Jiangfeng Xiao 7d73170e1c serial: serial_core: Perform NULL checks for break_ctl ops ... Doing fuzz test on sbsa uart device, causes a kernel crash due to NULL pointer dereference: ------------[ cut here ]------------ Unable to handle kernel paging request at virtual address fffffffffffffffc pgd = ffffffe331723000 [fffffffffffffffc] *pgd=0000002333595003, *pud=0000002333595003, *pmd=00000 Internal error: Oops: 96000005 [#1] PREEMPT SMP Modules linked in: ping(O) jffs2 rtos_snapshot(O) pramdisk(O) hisi_sfc(O) Drv_Nandc_K(O) Drv_SysCtl_K(O) Drv_SysClk_K(O) bsp_reg(O) hns3(O) hns3_uio_enet(O) hclgevf(O) hclge(O) hnae3(O) mdio_factory(O) mdio_registry(O) mdio_dev(O) mdio(O) hns3_info(O) rtos_kbox_panic(O) uart_suspend(O) rsm(O) stp llc tunnel4 xt_tcpudp ipt_REJECT nf_reject_ipv4 iptable_filter ip_tables x_tables sd_mod xhci_plat_hcd xhci_pci xhci_hcd usbmon usbhid usb_storage ohci_platform ohci_pci ohci_hcd hid_generic hid ehci_platform ehci_pci ehci_hcd vfat fat usbcore usb_common scsi_mod yaffs2multi(O) ext4 jbd2 ext2 mbcache ofpart i2c_dev i2c_core uio ubi nand nand_ecc nand_ids cfi_cmdset_0002 cfi_cmdset_0001 cfi_probe gen_probe cmdlinepart chipreg mtdblock mtd_blkdevs mtd nfsd auth_rpcgss oid_registry nfsv3 nfs nfs_acl lockd sunrpc grace autofs4 CPU: 2 PID: 2385 Comm: tty_fuzz_test Tainted: G O 4.4.193 #1 task: ffffffe32b23f110 task.stack: ffffffe32bda4000 PC is at uart_break_ctl+0x44/0x84 LR is at uart_break_ctl+0x34/0x84 pc : [<ffffff8393196098>] lr : [<ffffff8393196088>] pstate: 80000005 sp : ffffffe32bda7cc0 x29: ffffffe32bda7cc0 x28: ffffffe32b23f110 x27: ffffff8393402000 x26: 0000000000000000 x25: ffffffe32b233f40 x24: ffffffc07a8ec680 x23: 0000000000005425 x22: 00000000ffffffff x21: ffffffe33ed73c98 x20: 0000000000000000 x19: ffffffe33ed94168 x18: 0000000000000004 x17: 0000007f92ae9d30 x16: ffffff8392fa6064 x15: 0000000000000010 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000020 x10: 0000007ffdac1708 x9 : 0000000000000078 x8 : 000000000000001d x7 : 0000000052a64887 x6 : ffffffe32bda7e08 x5 : ffffffe32b23c000 x4 : 0000005fbc5b0000 x3 : ffffff83938d5018 x2 : 0000000000000080 x1 : ffffffe32b23c040 x0 : ffffff83934428f8 virtual start addr offset is 38ac00000 module base offset is 2cd4cf1000 linear region base offset is : 0 Process tty_fuzz_test (pid: 2385, stack limit = 0xffffffe32bda4000) Stack: (0xffffffe32bda7cc0 to 0xffffffe32bda8000) 7cc0: ffffffe32bda7cf0 ffffff8393177718 ffffffc07a8ec680 ffffff8393196054 7ce0: 000000001739f2e0 0000007ffdac1978 ffffffe32bda7d20 ffffff8393179a1c 7d00: 0000000000000000 ffffff8393c0a000 ffffffc07a8ec680 cb88537fdc8ba600 7d20: ffffffe32bda7df0 ffffff8392fa5a40 ffffff8393c0a000 0000000000005425 7d40: 0000007ffdac1978 ffffffe32b233f40 ffffff8393178dcc 0000000000000003 7d60: 000000000000011d 000000000000001d ffffffe32b23f110 000000000000029e 7d80: ffffffe34fe8d5d0 0000000000000000 ffffffe32bda7e14 cb88537fdc8ba600 7da0: ffffffe32bda7e30 ffffff8393042cfc ffffff8393c41720 ffffff8393c46410 7dc0: ffffff839304fa68 ffffffe32b233f40 0000000000005425 0000007ffdac1978 7de0: 000000000000011d cb88537fdc8ba600 ffffffe32bda7e70 ffffff8392fa60cc 7e00: 0000000000000000 ffffffe32b233f40 ffffffe32b233f40 0000000000000003 7e20: 0000000000005425 0000007ffdac1978 ffffffe32bda7e70 ffffff8392fa60b0 7e40: 0000000000000280 ffffffe32b233f40 ffffffe32b233f40 0000000000000003 7e60: 0000000000005425 cb88537fdc8ba600 0000000000000000 ffffff8392e02e78 7e80: 0000000000000280 0000005fbc5b0000 ffffffffffffffff 0000007f92ae9d3c 7ea0: 0000000060000000 0000000000000015 0000000000000003 0000000000005425 7ec0: 0000007ffdac1978 0000000000000000 00000000a54c910e 0000007f92b95014 7ee0: 0000007f92b95090 0000000052a64887 000000000000001d 0000000000000078 7f00: 0000007ffdac1708 0000000000000020 0000000000000000 0000000000000000 7f20: 0000000000000000 0000000000000010 000000556acf0090 0000007f92ae9d30 7f40: 0000000000000004 000000556acdef10 0000000000000000 000000556acdebd0 7f60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 7f80: 0000000000000000 0000000000000000 0000000000000000 0000007ffdac1840 7fa0: 000000556acdedcc 0000007ffdac1840 0000007f92ae9d3c 0000000060000000 7fc0: 0000000000000000 0000000000000000 0000000000000003 000000000000001d 7fe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 Call trace: Exception stack(0xffffffe32bda7ab0 to 0xffffffe32bda7bf0) 7aa0: 0000000000001000 0000007fffffffff 7ac0: ffffffe32bda7cc0 ffffff8393196098 0000000080000005 0000000000000025 7ae0: ffffffe32b233f40 ffffff83930d777c ffffffe32bda7b30 ffffff83930d777c 7b00: ffffffe32bda7be0 ffffff83938d5000 ffffffe32bda7be0 ffffffe32bda7c20 7b20: ffffffe32bda7b60 ffffff83930d777c ffffffe32bda7c10 ffffff83938d5000 7b40: ffffffe32bda7c10 ffffffe32bda7c50 ffffff8393c0a000 ffffffe32b23f110 7b60: ffffffe32bda7b70 ffffff8392e09df4 ffffffe32bda7bb0 cb88537fdc8ba600 7b80: ffffff83934428f8 ffffffe32b23c040 0000000000000080 ffffff83938d5018 7ba0: 0000005fbc5b0000 ffffffe32b23c000 ffffffe32bda7e08 0000000052a64887 7bc0: 000000000000001d 0000000000000078 0000007ffdac1708 0000000000000020 7be0: 0000000000000000 0000000000000000 [<ffffff8393196098>] uart_break_ctl+0x44/0x84 [<ffffff8393177718>] send_break+0xa0/0x114 [<ffffff8393179a1c>] tty_ioctl+0xc50/0xe84 [<ffffff8392fa5a40>] do_vfs_ioctl+0xc4/0x6e8 [<ffffff8392fa60cc>] SyS_ioctl+0x68/0x9c [<ffffff8392e02e78>] __sys_trace_return+0x0/0x4 Code: b9410ea0 34000160 f9408aa0 f9402814 (b85fc280) ---[ end trace 8606094f1960c5e0 ]--- Kernel panic - not syncing: Fatal exception Fix this problem by adding NULL checks prior to calling break_ctl ops. Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/1574263133-28259-1-git-send-email-xiaojiangfeng@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-11-21 08:24:43 +01:00
..
hvc	tty: Fix Kconfig indentation	2019-11-20 15:20:13 +01:00
ipwireless	tty: add SPDX identifiers to Kconfig and Makefiles	2019-04-04 18:48:43 +02:00
serdev	serdev: Add ACPI devices by ResourceSource field	2019-10-10 14:29:44 +02:00
serial	serial: serial_core: Perform NULL checks for break_ctl ops	2019-11-21 08:24:43 +01:00
vt	vt: Grab console_lock around con_is_bound in show_bind	2019-07-25 13:47:35 +02:00
amiserial.c	Remove every trace of SERIAL_MAGIC	2019-11-13 19:01:14 +08:00
cyclades.c	cyclades: switch to ->[sg]et_serial()	2018-10-13 00:50:30 -04:00
ehv_bytechan.c	tty: Convert to using %pOFn instead of device_node.name	2018-09-18 16:07:25 +02:00
goldfish.c	headers: separate linux/mod_devicetable.h from linux/platform_device.h	2018-07-07 17:52:26 +02:00
isicom.c	tty/isicom: remove redundant assignment to variable word_count	2019-09-04 12:43:44 +02:00
Kconfig	tty: Fix Kconfig indentation	2019-11-20 15:20:13 +01:00
Makefile	tty: Add NULL TTY driver	2019-04-16 15:21:34 +02:00
mips_ejtag_fdc.c
moxa.c	moxa: switch to ->[sg]et_serial()	2018-10-13 00:50:32 -04:00
moxa.h
mxser.c	mxser: switch to ->[sg]et_serial()	2018-10-13 00:50:32 -04:00
mxser.h
n_gsm.c	Revert "tty:n_gsm.c: destroy port by tty_port_destroy()"	2019-11-04 17:48:16 +01:00
n_hdlc.c	tty: n_hdlc: fix build on SPARC	2019-10-04 15:14:20 +02:00
n_null.c
n_r3964.c	tty: Don't block on IO when ldisc change is pending	2018-12-05 12:16:33 +01:00
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c	n_tty: check for negative and zero space return from tty_write_room	2019-04-16 15:21:33 +02:00
nozomi.c	tty: nozomi: Use dev_get_drvdata	2019-09-04 12:43:44 +02:00
pty.c	Revert "tty: pty: Fix race condition between release_one_tty and pty_write"	2019-03-29 15:47:40 +01:00
rocket_int.h
rocket.c	tty: rocket: reduce stack usage	2019-11-04 17:42:28 +01:00
rocket.h	tty: rocket: Remove RCPK_GET_STRUCT ioctl	2019-04-25 11:58:56 +02:00
synclink_gt.c	synclink_gt(): fix compat_ioctl()	2018-10-13 00:50:52 -04:00
synclink.c	tty/synclink: remove ISA support	2019-02-12 08:51:33 +01:00
synclinkmp.c	synclink: reduce pointless checks in ->ioctl()	2018-10-13 00:50:43 -04:00
sysrq.c	panic: avoid the extra noise dmesg	2019-05-14 19:52:51 -07:00
tty_audit.c	audit: join tty records to their syscall	2019-02-07 21:33:54 -05:00
tty_baudrate.c	termios, tty/tty_baudrate.c: fix buffer overrun	2018-11-08 03:36:45 -08:00
tty_buffer.c	tty: increase the default flip buffer limit to 2*640K	2019-01-30 12:03:58 +01:00
tty_io.c	tty: remove unused argument from tty_open_by_driver()	2019-11-20 16:39:51 +01:00
tty_ioctl.c	move compat handling of tty ioctls to tty_compat_ioctl()	2018-09-14 11:12:17 -04:00
tty_jobctrl.c	tty: fix read of tty->pgrp outside of ctrl_lock	2019-03-28 01:28:23 +09:00
tty_ldisc.c	tty_ldisc: simplify tty_ldisc_autoload initialization	2019-10-04 15:11:25 +02:00
tty_ldsem.c	tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop	2019-07-25 15:39:24 +02:00
tty_mutex.c
tty_port.c	Revert "tty: fix NULL pointer issue when tty_port ops is not set"	2019-04-16 15:21:34 +02:00
ttynull.c	tty: Add NULL TTY driver	2019-04-16 15:21:34 +02:00
vcc.c	tty: fix up a few remaining files without SPDX identifiers	2019-04-04 18:48:43 +02:00