From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Yang Yingliang <yangyingliang@huawei.com>
Subject: [PATCH 4.19 70/86] serial: 8250: fix null-ptr-deref in serial8250_start_tx()
Date: Mon, 27 Jul 2020 16:04:44 +0200 [thread overview]
Message-ID: <20200727134917.928280300@linuxfoundation.org> (raw)
In-Reply-To: <20200727134914.312934924@linuxfoundation.org>
From: Yang Yingliang <yangyingliang@huawei.com>
commit f4c23a140d80ef5e6d3d1f8f57007649014b60fa upstream.
I got null-ptr-deref in serial8250_start_tx():
[ 78.114630] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 78.123778] Mem abort info:
[ 78.126560] ESR = 0x86000007
[ 78.129603] EC = 0x21: IABT (current EL), IL = 32 bits
[ 78.134891] SET = 0, FnV = 0
[ 78.137933] EA = 0, S1PTW = 0
[ 78.141064] user pgtable: 64k pages, 48-bit VAs, pgdp=00000027d41a8600
[ 78.147562] [0000000000000000] pgd=00000027893f0003, p4d=00000027893f0003, pud=00000027893f0003, pmd=00000027c9a20003, pte=0000000000000000
[ 78.160029] Internal error: Oops: 86000007 [#1] SMP
[ 78.164886] Modules linked in: sunrpc vfat fat aes_ce_blk crypto_simd cryptd aes_ce_cipher crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce ses enclosure sg sbsa_gwdt ipmi_ssif spi_dw_mmio sch_fq_codel vhost_net tun vhost vhost_iotlb tap ip_tables ext4 mbcache jbd2 ahci hisi_sas_v3_hw libahci hisi_sas_main libsas hns3 scsi_transport_sas hclge libata megaraid_sas ipmi_si hnae3 ipmi_devintf ipmi_msghandler br_netfilter bridge stp llc nvme nvme_core xt_sctp sctp libcrc32c dm_mod nbd
[ 78.207383] CPU: 11 PID: 23258 Comm: null-ptr Not tainted 5.8.0-rc6+ #48
[ 78.214056] Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V3.B210.01 03/12/2020
[ 78.222888] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--)
[ 78.228435] pc : 0x0
[ 78.230618] lr : serial8250_start_tx+0x160/0x260
[ 78.235215] sp : ffff800062eefb80
[ 78.238517] x29: ffff800062eefb80 x28: 0000000000000fff
[ 78.243807] x27: ffff800062eefd80 x26: ffff202fd83b3000
[ 78.249098] x25: ffff800062eefd80 x24: ffff202fd83b3000
[ 78.254388] x23: ffff002fc5e50be8 x22: 0000000000000002
[ 78.259679] x21: 0000000000000001 x20: 0000000000000000
[ 78.264969] x19: ffffa688827eecc8 x18: 0000000000000000
[ 78.270259] x17: 0000000000000000 x16: 0000000000000000
[ 78.275550] x15: ffffa68881bc67a8 x14: 00000000000002e6
[ 78.280841] x13: ffffa68881bc67a8 x12: 000000000000c539
[ 78.286131] x11: d37a6f4de9bd37a7 x10: ffffa68881cccff0
[ 78.291421] x9 : ffffa68881bc6000 x8 : ffffa688819daa88
[ 78.296711] x7 : ffffa688822a0f20 x6 : ffffa688819e0000
[ 78.302002] x5 : ffff800062eef9d0 x4 : ffffa68881e707a8
[ 78.307292] x3 : 0000000000000000 x2 : 0000000000000002
[ 78.312582] x1 : 0000000000000001 x0 : ffffa688827eecc8
[ 78.317873] Call trace:
[ 78.320312] 0x0
[ 78.322147] __uart_start.isra.9+0x64/0x78
[ 78.326229] uart_start+0xb8/0x1c8
[ 78.329620] uart_flush_chars+0x24/0x30
[ 78.333442] n_tty_receive_buf_common+0x7b0/0xc30
[ 78.338128] n_tty_receive_buf+0x44/0x2c8
[ 78.342122] tty_ioctl+0x348/0x11f8
[ 78.345599] ksys_ioctl+0xd8/0xf8
[ 78.348903] __arm64_sys_ioctl+0x2c/0xc8
[ 78.352812] el0_svc_common.constprop.2+0x88/0x1b0
[ 78.357583] do_el0_svc+0x44/0xd0
[ 78.360887] el0_sync_handler+0x14c/0x1d0
[ 78.364880] el0_sync+0x140/0x180
[ 78.368185] Code: bad PC value
SERIAL_PORT_DFNS is not defined on each arch, if it's not defined,
serial8250_set_defaults() won't be called in serial8250_isa_init_ports(),
so the p->serial_in pointer won't be initialized, and it leads a null-ptr-deref.
Fix this problem by calling serial8250_set_defaults() after init uart port.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200721143852.4058352-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -527,6 +527,7 @@ static void __init serial8250_isa_init_p
*/
up->mcr_mask = ~ALPHA_KLUDGE_MCR;
up->mcr_force = ALPHA_KLUDGE_MCR;
+ serial8250_set_defaults(up);
}
/* chain base port ops to support Remote Supervisor Adapter */
@@ -550,7 +551,6 @@ static void __init serial8250_isa_init_p
port->membase = old_serial_port[i].iomem_base;
port->iotype = old_serial_port[i].io_type;
port->regshift = old_serial_port[i].iomem_reg_shift;
- serial8250_set_defaults(up);
port->irqflags |= irqflag;
if (serial8250_isa_config != NULL)
next prev parent reply other threads:[~2020-07-27 14:37 UTC|newest]
Thread overview: 110+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-27 14:03 [PATCH 4.19 00/86] 4.19.135-rc1 review Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 01/86] soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 02/86] gpio: arizona: handle pm_runtime_get_sync failure case Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 03/86] gpio: arizona: put pm_runtime in case of failure Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 04/86] pinctrl: amd: fix npins for uart0 in kerncz_groups Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 05/86] mac80211: allow rx of mesh eapol frames with default rx key Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 06/86] scsi: scsi_transport_spi: Fix function pointer check Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 07/86] xtensa: fix __sync_fetch_and_{and,or}_4 declarations Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 08/86] xtensa: update *pos in cpuinfo_op.next Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 09/86] drivers/net/wan/lapbether: Fixed the value of hard_header_len Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 10/86] net: sky2: initialize return of gm_phy_read Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 11/86] drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 12/86] drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups() Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 13/86] fuse: fix weird page warning Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 14/86] irqdomain/treewide: Keep firmware node unconditionally allocated Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 15/86] SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion") Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 16/86] spi: spi-fsl-dspi: Exit the ISR with IRQ_NONE when its not ours Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 17/86] tipc: clean up skb list lock handling on send path Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 18/86] IB/umem: fix reference count leak in ib_umem_odp_get() Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 19/86] uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 20/86] ALSA: info: Drop WARN_ON() from buffer NULL sanity check Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 21/86] ASoC: rt5670: Correct RT5670_LDO_SEL_MASK Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 22/86] btrfs: fix double free on ulist after backref resolution failure Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 23/86] btrfs: fix mount failure caused by race with umount Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 24/86] btrfs: fix page leaks after failure to lock page for delalloc Greg Kroah-Hartman
2020-07-27 14:03 ` [PATCH 4.19 25/86] bnxt_en: Fix race when modifying pause settings Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 26/86] fpga: dfl: fix bug in port reset handshake Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 27/86] hippi: Fix a size used in a pci_free_consistent() in an error handling path Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 28/86] ax88172a: fix ax88172a_unbind() failures Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 29/86] net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 30/86] ieee802154: fix one possible memleak in adf7242_probe Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 31/86] drm: sun4i: hdmi: Fix inverted HPD result Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 32/86] net: smc91x: Fix possible memory leak in smc_drv_probe() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 33/86] bonding: check error value of register_netdevice() immediately Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 34/86] mlxsw: destroy workqueue when trap_register in mlxsw_emad_init Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 35/86] qed: suppress "dont support RoCE & iWARP" flooding on HW init Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 36/86] ipvs: fix the connection sync failed in some cases Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 37/86] net: ethernet: ave: Fix error returns in ave_init Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 38/86] i2c: rcar: always clear ICSAR to avoid side effects Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 39/86] bonding: check return value of register_netdevice() in bond_newlink() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 40/86] serial: exar: Fix GPIO configuration for Sealevel cards based on XR17V35X Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 41/86] scripts/decode_stacktrace: strip basepath from all paths Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 42/86] scripts/gdb: fix lx-symbols gdb.error while loading modules Greg Kroah-Hartman
2020-07-27 14:26 ` Kieran Bingham
2020-07-27 14:37 ` Stefano Garzarella
2020-07-27 14:40 ` Kieran Bingham
2020-07-27 14:38 ` Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 43/86] HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 44/86] HID: alps: support devices with report id 2 Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 45/86] HID: steam: fixes race in handling device list Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 46/86] HID: apple: Disable Fn-key key-re-mapping on clone keyboards Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 47/86] dmaengine: tegra210-adma: Fix runtime PM imbalance on error Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 48/86] Input: add `SW_MACHINE_COVER` Greg Kroah-Hartman
2020-07-27 21:26 ` Pavel Machek
2020-07-27 22:00 ` Dmitry Torokhov
2020-07-27 14:04 ` [PATCH 4.19 49/86] spi: mediatek: use correct SPI_CFG2_REG MACRO Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 50/86] regmap: dev_get_regmap_match(): fix string comparison Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 51/86] hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 52/86] dmaengine: ioat setting ioat timeout as module parameter Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 53/86] Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 54/86] Input: elan_i2c - only increment wakeup count on touch Greg Kroah-Hartman
2020-07-27 21:29 ` Pavel Machek
2020-07-27 22:01 ` Dmitry Torokhov
2020-07-27 22:18 ` dbasehore .
2020-07-27 23:29 ` Sasha Levin
2020-07-27 14:04 ` [PATCH 4.19 55/86] usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 56/86] hwmon: (adm1275) Make sure we are reading enough data for different chips Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 57/86] hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe() Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 58/86] arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 59/86] x86: math-emu: Fix up cmp insn for clang ias Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 60/86] RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 61/86] binder: Dont use mmput() from shrinker function Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 62/86] usb: xhci-mtk: fix the failure of bandwidth allocation Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 63/86] usb: xhci: Fix ASM2142/ASM3142 DMA addressing Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 64/86] Revert "cifs: Fix the target file was deleted when rename failed." Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 65/86] staging: wlan-ng: properly check endpoint types Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 66/86] staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 67/86] staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 68/86] staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 69/86] staging: comedi: addi_apci_1564: " Greg Kroah-Hartman
2020-07-27 14:04 ` Greg Kroah-Hartman [this message]
2020-07-27 14:04 ` [PATCH 4.19 71/86] serial: 8250_mtk: Fix high-speed baud rates clamping Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 72/86] fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 73/86] vt: Reject zero-sized screen buffer size Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 74/86] Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 75/86] mm/memcg: fix refcount error while moving and swapping Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 76/86] mm: memcg/slab: fix memory leak at non-root kmem_cache destroy Greg Kroah-Hartman
2020-07-28 12:56 ` [External] " Muchun Song
2020-07-28 15:00 ` Greg Kroah-Hartman
2020-07-28 15:17 ` Sasha Levin
2020-07-28 15:27 ` Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 77/86] io-mapping: indicate mapping failure Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 78/86] drm/amdgpu: Fix NULL dereference in dpm sysfs handlers Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 79/86] drm/amd/powerplay: fix a crash when overclocking Vega M Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 80/86] parisc: Add atomic64_set_release() define to avoid CPU soft lockups Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 81/86] x86, vmlinux.lds: Page-align end of ..page_aligned sections Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 82/86] ASoC: rt5670: Add new gpio1_is_ext_spk_en quirk and enable it on the Lenovo Miix 2 10 Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 83/86] ASoC: qcom: Drop HAS_DMA dependency to fix link failure Greg Kroah-Hartman
2020-07-27 14:04 ` [PATCH 4.19 84/86] dm integrity: fix integrity recalculation that is improperly skipped Greg Kroah-Hartman
2020-07-27 20:56 ` Pavel Machek
2020-07-27 23:31 ` Sasha Levin
2020-07-28 0:24 ` Mike Snitzer
2020-07-27 14:04 ` [PATCH 4.19 85/86] ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Greg Kroah-Hartman
2020-07-27 14:05 ` [PATCH 4.19 86/86] ath9k: Fix regression with Atheros 9271 Greg Kroah-Hartman
2020-07-27 14:45 ` [PATCH 4.19 00/86] 4.19.135-rc1 review Thierry Reding
2020-07-28 1:37 ` Shuah Khan
2020-07-28 8:34 ` Naresh Kamboju
2020-07-28 13:03 ` [External] " Muchun Song
2020-07-28 14:35 ` Naresh Kamboju
2020-07-28 21:18 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200727134917.928280300@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).