linux/drivers/tty
George Kennedy 9196e42a3b serial: core: check uartclk for zero to avoid divide by zero
commit 6eabce6608 upstream.

Calling ioctl TIOCSSERIAL with an invalid baud_base can
result in uartclk being zero, which will result in a
divide by zero error in uart_get_divisor(). The check for
uartclk being zero in uart_set_info() needs to be done
before other settings are made as subsequent calls to
ioctl TIOCSSERIAL for the same port would be impacted if
the uartclk check was done where uartclk gets set.

Oops: divide error: 0000  PREEMPT SMP KASAN PTI
RIP: 0010:uart_get_divisor (drivers/tty/serial/serial_core.c:580)
Call Trace:
 <TASK>
serial8250_get_divisor (drivers/tty/serial/8250/8250_port.c:2576
    drivers/tty/serial/8250/8250_port.c:2589)
serial8250_do_set_termios (drivers/tty/serial/8250/8250_port.c:502
    drivers/tty/serial/8250/8250_port.c:2741)
serial8250_set_termios (drivers/tty/serial/8250/8250_port.c:2862)
uart_change_line_settings (./include/linux/spinlock.h:376
    ./include/linux/serial_core.h:608 drivers/tty/serial/serial_core.c:222)
uart_port_startup (drivers/tty/serial/serial_core.c:342)
uart_startup (drivers/tty/serial/serial_core.c:368)
uart_set_info (drivers/tty/serial/serial_core.c:1034)
uart_set_info_user (drivers/tty/serial/serial_core.c:1059)
tty_set_serial (drivers/tty/tty_io.c:2637)
tty_ioctl (drivers/tty/tty_io.c:2647 drivers/tty/tty_io.c:2791)
__x64_sys_ioctl (fs/ioctl.c:52 fs/ioctl.c:907
    fs/ioctl.c:893 fs/ioctl.c:893)
do_syscall_64 (arch/x86/entry/common.c:52
    (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

Reported-by: syzkaller <syzkaller@googlegroups.com>
Cc: stable@vger.kernel.org
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Rule: add
Link: https://lore.kernel.org/stable/1721148848-9784-1-git-send-email-george.kennedy%40oracle.com
Link: https://lore.kernel.org/r/1721219078-3209-1-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2024-08-19 05:45:46 +02:00
..
hvc hvc/xen: fix event channel handling for secondary consoles 2023-11-28 16:56:28 +00:00
ipwireless tty: drop put_tty_driver 2021-07-27 12:17:21 +02:00
serdev TTY / Serial patches for 5.15-rc1 2021-09-01 09:51:16 -07:00
serial serial: core: check uartclk for zero to avoid divide by zero 2024-08-19 05:45:46 +02:00
vt vt: fix unicode buffer corruption when deleting characters 2024-04-10 16:18:46 +02:00
amiserial.c tty: drop put_tty_driver 2021-07-27 12:17:21 +02:00
ehv_bytechan.c tty: drop put_tty_driver 2021-07-27 12:17:21 +02:00
goldfish.c tty: drivers/tty/, stop using tty_schedule_flip() 2022-07-29 17:25:31 +02:00
Kconfig This pull request contains the following changes for UML: 2021-07-09 10:19:13 -07:00
Makefile tty: remove broken r3964 line discipline 2021-05-13 16:57:15 +02:00
mips_ejtag_fdc.c tty: drop put_tty_driver 2021-07-27 12:17:21 +02:00
moxa.c tty: drivers/tty/, stop using tty_schedule_flip() 2022-07-29 17:25:31 +02:00
moxa.h tty: fix spelling mistake 2020-06-27 16:21:20 +02:00
mxser.c mxser: fix xmit_buf leak in activate when LSR == 0xff 2022-04-08 14:23:43 +02:00
n_gsm.c tty: n_gsm: fix missing receive state reset after mode switch 2024-06-16 13:39:11 +02:00
n_hdlc.c tty: n_hdlc: make n_hdlc_tty_wakeup() asynchronous 2021-12-22 09:32:45 +01:00
n_null.c tty: make tty_ldisc_ops a param in tty_unregister_ldisc 2021-05-13 16:57:16 +02:00
n_tty.c tty: fix hang on tty device with no_room set 2023-08-03 10:22:29 +02:00
nozomi.c tty: drop put_tty_driver 2021-07-27 12:17:21 +02:00
pty.c tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() 2022-07-29 17:25:32 +02:00
synclink_gt.c tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() 2022-06-14 18:36:20 +02:00
sysrq.c tty/sysrq: replace smp_processor_id() with get_cpu() 2023-11-28 16:56:27 +00:00
tty.h tty: change tty_write_lock()'s ndelay parameter to bool 2024-01-25 14:52:51 -08:00
tty_audit.c tty: audit: move some local functions out of tty.h 2021-04-15 10:24:58 +02:00
tty_baudrate.c tty: tty_baudrate: Fix coding style issues of block comments 2021-05-13 18:29:12 +02:00
tty_buffer.c tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() 2022-07-29 17:25:32 +02:00
tty_io.c usb: cdc-acm: return correct error code on unsupported break 2024-01-25 14:52:52 -08:00
tty_ioctl.c tty: allow TIOCSLCKTRMIOS with CAP_CHECKPOINT_RESTORE 2024-02-23 08:54:51 +01:00
tty_jobctrl.c tty: tty_jobctrl: fix pid memleak in disassociate_ctty() 2023-11-20 11:08:25 +01:00
tty_ldisc.c tty: unexport tty_ldisc_release 2021-09-14 11:18:47 +02:00
tty_ldsem.c locking/lockdep: Remove unused @nested argument from lock_release() 2019-10-09 12:46:10 +02:00
tty_mutex.c tty: move some internal tty lock enums and functions out of tty.h 2021-04-15 10:26:58 +02:00
tty_port.c tty: tty_port: Fix coding style issues of block comments 2021-05-13 18:29:13 +02:00
ttynull.c tty: drop put_tty_driver 2021-07-27 12:17:21 +02:00
vcc.c tty: vcc: Add check for kstrdup() in vcc_probe() 2023-11-28 16:56:19 +00:00