From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Alexey Kardashevskiy <aik@ozlabs.ru>
Subject: [PATCH 5.10 28/40] serial_core: Check for port state when tty is in error state
Date: Wed, 23 Dec 2020 16:33:29 +0100 [thread overview]
Message-ID: <20201223150516.892299582@linuxfoundation.org> (raw)
In-Reply-To: <20201223150515.553836647@linuxfoundation.org>
From: Alexey Kardashevskiy <aik@ozlabs.ru>
commit 2f70e49ed860020f5abae4f7015018ebc10e1f0e upstream.
At the moment opening a serial device node (such as /dev/ttyS3)
succeeds even if there is no actual serial device behind it.
Reading/writing/ioctls fail as expected because the uart port is not
initialized (the type is PORT_UNKNOWN) and the TTY_IO_ERROR error state
bit is set fot the tty.
However setting line discipline does not have these checks
8250_port.c (8250 is the default choice made by univ8250_console_init()).
As the result of PORT_UNKNOWN, uart_port::iobase is NULL which
a platform translates onto some address accessing which produces a crash
like below.
This adds tty_port_initialized() to uart_set_ldisc() to prevent the crash.
Found by syzkaller.
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Link: https://lore.kernel.org/r/20201203055834.45838-1-aik@ozlabs.ru
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/serial_core.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1467,6 +1467,10 @@ static void uart_set_ldisc(struct tty_st
{
struct uart_state *state = tty->driver_data;
struct uart_port *uport;
+ struct tty_port *port = &state->port;
+
+ if (!tty_port_initialized(port))
+ return;
mutex_lock(&state->port.mutex);
uport = uart_port_check(state);
next prev parent reply other threads:[~2020-12-23 15:35 UTC|newest]
Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-23 15:33 [PATCH 5.10 00/40] 5.10.3-rc1 review Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 01/40] net: ipconfig: Avoid spurious blank lines in boot log Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 02/40] x86/split-lock: Avoid returning with interrupts enabled Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 03/40] exfat: Avoid allocating upcase table using kcalloc() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 04/40] soc/tegra: fuse: Fix index bug in get_process_id Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 05/40] usb: mtu3: fix memory corruption in mtu3_debugfs_regset() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 06/40] USB: serial: option: add interface-number sanity check to flag handling Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 07/40] USB: gadget: f_acm: add support for SuperSpeed Plus Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 08/40] USB: gadget: f_midi: setup SuperSpeed Plus descriptors Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 09/40] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 10/40] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 11/40] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 12/40] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 13/40] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 14/40] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 15/40] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 16/40] coresight: tmc-etr: Check if page is valid before dma_map_page() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 17/40] coresight: tmc-etr: Fix barrier packet insertion for perf buffer Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 18/40] coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 19/40] coresight: etm4x: Skip setting LPOVERRIDE bit for qcom, skip-power-up Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 20/40] coresight: etm4x: Fix accesses to TRCVMIDCTLR1 Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 21/40] coresight: etm4x: Fix accesses to TRCCIDCTLR1 Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 22/40] coresight: etm4x: Fix accesses to TRCPROCSELR Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 23/40] coresight: etm4x: Handle TRCVIPCSSCTLR accesses Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 24/40] f2fs: fix to seek incorrect data offset in inline data file Greg Kroah-Hartman
2020-12-24 1:11 ` Chao Yu
2020-12-24 7:52 ` Greg Kroah-Hartman
2020-12-24 9:38 ` Chao Yu
2020-12-23 15:33 ` [PATCH 5.10 25/40] f2fs: init dirty_secmap incorrectly Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 26/40] scsi: megaraid_sas: Check user-provided offsets Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 27/40] HID: i2c-hid: add Vero K147 to descriptor override Greg Kroah-Hartman
2020-12-23 15:33 ` Greg Kroah-Hartman [this message]
2020-12-23 15:33 ` [PATCH 5.10 29/40] fscrypt: remove kernel-internal constants from UAPI header Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 30/40] fscrypt: add fscrypt_is_nokey_name() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 31/40] ubifs: prevent creating duplicate encrypted filenames Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 32/40] ext4: " Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 33/40] f2fs: " Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 34/40] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 35/40] quota: Sanity-check quota file headers on load Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 36/40] fs: quota: fix array-index-out-of-bounds bug by passing correct argument to vfs_cleanup_quota_inode() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 37/40] media: msi2500: assign SPI bus number dynamically Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 38/40] crypto: af_alg - avoid undefined behavior accessing salg_name Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 39/40] nl80211: validate key indexes for cfg80211_registered_device Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 40/40] md: fix a warning caused by a race between concurrent md_ioctl()s Greg Kroah-Hartman
2020-12-24 0:56 ` [PATCH 5.10 00/40] 5.10.3-rc1 review Daniel Díaz
2020-12-26 15:07 ` Greg Kroah-Hartman
2020-12-24 9:43 ` Jeffrin Jose T
2020-12-26 15:06 ` Greg Kroah-Hartman
2020-12-27 15:50 ` Jeffrin Jose T
2020-12-27 16:05 ` Greg Kroah-Hartman
2020-12-27 21:33 ` Jeffrin Jose T
2020-12-28 9:50 ` Pavel Machek
2020-12-28 20:41 ` Guenter Roeck
2021-01-03 13:07 ` Jeffrin Jose T
2021-01-04 6:21 ` Greg Kroah-Hartman
2021-01-06 19:38 ` Jeffrin Jose T
2021-01-06 19:49 ` Greg Kroah-Hartman
2021-01-06 23:56 ` Jeffrin Jose T
2020-12-24 15:26 ` Guenter Roeck
2020-12-26 15:06 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201223150516.892299582@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=aik@ozlabs.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).