Received-SPF: pass (google.com: domain of linux-kernel+bounces-146839-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: Parker Newman <parker@finest.io>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Jiri Slaby <jirislaby@kernel.org>,
	linux-kernel@vger.kernel.org,
	linux-serial@vger.kernel.org
Cc: Parker Newman <pnewman@connecttech.com>
Subject: [PATCH v3 8/8] serial: exar: fix: fix crash during shutdown if setup fails
Date: Tue, 16 Apr 2024 08:55:35 -0400
Message-ID: <1a21fffe403d7181e0404db1ed92140c306f97b7.1713270624.git.pnewman@connecttech.com>
In-Reply-To: <cover.1713270624.git.pnewman@connecttech.com>
References: <cover.1713270624.git.pnewman@connecttech.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:R9jOjENT1WY=;ejdCrwwafJxLraDIM3YWdGe5Gf8
 TGgftdLfb0YEcoJYUk0MjEIP5PuK3s748EFwOTKaLY+Pq67vKwXlBwwF6Qr2vRrcq7L3SIdyI
 ysVumb/Co+kA88d4EnuG+4x/6O0tWghnHZXILOYGY+grItIiuXDDBue+YGPsojqQe/vQFCu5j
 AnM5ofSPS1mRszGgXFvhgtEyU56eKQwL/kQPAumflvQARki2PgJ4EtskR9xbqSQuv0Lv64oH1
 4BHQXvS8+9kES+adbpXhgmg8qJx0KNTUNBRlc2QE3qzfSZqa67dmyl9sG1+75pkPjusK5YWqO
 dbNGBATZ2m8olWBCF3w/91oDCqfQZ5sASj4VQ+iFfbEMhI9UE5bX+ve05LagaY3wxSKdQD57K
 85LMfFDKXgdBsYuNP3iCqh0/eKX7k8Ut8ntFm/p+/9WiPYFFbN41dn+hjOFfmhhCK+KAaBpLC
 EnvcA5GERyQum/2sHmHkh2gkjT+K4S7xvi9KNWBmRztfGF4+MFs929LvBWT/MZ1c29emR83Ao
 RZSvao8gY2jnbrYQvmBdmHxzFDr0qHlmjqS9mOZTXXjDpb1+S+bUJdhSFTpIzFsWz0Ak0iQdR
 Csqskd5/909oaQ3kbEe042qJU62/boQ1w7xDTaMMdUARd0u1l2ktaUbvJtXIjCHJLGpYZC/4Q
 OV4ZW0lBaNndXjHuKj0L55EB0NoyqPeg+rN9YX4gufMj9w9ko44hKulEjeQX/xzkmNgQVOt0V
 eiF47/CMa5tfT5XvMX9PeNVTtTPxP1P+frurlBoSXwIT7gPCDQTyvg=

From: Parker Newman <pnewman@connecttech.com>

If a port fails to register with serial8250_register_8250_port() the
kernel can crash when shutting down or module removal.

This is because "priv->line[i]" will be set to a negative error code
and in the exar_pci_remove() function serial8250_unregister_port() is
called without checking if the "priv->line[i]" value is valid.

Signed-off-by: Parker Newman <pnewman@connecttech.com>
=2D--
 drivers/tty/serial/8250/8250_exar.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250=
/8250_exar.c
index 501b9f3e9c89..f5a395ed69d1 100644
=2D-- a/drivers/tty/serial/8250/8250_exar.c
+++ b/drivers/tty/serial/8250/8250_exar.c
@@ -1671,7 +1671,8 @@ static void exar_pci_remove(struct pci_dev *pcidev)
 	unsigned int i;

 	for (i =3D 0; i < priv->nr; i++)
-		serial8250_unregister_port(priv->line[i]);
+		if (priv->line[i] >=3D 0)
+			serial8250_unregister_port(priv->line[i]);

 	/* Ensure that every init quirk is properly torn down */
 	if (priv->board->exit)
=2D-
2.43.2