x24: ffff202fd83b3000
[ 78.254388] x23: ffff002fc5e50be8 x22: 0000000000000002
[ 78.259679] x21: 0000000000000001 x20: 0000000000000000
[ 78.264969] x19: ffffa688827eecc8 x18: 0000000000000000
[ 78.270259] x17: 0000000000000000 x16: 0000000000000000
[ 78.275550] x15: ffffa68881bc67a8 x14: 00000000000002e6
[ 78.280841] x13: ffffa68881bc67a8 x12: 000000000000c539
[ 78.286131] x11: d37a6f4de9bd37a7 x10: ffffa68881cccff0
[ 78.291421] x9 : ffffa68881bc6000 x8 : ffffa688819daa88
[ 78.296711] x7 : ffffa688822a0f20 x6 : ffffa688819e0000
[ 78.302002] x5 : ffff800062eef9d0 x4 : ffffa68881e707a8
[ 78.307292] x3 : 0000000000000000 x2 : 0000000000000002
[ 78.312582] x1 : 0000000000000001 x0 : ffffa688827eecc8
[ 78.317873] Call trace:
[ 78.320312] 0x0
[ 78.322147] __uart_start.isra.9+0x64/0x78
[ 78.326229] uart_start+0xb8/0x1c8
[ 78.329620] uart_flush_chars+0x24/0x30
[ 78.333442] n_tty_receive_buf_common+0x7b0/0xc30
[ 78.338128] n_tty_receive_buf+0x44/0x2c8
[ 78.342122] tty_ioctl+0x348/0x11f8
[ 78.345599] ksys_ioctl+0xd8/0xf8
[ 78.348903] __arm64_sys_ioctl+0x2c/0xc8
[ 78.352812] el0_svc_common.constprop.2+0x88/0x1b0
[ 78.357583] do_el0_svc+0x44/0xd0
[ 78.360887] el0_sync_handler+0x14c/0x1d0
[ 78.364880] el0_sync+0x140/0x180
[ 78.368185] Code: bad PC value
SERIAL_PORT_DFNS is not defined on each arch, if it's not defined,
serial8250_set_defaults() won't be called in serial8250_isa_init_ports(),
so the p->serial_in pointer won't be initialized, and it leads a null-ptr-deref.
Fix this problem by calling serial8250_set_defaults() after init uart port.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200721143852.4058352-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -534,6 +534,7 @@ static void __init serial8250_isa_init_p
*/
up->mcr_mask = ~ALPHA_KLUDGE_MCR;
up->mcr_force = ALPHA_KLUDGE_MCR;
+ serial8250_set_defaults(up);
}
/* chain base port ops to support Remote Supervisor Adapter */
@@ -557,7 +558,6 @@ static void __init serial8250_isa_init_p
port->membase = old_serial_port[i].iomem_base;
port->iotype = old_serial_port[i].io_type;
port->regshift = old_serial_port[i].iomem_reg_shift;
- serial8250_set_defaults(up);
port->irqflags |= irqflag;
if (serial8250_isa_config != NULL)
next prev parent reply other threads:[~2020-07-27 14:41 UTC|newest]
Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-27 14:03 [PATCH 4.14 00/64] 4.14.190-rc1 review Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 01/64] gpio: arizona: handle pm_runtime_get_sync failure case Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 02/64] gpio: arizona: put pm_runtime in case of failure Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 03/64] pinctrl: amd: fix npins for uart0 in kerncz_groups Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 04/64] mac80211: allow rx of mesh eapol frames with default rx key Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 05/64] scsi: scsi_transport_spi: Fix function pointer check Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 06/64] xtensa: fix __sync_fetch_and_{and,or}_4 declarations Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 07/64] xtensa: update *pos in cpuinfo_op.next Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 08/64] drivers/net/wan/lapbether: Fixed the value of hard_header_len Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 09/64] net: sky2: initialize return of gm_phy_read Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 10/64] drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 11/64] irqdomain/treewide: Keep firmware node unconditionally allocated Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 12/64] SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion") Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 13/64] spi: spi-fsl-dspi: Exit the ISR with IRQ_NONE when its not ours Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 14/64] IB/umem: fix reference count leak in ib_umem_odp_get() Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 15/64] uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 16/64] ALSA: info: Drop WARN_ON() from buffer NULL sanity check Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 17/64] ASoC: rt5670: Correct RT5670_LDO_SEL_MASK Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 18/64] btrfs: fix double free on ulist after backref resolution failure Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 19/64] btrfs: fix mount failure caused by race with umount Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.14 20/64] btrfs: fix page leaks after failure to lock page for delalloc Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 21/64] bnxt_en: Fix race when modifying pause settings Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 22/64] hippi: Fix a size used in a pci_free_consistent() in an error handling path Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 23/64] ax88172a: fix ax88172a_unbind() failures Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 24/64] net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 25/64] drm: sun4i: hdmi: Fix inverted HPD result Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 26/64] net: smc91x: Fix possible memory leak in smc_drv_probe() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 27/64] bonding: check error value of register_netdevice() immediately Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 28/64] mlxsw: destroy workqueue when trap_register in mlxsw_emad_init Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 29/64] ipvs: fix the connection sync failed in some cases Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 30/64] i2c: rcar: always clear ICSAR to avoid side effects Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 31/64] bonding: check return value of register_netdevice() in bond_newlink() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 32/64] serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 33/64] scripts/decode_stacktrace: strip basepath from all paths Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 34/64] HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 35/64] HID: apple: Disable Fn-key key-re-mapping on clone keyboards Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 36/64] dmaengine: tegra210-adma: Fix runtime PM imbalance on error Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 37/64] Input: add `SW_MACHINE_COVER` Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 38/64] spi: mediatek: use correct SPI_CFG2_REG MACRO Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 39/64] regmap: dev_get_regmap_match(): fix string comparison Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 40/64] hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 41/64] dmaengine: ioat setting ioat timeout as module parameter Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 42/64] Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 43/64] usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 44/64] arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 45/64] x86: math-emu: Fix up cmp insn for clang ias Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 46/64] binder: Dont use mmput() from shrinker function Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 47/64] usb: xhci-mtk: fix the failure of bandwidth allocation Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 48/64] usb: xhci: Fix ASM2142/ASM3142 DMA addressing Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 49/64] Revert "cifs: Fix the target file was deleted when rename failed." Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 50/64] staging: wlan-ng: properly check endpoint types Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 51/64] staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 52/64] staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 53/64] staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 54/64] staging: comedi: addi_apci_1564: " Greg Kroah-Hartman
2020-07-27 14:04 ` Greg Kroah-Hartman [this message]
2020-07-27 14:04 ` [PATCH 4.14 56/64] serial: 8250_mtk: Fix high-speed baud rates clamping Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 57/64] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 58/64] vt: Reject zero-sized screen buffer size Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 59/64] Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 60/64] mm/memcg: fix refcount error while moving and swapping Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 61/64] io-mapping: indicate mapping failure Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 62/64] parisc: Add atomic64_set_release() define to avoid CPU soft lockups Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 63/64] ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.14 64/64] ath9k: Fix regression with Atheros 9271 Greg Kroah-Hartman
2020-07-28 1:40 ` [PATCH 4.14 00/64] 4.14.190-rc1 review Shuah Khan
2020-07-28 12:43 ` Naresh Kamboju
2020-07-28 18:22 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200727134913.893539507@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).