[PATCH] serial: fix 8250 hash_mutex race and uart_get_baud_rate() divide-by-zero

[PATCH] serial: fix 8250 hash_mutex race and uart_get_baud_rate() divide-by-zero

[Hui Peng]

Fix two bugs in the serial subsystem:

1. In serial8250_Label / serial_link_irq_chain() and
   serial_unlink_irq_chain() (drivers/tty/serial/8250/8250_core.c), hold
   hash_mutex across the entire IRQ list manipulation and
   request_irq()/free_irq() sequence to prevent racing IRQ chain
   insertions/removals.
2. In uart_get_baud_rate() and uart_set_info()
   (drivers/tty/serial/serial_core.c), avoid unsigned overflow in
   port->uartclk = new_info->baud_base * 16 and ensure the fallback
   retry in uart_get_baud_rate() terminates cleanly when no baud rate
   lies in [min, max].

Fixes: ab4382d27412 ("tty: move drivers/serial/ to drivers/tty/serial/")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index b875d394796f..0bc810f285a4 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -134,8 +134,6 @@ static struct irq_info *serial_get_or_create_irq_info(const struct uart_8250_por
 {
 	struct irq_info *i;
 
-	guard(mutex)(&hash_mutex);
-
 	hash_for_each_possible(irq_lists, i, node, up->port.irq)
 		if (i->irq == up->port.irq)
 			return i;
@@ -156,6 +154,8 @@ static int serial_link_irq_chain(struct uart_8250_port *up)
 	struct irq_info *i;
 	int ret;
 
+	guard(mutex)(&hash_mutex);
+
 	i = serial_get_or_create_irq_info(up);
 	if (IS_ERR(i))
 		return PTR_ERR(i);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 95774b0f1484..4cd4fb0f7ee3 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -501,7 +501,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,
 		break;
 	}
 
-	for (try = 0; try < 2; try++) {
+	for (try = 0; try < 3; try++) {
 		baud = tty_termios_baud_rate(termios);
 
 		/*
@@ -965,7 +965,7 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
 	}
 
 	if ((new_info->irq >= irq_get_nr_irqs()) || (new_info->irq < 0) ||
-	    (new_info->baud_base < 9600))
+	    (new_info->baud_base < 9600) || (new_info->baud_base > UINT_MAX / 16))
 		return -EINVAL;
 
 	if (change_port || change_irq) {

Re: [PATCH] serial: fix 8250 hash_mutex race and uart_get_baud_rate() divide-by-zero

[Greg KH]

On Sat, Sep 19, 2026 at 10:26:27PM +0000, Hui Peng wrote:
> Fix two bugs in the serial subsystem:
> 
> 1. In serial8250_Label / serial_link_irq_chain() and
>    serial_unlink_irq_chain() (drivers/tty/serial/8250/8250_core.c), hold
>    hash_mutex across the entire IRQ list manipulation and
>    request_irq()/free_irq() sequence to prevent racing IRQ chain
>    insertions/removals.
> 2. In uart_get_baud_rate() and uart_set_info()
>    (drivers/tty/serial/serial_core.c), avoid unsigned overflow in
>    port->uartclk = new_info->baud_base * 16 and ensure the fallback
>    retry in uart_get_baud_rate() terminates cleanly when no baud rate
>    lies in [min, max].

Then this should be 2 different patches, right?

Please slow down.

thanks,

greg k-h

Re: [PATCH] serial: fix 8250 hash_mutex race and uart_get_baud_rate() divide-by-zero

[Greg KH]

On Sat, Sep 19, 2026 at 10:20:48PM -0700, Hui Peng wrote:
> You are right, I apologize for that.  I have stopped submitting new ones,
> working on the submitted ones.

Please fix your email client to not top-post or send html email, as that
is rejected from the mailing lists :(

thanks,

greg k-h