Jiangfeng Xiao 7d73170e1c serial: serial_core: Perform NULL checks for break_ctl ops ... Doing fuzz test on sbsa uart device, causes a kernel crash due to NULL pointer dereference: ------------[ cut here ]------------ Unable to handle kernel paging request at virtual address fffffffffffffffc pgd = ffffffe331723000 [fffffffffffffffc] *pgd=0000002333595003, *pud=0000002333595003, *pmd=00000 Internal error: Oops: 96000005 [#1] PREEMPT SMP Modules linked in: ping(O) jffs2 rtos_snapshot(O) pramdisk(O) hisi_sfc(O) Drv_Nandc_K(O) Drv_SysCtl_K(O) Drv_SysClk_K(O) bsp_reg(O) hns3(O) hns3_uio_enet(O) hclgevf(O) hclge(O) hnae3(O) mdio_factory(O) mdio_registry(O) mdio_dev(O) mdio(O) hns3_info(O) rtos_kbox_panic(O) uart_suspend(O) rsm(O) stp llc tunnel4 xt_tcpudp ipt_REJECT nf_reject_ipv4 iptable_filter ip_tables x_tables sd_mod xhci_plat_hcd xhci_pci xhci_hcd usbmon usbhid usb_storage ohci_platform ohci_pci ohci_hcd hid_generic hid ehci_platform ehci_pci ehci_hcd vfat fat usbcore usb_common scsi_mod yaffs2multi(O) ext4 jbd2 ext2 mbcache ofpart i2c_dev i2c_core uio ubi nand nand_ecc nand_ids cfi_cmdset_0002 cfi_cmdset_0001 cfi_probe gen_probe cmdlinepart chipreg mtdblock mtd_blkdevs mtd nfsd auth_rpcgss oid_registry nfsv3 nfs nfs_acl lockd sunrpc grace autofs4 CPU: 2 PID: 2385 Comm: tty_fuzz_test Tainted: G O 4.4.193 #1 task: ffffffe32b23f110 task.stack: ffffffe32bda4000 PC is at uart_break_ctl+0x44/0x84 LR is at uart_break_ctl+0x34/0x84 pc : [<ffffff8393196098>] lr : [<ffffff8393196088>] pstate: 80000005 sp : ffffffe32bda7cc0 x29: ffffffe32bda7cc0 x28: ffffffe32b23f110 x27: ffffff8393402000 x26: 0000000000000000 x25: ffffffe32b233f40 x24: ffffffc07a8ec680 x23: 0000000000005425 x22: 00000000ffffffff x21: ffffffe33ed73c98 x20: 0000000000000000 x19: ffffffe33ed94168 x18: 0000000000000004 x17: 0000007f92ae9d30 x16: ffffff8392fa6064 x15: 0000000000000010 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000020 x10: 0000007ffdac1708 x9 : 0000000000000078 x8 : 000000000000001d x7 : 0000000052a64887 x6 : ffffffe32bda7e08 x5 : ffffffe32b23c000 x4 : 0000005fbc5b0000 x3 : ffffff83938d5018 x2 : 0000000000000080 x1 : ffffffe32b23c040 x0 : ffffff83934428f8 virtual start addr offset is 38ac00000 module base offset is 2cd4cf1000 linear region base offset is : 0 Process tty_fuzz_test (pid: 2385, stack limit = 0xffffffe32bda4000) Stack: (0xffffffe32bda7cc0 to 0xffffffe32bda8000) 7cc0: ffffffe32bda7cf0 ffffff8393177718 ffffffc07a8ec680 ffffff8393196054 7ce0: 000000001739f2e0 0000007ffdac1978 ffffffe32bda7d20 ffffff8393179a1c 7d00: 0000000000000000 ffffff8393c0a000 ffffffc07a8ec680 cb88537fdc8ba600 7d20: ffffffe32bda7df0 ffffff8392fa5a40 ffffff8393c0a000 0000000000005425 7d40: 0000007ffdac1978 ffffffe32b233f40 ffffff8393178dcc 0000000000000003 7d60: 000000000000011d 000000000000001d ffffffe32b23f110 000000000000029e 7d80: ffffffe34fe8d5d0 0000000000000000 ffffffe32bda7e14 cb88537fdc8ba600 7da0: ffffffe32bda7e30 ffffff8393042cfc ffffff8393c41720 ffffff8393c46410 7dc0: ffffff839304fa68 ffffffe32b233f40 0000000000005425 0000007ffdac1978 7de0: 000000000000011d cb88537fdc8ba600 ffffffe32bda7e70 ffffff8392fa60cc 7e00: 0000000000000000 ffffffe32b233f40 ffffffe32b233f40 0000000000000003 7e20: 0000000000005425 0000007ffdac1978 ffffffe32bda7e70 ffffff8392fa60b0 7e40: 0000000000000280 ffffffe32b233f40 ffffffe32b233f40 0000000000000003 7e60: 0000000000005425 cb88537fdc8ba600 0000000000000000 ffffff8392e02e78 7e80: 0000000000000280 0000005fbc5b0000 ffffffffffffffff 0000007f92ae9d3c 7ea0: 0000000060000000 0000000000000015 0000000000000003 0000000000005425 7ec0: 0000007ffdac1978 0000000000000000 00000000a54c910e 0000007f92b95014 7ee0: 0000007f92b95090 0000000052a64887 000000000000001d 0000000000000078 7f00: 0000007ffdac1708 0000000000000020 0000000000000000 0000000000000000 7f20: 0000000000000000 0000000000000010 000000556acf0090 0000007f92ae9d30 7f40: 0000000000000004 000000556acdef10 0000000000000000 000000556acdebd0 7f60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7f80: 0000000000000000 0000000000000000 0000000000000000 0000007ffdac1840 7fa0: 000000556acdedcc 0000007ffdac1840 0000007f92ae9d3c 0000000060000000 7fc0: 0000000000000000 0000000000000000 0000000000000003 000000000000001d 7fe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 Call trace: Exception stack(0xffffffe32bda7ab0 to 0xffffffe32bda7bf0) 7aa0: 0000000000001000 0000007fffffffff 7ac0: ffffffe32bda7cc0 ffffff8393196098 0000000080000005 0000000000000025 7ae0: ffffffe32b233f40 ffffff83930d777c ffffffe32bda7b30 ffffff83930d777c 7b00: ffffffe32bda7be0 ffffff83938d5000 ffffffe32bda7be0 ffffffe32bda7c20 7b20: ffffffe32bda7b60 ffffff83930d777c ffffffe32bda7c10 ffffff83938d5000 7b40: ffffffe32bda7c10 ffffffe32bda7c50 ffffff8393c0a000 ffffffe32b23f110 7b60: ffffffe32bda7b70 ffffff8392e09df4 ffffffe32bda7bb0 cb88537fdc8ba600 7b80: ffffff83934428f8 ffffffe32b23c040 0000000000000080 ffffff83938d5018 7ba0: 0000005fbc5b0000 ffffffe32b23c000 ffffffe32bda7e08 0000000052a64887 7bc0: 000000000000001d 0000000000000078 0000007ffdac1708 0000000000000020 7be0: 0000000000000000 0000000000000000 [<ffffff8393196098>] uart_break_ctl+0x44/0x84 [<ffffff8393177718>] send_break+0xa0/0x114 [<ffffff8393179a1c>] tty_ioctl+0xc50/0xe84 [<ffffff8392fa5a40>] do_vfs_ioctl+0xc4/0x6e8 [<ffffff8392fa60cc>] SyS_ioctl+0x68/0x9c [<ffffff8392e02e78>] __sys_trace_return+0x0/0x4 Code: b9410ea0 34000160 f9408aa0 f9402814 (b85fc280) ---[ end trace 8606094f1960c5e0 ]--- Kernel panic - not syncing: Fatal exception Fix this problem by adding NULL checks prior to calling break_ctl ops. Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/1574263133-28259-1-git-send-email-xiaojiangfeng@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-11-21 08:24:43 +01:00
..
accessibility
acpi	ACPI fix for 5.4-rc5	2019-10-24 15:49:32 -04:00
amba	ARM updates for 5.4-rc:	2019-10-23 06:26:33 -04:00
android	binder: Don't modify VMA bounds in ->mmap handler	2019-10-17 05:58:44 -07:00
ata	ata: libahci_platform: Fix regulator_get_optional() misuse	2019-10-25 14:22:20 -06:00
atm	atm: he: clean up an indentation issue	2019-09-25 13:54:45 +02:00
auxdisplay	It's a somewhat calmer cycle for docs this time, as the churn of the mass	2019-09-17 16:22:26 -07:00
base	PM: QoS: Drop frequency QoS types from device PM QoS	2019-10-21 02:05:21 +02:00
bcma	bcma: make arrays pwr_info_offset and sprom_sizes static const, shrinks object size	2019-09-13 16:44:49 +03:00
block	nbd: verify socket is supported during setup	2019-10-25 14:37:21 -06:00
bluetooth	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-09-15 14:17:27 +02:00
bus	bus: ti-sysc: Fix watchdog quirk handling	2019-10-18 08:45:32 -07:00
cdrom
char	char/random: Add a newline at the end of the file	2019-10-02 13:49:43 -07:00
clk	Merge tag 'fix-missing-panels' into fixes	2019-10-04 09:06:41 -07:00
clocksource	timer-of: don't use conditional expression with mixed 'void' types	2019-10-02 16:16:07 -07:00
connector
counter
cpufreq	cpufreq: Cancel policy update work scheduled before freeing	2019-10-22 18:07:30 +02:00
cpuidle	cpuidle: haltpoll: Take 'idle=' override into account	2019-10-22 11:43:17 +02:00
crypto	Merge branch 'akpm' (patches from Andrew)	2019-09-24 16:10:23 -07:00
dax
dca
devfreq
dio
dma	Main MIPS changes for v5.4:	2019-09-22 09:30:30 -07:00
dma-buf	dma-buf/resv: fix exclusive fence get	2019-10-10 17:05:20 +02:00
edac	EDAC/ghes: Fix Use after free in ghes_edac remove path	2019-10-17 11:27:05 +02:00
eisa
extcon	chrome platform changes for v5.4	2019-09-19 14:14:28 -07:00
firewire
firmware	Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging	2019-10-15 09:20:07 -07:00
fpga	Char/Misc driver patches for 5.4-rc1	2019-09-18 11:14:31 -07:00
fsi
gnss
gpio	gpio: lynxpoint: set default handler to be handle_bad_irq()	2019-10-15 01:19:05 +02:00
gpu	Merge tag 'drm-fixes-5.4-2019-10-23' of git://people.freedesktop.org/~agd5f/linux into drm-fixes	2019-10-25 14:48:53 +10:00
greybus
hid	HID: hyperv: Use in-place iterator API in the channel callback	2019-10-01 14:49:41 -04:00
hsi	HSI changes for the 5.4 series	2019-09-22 12:02:21 -07:00
hv	Drivers: hv: vmbus: Fix harmless building warnings without CONFIG_PM_SLEEP	2019-10-01 14:49:45 -04:00
hwmon	hwmon: (nct7904) Add array fan_alarm and vsen_alarm to store the alarms in nct7904_data struct.	2019-10-02 06:42:48 -07:00
hwspinlock
hwtracing	Char/Misc driver patches for 5.4-rc1	2019-09-18 11:14:31 -07:00
i2c	i2c: stm32f7: remove warning when compiling with W=1	2019-10-24 20:52:21 +02:00
i3c
ide
idle
iio	First set of IIO fixes for the 5.4 cycle.	2019-10-10 11:18:37 +02:00
infiniband	RDMA/mlx5: Add missing synchronize_srcu() for MW cases	2019-10-04 15:54:22 -03:00
input	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2019-10-25 17:31:53 -04:00
interconnect
iommu	dma-mapping fix for 5.4	2019-10-26 06:29:04 -04:00
ipack
irqchip	irqchip updates for 5.4, take 2	2019-10-25 14:25:15 +02:00
isdn	mISDN: enforce CAP_NET_RAW for raw sockets	2019-09-24 16:37:18 +02:00
leds	leds: lm3532: Fix optional led-max-microamp prop error handling	2019-09-12 20:45:52 +02:00
lightnvm	lightnvm: print error when target is not found	2019-09-05 13:17:01 -06:00
macintosh	cpufreq: Use per-policy frequency QoS	2019-10-21 02:05:21 +02:00
mailbox	mailbox: qcom-apcs: fix max_register value	2019-09-17 00:54:29 -05:00
mcb
md	for-linus-2019-10-18	2019-10-18 22:29:36 -04:00
media	media: stkwebcam: fix runtime PM after driver unbind	2019-10-04 14:38:46 +02:00
memory
memstick	memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'	2019-10-09 11:08:03 +02:00
message
mfd	mfd: mt6397: Fix probe after changing mt6397-core	2019-10-24 08:49:25 +01:00
misc	misc: fastrpc: prevent memory leak in fastrpc_dma_buf_attach	2019-10-04 18:22:14 +02:00
mmc	mmc: mxs: fix flags passed to dmaengine_prep_slave_sg	2019-10-21 16:16:38 +02:00
mtd	{tty: serial, nand: onenand}: samsung: rename to fix build warning	2019-11-18 18:49:11 +01:00
mux
net	Remove every trace of SERIAL_MAGIC	2019-11-13 19:01:14 +08:00
nfc	NFC: pn533: fix use-after-free and memleaks	2019-10-08 16:52:26 -07:00
ntb	NTB: fix IDT Kconfig typos/spellos	2019-09-23 17:20:40 -04:00
nubus
nvdimm	libnvdimm fixes v5.4-rc1	2019-09-29 10:33:41 -07:00
nvme	nvme-pci: Set the prp2 correctly when using more than 4k page	2019-10-18 23:09:41 +09:00
nvmem	Char/Misc driver patches for 5.4-rc1	2019-09-18 11:14:31 -07:00
of	of: reserved_mem: add missing of_node_put() for proper ref-counting	2019-10-23 15:15:05 -05:00
opp	opp: Reinitialize the list_kref before adding the static OPPs again	2019-10-23 10:58:44 +05:30
oprofile
parisc	parisc: Remove 32-bit DMA enforcement from sba_iommu	2019-10-14 21:44:26 +02:00
parport	Char/Misc driver patches for 5.4-rc1	2019-09-18 11:14:31 -07:00
pci	PCI: PM: Fix pci_power_up()	2019-10-15 23:51:36 +02:00
pcmcia	Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2019-09-28 08:14:15 -07:00
perf
phy	pci-v5.4-changes	2019-09-23 19:16:01 -07:00
pinctrl	pinctrl: aspeed-g6: Rename SD3 to EMMC and rework pin groups	2019-10-16 15:58:27 +02:00
platform	platform/x86: i2c-multi-instantiate: Fail the probe if no IRQ provided	2019-10-14 15:31:50 +03:00
pnp
power	power supply and reset changes for the v5.4 series	2019-09-22 12:04:59 -07:00
powercap	Power management updates for 5.4-rc1	2019-09-17 19:15:14 -07:00
pps
ps3
ptp	ptp: fix typo of "mechanism" in Kconfig help text	2019-10-07 14:55:46 -04:00
pwm	pwm: Changes for v5.4-rc1	2019-09-27 12:19:47 -07:00
rapidio
ras
regulator	regulator: Fixes for v5.4	2019-10-23 15:31:17 -04:00
remoteproc	remoteproc updates for v5.4	2019-09-22 10:55:08 -07:00
reset	ARM: SoC fixes	2019-09-30 10:04:28 -07:00
rpmsg	rpmsg: glink-smem: Name the edge based on parent remoteproc	2019-09-17 15:33:31 -07:00
rtc	RTC for 5.4	2019-09-22 11:05:43 -07:00
s390	s390/zcrypt: fix memleak at release	2019-10-22 17:55:51 +02:00
sbus
scsi	SCSI fixes on 20191025	2019-10-25 20:11:33 -04:00
sfi
sh
siox
slimbus
soc	soc: imx: imx-scu: Getting UID from SCU should have response	2019-10-06 09:21:38 +08:00
soundwire	soundwire updates for v5.4-rc1	2019-09-22 10:52:23 -07:00
spi	LED updates for 5.4-rc1	2019-09-17 18:40:42 -07:00
spmi
ssb	ssb: make array pwr_info_offset static const, makes object smaller	2019-09-13 17:23:18 +03:00
staging	staging: wlan-ng: fix exit return when sme->key_idx >= NUM_WEPKEYS	2019-10-14 15:40:08 +02:00
target	SCSI fixes on 20191025	2019-10-25 20:11:33 -04:00
tc
tee	tee/shm: untag user pointers in tee_shm_register	2019-09-25 17:51:41 -07:00
thermal	cpufreq: Use per-policy frequency QoS	2019-10-21 02:05:21 +02:00
thunderbolt
tty	serial: serial_core: Perform NULL checks for break_ctl ops	2019-11-21 08:24:43 +01:00
uio	Char/Misc driver patches for 5.4-rc1	2019-09-18 11:14:31 -07:00
usb	usb: cdns3: Error out if USB_DR_MODE_UNKNOWN in cdns3_core_init_role()	2019-10-18 12:00:15 -07:00
vfio	vfio/type1: Initialize resv_msi_base	2019-10-15 14:07:01 -06:00
vhost	vhost/test: stop device before reset	2019-10-13 09:38:27 -04:00
video	video/logo: do not generate unneeded logo C files	2019-10-05 15:29:49 +09:00
virt	virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr	2019-10-10 14:50:32 +02:00
virtio	virtio_ring: fix unmap of indirect descriptors	2019-09-09 10:43:15 -04:00
visorbus
vlynq
vme
w1	w1: ds250x: Fix build error without CRC16	2019-10-10 15:35:41 +02:00
watchdog	linux-watchdog 5.4-rc1 tag	2019-09-27 11:17:38 -07:00
xen	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-10-19 17:09:11 -04:00
zorro
Kconfig	Staging/IIO driver patches for 5.4-rc1	2019-09-18 11:05:34 -07:00
Makefile	Staging/IIO driver patches for 5.4-rc1	2019-09-18 11:05:34 -07:00