serdev: ttyport: add missing receive_buf sanity checks
authorJohan Hovold <johan@kernel.org>
Fri, 3 Nov 2017 14:30:52 +0000 (15:30 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 14 Dec 2017 08:52:44 +0000 (09:52 +0100)
commitd415ccdd0be1a745904a7b12b87437463aa35a8d
tree2dc9493fb100f5cc8cf8a2f6b88bd866e53e0a0b
parent28ddc2b45f5f409b905dc78e79d959377789fc12
serdev: ttyport: add missing receive_buf sanity checks

commit eb281683621b71ab9710d9dccbbef0c2e1769c97 upstream.

The receive_buf tty-port callback should return the number of bytes
accepted and must specifically never return a negative errno (or a value
larger than the buffer size) to the tty layer.

A serdev driver not providing a receive_buf callback would currently
cause the flush_to_ldisc() worker to spin in a tight loop when the tty
buffer pointers are incremented with -EINVAL (-22) after data has been
received.

A serdev driver occasionally returning a negative errno (or a too large
byte count) could cause information leaks or crashes when accessing
memory outside the tty buffers in consecutive callbacks.

Fixes: cd6484e1830b ("serdev: Introduce new bus for serial attached devices")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/serdev/serdev-ttyport.c