Commit d8cecee5 authored by Andy Shevchenko's avatar Andy Shevchenko Committed by Yi Yang
Browse files

serial: max3100: Lock port->lock when calling uart_handle_cts_change() 

stable inclusion
from stable-v6.6.33
commit 93df2fba6c7dfa9a2f08546ea9a5ca4728758458
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D3L
CVE: CVE-2024-38634

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=93df2fba6c7dfa9a2f08546ea9a5ca4728758458



--------------------------------

[ Upstream commit 77ab53371a2066fdf9b895246505f5ef5a4b5d47 ]

uart_handle_cts_change() has to be called with port lock taken,
Since we run it in a separate work, the lock may not be taken at
the time of running. Make sure that it's taken by explicitly doing
that. Without it we got a splat:

  WARNING: CPU: 0 PID: 10 at drivers/tty/serial/serial_core.c:3491 uart_handle_cts_change+0xa6/0xb0
  ...
  Workqueue: max3100-0 max3100_work [max3100]
  RIP: 0010:uart_handle_cts_change+0xa6/0xb0
  ...
   max3100_handlerx+0xc5/0x110 [max3100]
   max3100_work+0x12a/0x340 [max3100]

Fixes: 7831d56b ("tty: MAX3100")
Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20240402195306.269276-2-andriy.shevchenko@linux.intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarYi Yang <yiyang13@huawei.com>
parent dc011b0f

drivers/tty/serial/max3100.c

+12 −1
Original line number Diff line number Diff line
@@ -213,7 +213,7 @@ static int max3100_sr(struct max3100_port *s, u16 tx, u16 *rx) 
	return 0;

}



static int max3100_handlerx(struct max3100_port *s, u16 rx)

static int max3100_handlerx_unlocked(struct max3100_port *s, u16 rx)

{

	unsigned int status = 0;

	int ret = 0, cts;
@@ -254,6 +254,17 @@ static int max3100_handlerx(struct max3100_port *s, u16 rx) 
	return ret;

}



static int max3100_handlerx(struct max3100_port *s, u16 rx)

{

	unsigned long flags;

	int ret;



	uart_port_lock_irqsave(&s->port, &flags);

	ret = max3100_handlerx_unlocked(s, rx);

	uart_port_unlock_irqrestore(&s->port, flags);

	return ret;

}



static void max3100_work(struct work_struct *w)

{

	struct max3100_port *s = container_of(w, struct max3100_port, work);