[PATCH v5 0/3] serial: fix IRQ chain race, baud fallback, and uartclk overflow

[PATCH v5 0/3] serial: fix IRQ chain race, baud fallback, and uartclk overflow

[Hui Peng]

This series fixes three bugs in the 8250 and serial core drivers:

1. Hold hash_mutex across IRQ chain lookup, linking, and error-path
   unlinking in serial_link_irq_chain() to prevent a use-after-free race
   with concurrent serial_unlink_irq_chain().
2. Allow a third loop iteration (try < 3) in uart_get_baud_rate() so that
   when both the requested and old baud rates are out of range and try == 1
   clips the rate into termios, the clipped baud rate is evaluated and
   returned on try == 2 instead of returning 0 and causing a divide-by-zero
   in uart_get_divisor().
3. Reject baud_base > UINT_MAX / 16 in uart_set_info() alongside the
   uartclk == 0 check so that multiplying baud_base by 16 cannot wrap
   around in 32-bit unsigned arithmetic to a small non-zero uartclk.

Changes in v5:
- Rebased cleanly and tested for applicability against tip of upstream
  mainline commit 62f4c998b297 ("Merge tag 'parisc-for-7.3-rc5' of
  git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux").
- Dynamically verified all 3 issues in QEMU KVM with CONFIG_KASAN=y against
  unfixed vs fixed kernels, adding explicit test methods to commit bodies.
- Patch 1/3: Updated diff to align with upstream guard(mutex) refactoring.
- Patch 2/3: Trimmed kernel stack trace in commit message to 4 key lines,
  as suggested by Andy Shevchenko.
- Patch 3/3: Collected Reviewed-by from Ilpo Järvinen.
- Re-sending full series as a fresh standalone thread per Andy Shevchenko's
  feedback.

Changes in v4:
- Patch 3/3: Check new_info->baud_base > UINT_MAX / 16 before
  multiplying by 16, as suggested by Ilpo Järvinen.

Changes in v3:
- Patch 2/3: Collect Reviewed-by from Ilpo Järvinen.
- Patch 3/3: Add missing #include <linux/limits.h> for UINT_MAX and move
  the new_info->baud_base > UINT_MAX / 16 check to the uartclk == 0 check,
  as suggested by Ilpo Järvinen.

Changes in v2:
- Split the 8250_core.c and serial_core.c fixes into a 3-patch series,
  add Cc: stable@vger.kernel.org, and document how each patch was tested in
  QEMU, as requested by Greg Kroah-Hartman and John Ogness.

Hui Peng (3):
  serial: 8250: hold hash_mutex across IRQ chain linking in
    serial_link_irq_chain()
  serial: core: allow third iteration in uart_get_baud_rate() fallback
  serial: core: reject baud_base values that overflow port->uartclk in
    uart_set_info()

 drivers/tty/serial/8250/8250_core.c | 10 ++++------
 drivers/tty/serial/serial_core.c    |  5 +++--
 2 files changed, 7 insertions(+), 8 deletions(-)

[PATCH v5 1/3] serial: 8250: hold hash_mutex across IRQ chain linking in serial_link_irq_chain()

[Hui Peng]

In serial_link_irq_chain(), serial_get_or_create_irq_info() acquires
hash_mutex to search or allocate a chain instance and drops hash_mutex
before returning.

If a concurrent call to serial_unlink_irq_chain() runs immediately after
serial_get_or_create_irq_info() returns while i->head is still NULL,
serial_unlink_irq_chain() acquires hash_mutex, finds i with
i->head == NULL, frees the chain structure via free_irq() / kfree(),
and removes it from the hashtable. serial_link_irq_chain() then
proceeds to scoped_guard(spinlock_irq, &i->lock), dereferencing the freed
chain pointer i and causing a slab use-after-free.

Move guard(mutex)(&hash_mutex) to the beginning of
serial_link_irq_chain() and rename serial_get_or_create_irq_info() to
serial_get_or_create_irq_info_locked() so hash_mutex is held across the
entire lookup, linking, and error-path unlinking sequence.

Tested in QEMU against tip of mainline (62f4c998b297, "Merge tag
'parisc-for-7.3-rc5' of git://git.kernel.org/.../parisc-linux")
with KASAN enabled by concurrently opening/closing 8250 serial ports
sharing IRQ 4 (ttyS0 and ttyS2): on the unfixed kernel KASAN detects
slab-use-after-free in serial_link_irq_chain(); whereas with this fix
applied, port registration and unregistration run cleanly with 0 KASAN
warnings.

Fixes: e91f1ed6c24f ("serial: 8250: fix use-after-free in serial_link_irq_chain")
Cc: stable@vger.kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v5:
- Rebased cleanly onto tip of mainline commit 62f4c998b297.
- Updated patch diff and commit description to align with upstream
  guard(mutex) refactoring in 8250_core.c.

Changes in v4:
- No changes.

Changes in v3:
- No changes.

Changes in v2:
- Split out from monolithic patch into patch 1/3, add Cc: stable@vger.kernel.org,
  and document QEMU test procedure in commit message body, as requested by
  Greg Kroah-Hartman and John Ogness.

 drivers/tty/serial/8250/8250_core.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index b875d394796f..e831a8fe9a95 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -130,12 +130,10 @@ static void serial_do_unlink(struct irq_info *i, struct uart_8250_port *up)
  * - find the corresponding info in the hashtable and return it, or
  * - allocate a new one, add it to the hashtable and return it.
  */
-static struct irq_info *serial_get_or_create_irq_info(const struct uart_8250_port *up)
+static struct irq_info *serial_get_or_create_irq_info_locked(const struct uart_8250_port *up)
 {
 	struct irq_info *i;

-	guard(mutex)(&hash_mutex);
-
 	hash_for_each_possible(irq_lists, i, node, up->port.irq)
 		if (i->irq == up->port.irq)
 			return i;
@@ -156,7 +154,9 @@ static int serial_link_irq_chain(struct uart_8250_port *up)
 	struct irq_info *i;
 	int ret;

-	i = serial_get_or_create_irq_info(up);
+	guard(mutex)(&hash_mutex);
+
+	i = serial_get_or_create_irq_info_locked(up);
 	if (IS_ERR(i))
 		return PTR_ERR(i);

[PATCH v5 2/3] serial: core: allow third iteration in uart_get_baud_rate() fallback

[Hui Peng]

In uart_get_baud_rate(), when the requested baud rate is out of range
(try == 0) and old is non-NULL, the function copies the old termios baud
rate into termios, sets old = NULL, and continues to try == 1. If the
old baud rate is also out of range (for instance, after uport->uartclk
was lowered via TIOCSSERIAL so max = uport->uartclk / 16 is smaller than
both the old and new baud rates), try == 1 clips baud to [min + 1,
max - 1] and encodes it into termios via tty_termios_encode_baud_rate().

However, because the loop bound is for (try = 0; try < 2; try++), the
loop terminates immediately after try == 1 without re-evaluating
baud = tty_termios_baud_rate(termios) for the clipped rate, hitting
WARN_ON(1) and returning 0, which then triggers a fatal divide-by-zero
(Oops: divide error) in uart_get_divisor():

  WARNING: drivers/tty/serial/serial_core.c:548 at uart_get_baud_rate+0x136/0x260
  Oops: divide error: 0000 [#1] SMP KASAN PTI
  RIP: 0010:uart_get_divisor+0x5b/0x100
  Call Trace:
   serial8250_get_divisor+0x123/0x1a0
   serial8250_do_set_termios+0x21e/0x1610
   tty_ioctl+0x1028/0x1480

Increase the loop limit to try < 3 so that the clipped baud rate encoded
on try == 1 is evaluated and returned on try == 2.

Tested in QEMU against Linux 7.3.0-rc3 by setting /dev/ttyS1 to B115200,
lowering baud_base to 9600 (max = 9600) via TIOCSSERIAL, and calling
tcsetattr() with B57600 (old = B115200), reproducing the WARNING and
Oops: divide error in uart_get_divisor() on the unfixed kernel and
verifying clean execution with 0 warnings/faults with the fix applied.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: 091ea8e5d34e ("serial: core: prevent division by zero by always returning non-zero baud rate")
Cc: stable@vger.kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v5:
- Trim kernel stack trace in commit message to 4 key lines, as suggested by
  Andy Shevchenko.

Changes in v4:
- No changes.

Changes in v3:
- Collect Reviewed-by from Ilpo Järvinen.

Changes in v2:
- Split out from the 8250_core.c and uart_set_info() changes into patch
  2/3, add Cc: stable@vger.kernel.org, and include the QEMU reproducer test
  details and kernel stack trace, as requested by Greg Kroah-Hartman.

 drivers/tty/serial/serial_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 95774b0f1484..3845fb582f45 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -501,7 +501,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,
 		break;
 	}

-	for (try = 0; try < 2; try++) {
+	for (try = 0; try < 3; try++) {
 		baud = tty_termios_baud_rate(termios);

 		/*

[PATCH v5 3/3] serial: core: reject baud_base values that overflow port->uartclk in uart_set_info()

[Hui Peng]

In uart_set_info(), new_info->baud_base is multiplied by 16 and stored in
uport->uartclk (an unsigned int):

  uport->uartclk = new_info->baud_base * 16;

While uart_set_info() checks if (uartclk == 0) and
if (new_info->baud_base < 9600), when new_info->baud_base exceeds
UINT_MAX / 16 with low bits set (for example, 0x10000001), multiplying
by 16 wraps around in 32-bit unsigned arithmetic to a small non-zero value
(16), bypassing both uartclk == 0 and new_info->baud_base < 9600 and
setting uport->uartclk = 16 (baud_base = 1, well below the required
minimum of 9600 * 16).

Reject new_info->baud_base > UINT_MAX / 16 before multiplying by 16 in
uart_set_info().

Tested in QEMU against Linux 7.3.0-rc3 by calling ioctl(fd, TIOCSSERIAL,
&ss) with ss.baud_base = 0x10000001 on /dev/ttyS1: on the unfixed kernel
TIOCSSERIAL succeeds (ret = 0) and wraps uport->uartclk to 16
(TIOCGSERIAL reports baud_base = 1), whereas with the fix applied
TIOCSSERIAL returns -EINVAL and preserves the existing uport->uartclk.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: 6eabce6608d6 ("serial: core: check uartclk for zero to avoid divide by zero")
Cc: stable@vger.kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v5:
- Collect Reviewed-by from Ilpo Järvinen.
- Re-send as part of v5 series in a fresh standalone thread per Andy
  Shevchenko's feedback.

Changes in v4:
- Check new_info->baud_base > UINT_MAX / 16 before multiplying by 16,
  as suggested by Ilpo Järvinen.

Changes in v3:
- Add missing #include <linux/limits.h> for UINT_MAX and move the
  new_info->baud_base > UINT_MAX / 16 check to the uartclk == 0 check, as
  suggested by Ilpo Järvinen.

 drivers/tty/serial/serial_core.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 95774b0f1484..75bb1eaa27e7 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -16,6 +16,7 @@
 #include <linux/console.h>
 #include <linux/gpio/consumer.h>
 #include <linux/kernel.h>
+#include <linux/limits.h>
 #include <linux/of.h>
 #include <linux/pm_runtime.h>
 #include <linux/proc_fs.h>
@@ -931,8 +932,13 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
 	old_custom_divisor = uport->custom_divisor;

 	if (!(uport->flags & UPF_FIXED_PORT)) {
-		unsigned int uartclk = new_info->baud_base * 16;
+		unsigned int uartclk;
+
 		/* check needs to be done here before other settings made */
+		if (new_info->baud_base > UINT_MAX / 16)
+			return -EINVAL;
+
+		uartclk = new_info->baud_base * 16;
 		if (uartclk == 0)
 			return -EINVAL;
 	}

Re: [PATCH v5 3/3] serial: core: reject baud_base values that overflow port->uartclk in uart_set_info()

[Jiri Slaby]

On 30. 09. 26, 6:12, Hui Peng wrote:
> In uart_set_info(), new_info->baud_base is multiplied by 16 and stored in
> uport->uartclk (an unsigned int):
> 
>    uport->uartclk = new_info->baud_base * 16;
> 
> While uart_set_info() checks if (uartclk == 0) and
> if (new_info->baud_base < 9600), when new_info->baud_base exceeds
> UINT_MAX / 16 with low bits set (for example, 0x10000001), multiplying
> by 16 wraps around in 32-bit unsigned arithmetic to a small non-zero value
> (16), bypassing both uartclk == 0 and new_info->baud_base < 9600 and
> setting uport->uartclk = 16 (baud_base = 1, well below the required
> minimum of 9600 * 16).
> 
> Reject new_info->baud_base > UINT_MAX / 16 before multiplying by 16 in
> uart_set_info().
> 
> Tested in QEMU against Linux 7.3.0-rc3 by calling ioctl(fd, TIOCSSERIAL,
> &ss) with ss.baud_base = 0x10000001 on /dev/ttyS1: on the unfixed kernel
> TIOCSSERIAL succeeds (ret = 0) and wraps uport->uartclk to 16
> (TIOCGSERIAL reports baud_base = 1), whereas with the fix applied
> TIOCSSERIAL returns -EINVAL and preserves the existing uport->uartclk.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Fixes: 6eabce6608d6 ("serial: core: check uartclk for zero to avoid divide by zero")
> Cc: stable@vger.kernel.org
> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v5:
> - Collect Reviewed-by from Ilpo Järvinen.
> - Re-send as part of v5 series in a fresh standalone thread per Andy
>    Shevchenko's feedback.
> 
> Changes in v4:
> - Check new_info->baud_base > UINT_MAX / 16 before multiplying by 16,
>    as suggested by Ilpo Järvinen.
> 
> Changes in v3:
> - Add missing #include <linux/limits.h> for UINT_MAX and move the
>    new_info->baud_base > UINT_MAX / 16 check to the uartclk == 0 check, as
>    suggested by Ilpo Järvinen.
> 
>   drivers/tty/serial/serial_core.c | 8 +++++++-
>   1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index 95774b0f1484..75bb1eaa27e7 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
> @@ -16,6 +16,7 @@
>   #include <linux/console.h>
>   #include <linux/gpio/consumer.h>
>   #include <linux/kernel.h>
> +#include <linux/limits.h>
>   #include <linux/of.h>
>   #include <linux/pm_runtime.h>
>   #include <linux/proc_fs.h>
> @@ -931,8 +932,13 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
>   	old_custom_divisor = uport->custom_divisor;
> 
>   	if (!(uport->flags & UPF_FIXED_PORT)) {
> -		unsigned int uartclk = new_info->baud_base * 16;
> +		unsigned int uartclk;
> +
>   		/* check needs to be done here before other settings made */
> +		if (new_info->baud_base > UINT_MAX / 16)
> +			return -EINVAL;
> +
> +		uartclk = new_info->baud_base * 16;

check_mul_overflow() instead?

>   		if (uartclk == 0)
>   			return -EINVAL;
>   	}


-- 
js
suse labs