[PATCH v5 0/3] serial: fix IRQ chain race, baud fallback, and uartclk overflow

[Hui Peng <benquike@gmail.com>]

This series fixes three bugs in the 8250 and serial core drivers:

1. Hold hash_mutex across IRQ chain lookup, linking, and error-path
   unlinking in serial_link_irq_chain() to prevent a use-after-free race
   with concurrent serial_unlink_irq_chain().
2. Allow a third loop iteration (try < 3) in uart_get_baud_rate() so that
   when both the requested and old baud rates are out of range and try == 1
   clips the rate into termios, the clipped baud rate is evaluated and
   returned on try == 2 instead of returning 0 and causing a divide-by-zero
   in uart_get_divisor().
3. Reject baud_base > UINT_MAX / 16 in uart_set_info() alongside the
   uartclk == 0 check so that multiplying baud_base by 16 cannot wrap
   around in 32-bit unsigned arithmetic to a small non-zero uartclk.

Changes in v5:
- Rebased cleanly and tested for applicability against tip of upstream
  mainline commit 62f4c998b297 ("Merge tag 'parisc-for-7.3-rc5' of
  git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux").
- Dynamically verified all 3 issues in QEMU KVM with CONFIG_KASAN=y against
  unfixed vs fixed kernels, adding explicit test methods to commit bodies.
- Patch 1/3: Updated diff to align with upstream guard(mutex) refactoring.
- Patch 2/3: Trimmed kernel stack trace in commit message to 4 key lines,
  as suggested by Andy Shevchenko.
- Patch 3/3: Collected Reviewed-by from Ilpo Järvinen.
- Re-sending full series as a fresh standalone thread per Andy Shevchenko's
  feedback.

Changes in v4:
- Patch 3/3: Check new_info->baud_base > UINT_MAX / 16 before
  multiplying by 16, as suggested by Ilpo Järvinen.

Changes in v3:
- Patch 2/3: Collect Reviewed-by from Ilpo Järvinen.
- Patch 3/3: Add missing #include <linux/limits.h> for UINT_MAX and move
  the new_info->baud_base > UINT_MAX / 16 check to the uartclk == 0 check,
  as suggested by Ilpo Järvinen.

Changes in v2:
- Split the 8250_core.c and serial_core.c fixes into a 3-patch series,
  add Cc: stable@vger.kernel.org, and document how each patch was tested in
  QEMU, as requested by Greg Kroah-Hartman and John Ogness.

Hui Peng (3):
  serial: 8250: hold hash_mutex across IRQ chain linking in
    serial_link_irq_chain()
  serial: core: allow third iteration in uart_get_baud_rate() fallback
  serial: core: reject baud_base values that overflow port->uartclk in
    uart_set_info()

 drivers/tty/serial/8250/8250_core.c | 10 ++++------
 drivers/tty/serial/serial_core.c    |  5 +++--
 2 files changed, 7 insertions(+), 8 deletions(-)