LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Darwin Dingel <Darwin.Dingel@alliedtelesis.co.nz>
To: "zhe.he@windriver.com" <zhe.he@windriver.com>,
	"gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>,
	"jslaby@suse.com" <jslaby@suse.com>,
	"andriy.shevchenko@linux.intel.com" 
	<andriy.shevchenko@linux.intel.com>,
	"bigeasy@linutronix.de" <bigeasy@linutronix.de>,
	"Jisheng.Zhang@synaptics.com" <Jisheng.Zhang@synaptics.com>,
	"linux-serial@vger.kernel.org" <linux-serial@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] serial: 8250: Fix serial8250 initialization crash
Date: Thu, 17 Jan 2019 19:49:53 +0000
Message-ID: <41c574bfdce7490597079dae8f328661@svr-chch-ex1.atlnz.lc> (raw)
In-Reply-To: <1547715619-181299-1-git-send-email-zhe.he@windriver.com>

On 17/01/19 10:00 PM, zhe.he@windriver.com wrote:
> From: He Zhe <zhe.he@windriver.com>
> 
> The initialization code of interrupt backoff work might reference NULL
> pointer and cause the following crash, if no port was found.
> 
> [   10.017727] CPU 0 Unable to handle kernel paging request at virtual address 000001b0, epc == 807088e0, ra == 8070863c
> ---- snip ----
> [   11.704470] [<807088e0>] serial8250_register_8250_port+0x318/0x4ac
> [   11.747251] [<80708d74>] serial8250_probe+0x148/0x1c0
> [   11.789301] [<80728450>] platform_drv_probe+0x40/0x94
> [   11.830515] [<807264f8>] really_probe+0xf8/0x318
> [   11.870876] [<80726b7c>] __driver_attach+0x110/0x12c
> [   11.910960] [<80724374>] bus_for_each_dev+0x78/0xcc
> [   11.951134] [<80725958>] bus_add_driver+0x200/0x234
> [   11.989756] [<807273d8>] driver_register+0x84/0x148
> [   12.029832] [<80d72f84>] serial8250_init+0x138/0x198
> [   12.070447] [<80100e6c>] do_one_initcall+0x5c/0x2a0
> [   12.110104] [<80d3a208>] kernel_init_freeable+0x370/0x484
> [   12.150722] [<80a49420>] kernel_init+0x10/0xf8
> [   12.191517] [<8010756c>] ret_from_kernel_thread+0x14/0x1c
> 
> This patch makes sure the initialization code can be reached only if a port
> is found.
> 
> Fixes: commit 6d7f677a2afa ("serial: 8250: Rate limit serial port rx interrupts during input overruns")
> Signed-off-by: He Zhe <zhe.he@windriver.com>
> ---
>   drivers/tty/serial/8250/8250_core.c | 17 +++++++++--------
>   1 file changed, 9 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
> index 189ab12..e441221 100644
> --- a/drivers/tty/serial/8250/8250_core.c
> +++ b/drivers/tty/serial/8250/8250_core.c
> @@ -1070,15 +1070,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
>   
>   			ret = 0;
>   		}
> -	}
>   
> -	/* Initialise interrupt backoff work if required */
> -	if (up->overrun_backoff_time_ms > 0) {
> -		uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
> -		INIT_DELAYED_WORK(&uart->overrun_backoff,
> -				  serial_8250_overrun_backoff_work);
> -	} else {
> -		uart->overrun_backoff_time_ms = 0;
> +		/* Initialise interrupt backoff work if required */
> +		if (up->overrun_backoff_time_ms > 0) {
> +			uart->overrun_backoff_time_ms =
> +				up->overrun_backoff_time_ms;
> +			INIT_DELAYED_WORK(&uart->overrun_backoff,
> +					serial_8250_overrun_backoff_work);
> +		} else {
> +			uart->overrun_backoff_time_ms = 0;
> +		}
>   	}
>   
>   	mutex_unlock(&serial_mutex);
> 

Reviewed-by: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>

I presume this is the same issue reported here:

https://www.spinics.net/lists/linux-serial/msg33114.html
https://lkml.org/lkml/2018/12/22/171



Thanks!
Regards,

Darwin

  reply index

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-01-17  9:00 zhe.he
2019-01-17 19:49 ` Darwin Dingel [this message]
2019-01-17 20:06   ` Darwin Dingel
2019-01-18 12:02 ` Greg KH

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=41c574bfdce7490597079dae8f328661@svr-chch-ex1.atlnz.lc \
    --to=darwin.dingel@alliedtelesis.co.nz \
    --cc=Jisheng.Zhang@synaptics.com \
    --cc=andriy.shevchenko@linux.intel.com \
    --cc=bigeasy@linutronix.de \
    --cc=gregkh@linuxfoundation.org \
    --cc=jslaby@suse.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-serial@vger.kernel.org \
    --cc=zhe.he@windriver.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org linux-kernel@archiver.kernel.org
	public-inbox-index lkml


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox