From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Yang Yingliang <yangyingliang@huawei.com>
Subject: [PATCH 4.9 37/61] serial: 8250: fix null-ptr-deref in serial8250_start_tx()
Date: Thu, 30 Jul 2020 10:04:55 +0200 [thread overview]
Message-ID: <20200730074422.627820232@linuxfoundation.org> (raw)
In-Reply-To: <20200730074420.811058810@linuxfoundation.org>
From: Yang Yingliang <yangyingliang@huawei.com>
commit f4c23a140d80ef5e6d3d1f8f57007649014b60fa upstream.
I got null-ptr-deref in serial8250_start_tx():
[ 78.114630] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 78.123778] Mem abort info:
[ 78.126560] ESR = 0x86000007
[ 78.129603] EC = 0x21: IABT (current EL), IL = 32 bits
[ 78.134891] SET = 0, FnV = 0
[ 78.137933] EA = 0, S1PTW = 0
[ 78.141064] user pgtable: 64k pages, 48-bit VAs, pgdp=00000027d41a8600
[ 78.147562] [0000000000000000] pgd=00000027893f0003, p4d=00000027893f0003, pud=00000027893f0003, pmd=00000027c9a20003, pte=0000000000000000
[ 78.160029] Internal error: Oops: 86000007 [#1] SMP
[ 78.164886] Modules linked in: sunrpc vfat fat aes_ce_blk crypto_simd cryptd aes_ce_cipher crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce ses enclosure sg sbsa_gwdt ipmi_ssif spi_dw_mmio sch_fq_codel vhost_net tun vhost vhost_iotlb tap ip_tables ext4 mbcache jbd2 ahci hisi_sas_v3_hw libahci hisi_sas_main libsas hns3 scsi_transport_sas hclge libata megaraid_sas ipmi_si hnae3 ipmi_devintf ipmi_msghandler br_netfilter bridge stp llc nvme nvme_core xt_sctp sctp libcrc32c dm_mod nbd
[ 78.207383] CPU: 11 PID: 23258 Comm: null-ptr Not tainted 5.8.0-rc6+ #48
[ 78.214056] Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V3.B210.01 03/12/2020
[ 78.222888] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--)
[ 78.228435] pc : 0x0
[ 78.230618] lr : serial8250_start_tx+0x160/0x260
[ 78.235215] sp : ffff800062eefb80
[ 78.238517] x29: ffff800062eefb80 x28: 0000000000000fff
[ 78.243807] x27: ffff800062eefd80 x26: ffff202fd83b3000
[ 78.249098] x25: ffff800062eefd80 x24: ffff202fd83b3000
[ 78.254388] x23: ffff002fc5e50be8 x22: 0000000000000002
[ 78.259679] x21: 0000000000000001 x20: 0000000000000000
[ 78.264969] x19: ffffa688827eecc8 x18: 0000000000000000
[ 78.270259] x17: 0000000000000000 x16: 0000000000000000
[ 78.275550] x15: ffffa68881bc67a8 x14: 00000000000002e6
[ 78.280841] x13: ffffa68881bc67a8 x12: 000000000000c539
[ 78.286131] x11: d37a6f4de9bd37a7 x10: ffffa68881cccff0
[ 78.291421] x9 : ffffa68881bc6000 x8 : ffffa688819daa88
[ 78.296711] x7 : ffffa688822a0f20 x6 : ffffa688819e0000
[ 78.302002] x5 : ffff800062eef9d0 x4 : ffffa68881e707a8
[ 78.307292] x3 : 0000000000000000 x2 : 0000000000000002
[ 78.312582] x1 : 0000000000000001 x0 : ffffa688827eecc8
[ 78.317873] Call trace:
[ 78.320312] 0x0
[ 78.322147] __uart_start.isra.9+0x64/0x78
[ 78.326229] uart_start+0xb8/0x1c8
[ 78.329620] uart_flush_chars+0x24/0x30
[ 78.333442] n_tty_receive_buf_common+0x7b0/0xc30
[ 78.338128] n_tty_receive_buf+0x44/0x2c8
[ 78.342122] tty_ioctl+0x348/0x11f8
[ 78.345599] ksys_ioctl+0xd8/0xf8
[ 78.348903] __arm64_sys_ioctl+0x2c/0xc8
[ 78.352812] el0_svc_common.constprop.2+0x88/0x1b0
[ 78.357583] do_el0_svc+0x44/0xd0
[ 78.360887] el0_sync_handler+0x14c/0x1d0
[ 78.364880] el0_sync+0x140/0x180
[ 78.368185] Code: bad PC value
SERIAL_PORT_DFNS is not defined on each arch, if it's not defined,
serial8250_set_defaults() won't be called in serial8250_isa_init_ports(),
so the p->serial_in pointer won't be initialized, and it leads a null-ptr-deref.
Fix this problem by calling serial8250_set_defaults() after init uart port.
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200721143852.4058352-1-yangyingliang@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -529,6 +529,7 @@ static void __init serial8250_isa_init_p
*/
up->mcr_mask = ~ALPHA_KLUDGE_MCR;
up->mcr_force = ALPHA_KLUDGE_MCR;
+ serial8250_set_defaults(up);
}
/* chain base port ops to support Remote Supervisor Adapter */
@@ -552,7 +553,6 @@ static void __init serial8250_isa_init_p
port->membase = old_serial_port[i].iomem_base;
port->iotype = old_serial_port[i].io_type;
port->regshift = old_serial_port[i].iomem_reg_shift;
- serial8250_set_defaults(up);
port->irqflags |= irqflag;
if (serial8250_isa_config != NULL)
next prev parent reply other threads:[~2020-07-30 8:17 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-30 8:04 [PATCH 4.9 00/61] 4.9.232-rc1 review Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 01/61] pinctrl: amd: fix npins for uart0 in kerncz_groups Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 02/61] mac80211: allow rx of mesh eapol frames with default rx key Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 03/61] scsi: scsi_transport_spi: Fix function pointer check Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 04/61] xtensa: fix __sync_fetch_and_{and,or}_4 declarations Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 05/61] xtensa: update *pos in cpuinfo_op.next Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 06/61] drivers/net/wan/lapbether: Fixed the value of hard_header_len Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 07/61] net: sky2: initialize return of gm_phy_read Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 08/61] drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 09/61] SUNRPC reverting d03727b248d0 ("NFSv4 fix CLOSE not waiting for direct IO compeletion") Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 10/61] uprobes: Change handle_swbp() to send SIGTRAP with si_code=SI_KERNEL, to fix GDB regression Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 11/61] ALSA: info: Drop WARN_ON() from buffer NULL sanity check Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 12/61] ASoC: rt5670: Correct RT5670_LDO_SEL_MASK Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 13/61] btrfs: fix double free on ulist after backref resolution failure Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 14/61] btrfs: fix mount failure caused by race with umount Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 15/61] bnxt_en: Fix race when modifying pause settings Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 16/61] hippi: Fix a size used in a pci_free_consistent() in an error handling path Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 17/61] ax88172a: fix ax88172a_unbind() failures Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 18/61] net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual configuration Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 19/61] net: smc91x: Fix possible memory leak in smc_drv_probe() Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 20/61] scripts/decode_stacktrace: strip basepath from all paths Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 21/61] HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 22/61] HID: apple: Disable Fn-key key-re-mapping on clone keyboards Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 23/61] dmaengine: tegra210-adma: Fix runtime PM imbalance on error Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 24/61] regmap: dev_get_regmap_match(): fix string comparison Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 25/61] dmaengine: ioat setting ioat timeout as module parameter Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 26/61] usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init() Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 27/61] arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 28/61] x86: math-emu: Fix up cmp insn for clang ias Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 29/61] usb: xhci-mtk: fix the failure of bandwidth allocation Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 30/61] usb: xhci: Fix ASM2142/ASM3142 DMA addressing Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 31/61] Revert "cifs: Fix the target file was deleted when rename failed." Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 32/61] staging: wlan-ng: properly check endpoint types Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 33/61] staging: comedi: addi_apci_1032: check INSN_CONFIG_DIGITAL_TRIG shift Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 34/61] staging: comedi: ni_6527: fix INSN_CONFIG_DIGITAL_TRIG support Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 35/61] staging: comedi: addi_apci_1500: check INSN_CONFIG_DIGITAL_TRIG shift Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 36/61] staging: comedi: addi_apci_1564: " Greg Kroah-Hartman
2020-07-30 8:04 ` Greg Kroah-Hartman [this message]
2020-07-30 8:04 ` [PATCH 4.9 38/61] serial: 8250_mtk: Fix high-speed baud rates clamping Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 39/61] vt: Reject zero-sized screen buffer size Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 40/61] Makefile: Fix GCC_TOOLCHAIN_DIR prefix for Clang cross compilation Greg Kroah-Hartman
2020-07-30 8:04 ` [PATCH 4.9 41/61] mm/memcg: fix refcount error while moving and swapping Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 42/61] io-mapping: indicate mapping failure Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 43/61] parisc: Add atomic64_set_release() define to avoid CPU soft lockups Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 44/61] ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 45/61] ath9k: Fix regression with Atheros 9271 Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 46/61] AX.25: Fix out-of-bounds read in ax25_connect() Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 47/61] AX.25: Prevent out-of-bounds read in ax25_sendmsg() Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 48/61] dev: Defer free of skbs in flush_backlog Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 49/61] net-sysfs: add a newline when printing tx_timeout by sysfs Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 50/61] net: udp: Fix wrong clean up for IS_UDPLITE macro Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 51/61] rxrpc: Fix sendmsg() returning EPIPE due to recvmsg() returning ENODATA Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 52/61] AX.25: Prevent integer overflows in connect and sendmsg Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 53/61] tcp: allow at most one TLP probe per flight Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 54/61] ip6_gre: fix null-ptr-deref in ip6gre_init_net() Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 55/61] drivers/net/wan/x25_asy: Fix to make it work Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 56/61] regmap: debugfs: check count when read regmap file Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 57/61] xfs: set format back to extents if xfs_bmap_extents_to_btree Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 58/61] perf probe: Fix to check blacklist address correctly Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 59/61] perf annotate: Use asprintf when formatting objdump command line Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 60/61] perf tools: Fix snprint warnings for gcc 8 Greg Kroah-Hartman
2020-07-30 8:05 ` [PATCH 4.9 61/61] perf: Make perf able to build with latest libbfd Greg Kroah-Hartman
2020-07-30 16:46 ` [PATCH 4.9 00/61] 4.9.232-rc1 review Guenter Roeck
2020-07-31 12:41 ` Jon Hunter
2020-07-31 12:43 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200730074422.627820232@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).