Patch "serdev: ttyport: add missing receive_buf sanity checks" has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

serdev: ttyport: add missing receive_buf sanity checks

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
serdev-ttyport-add-missing-receive_buf-sanity-checks.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Johan Hovold <[email protected]>
Date: Fri, 3 Nov 2017 15:30:52 +0100
Subject: serdev: ttyport: add missing receive_buf sanity checks

From: Johan Hovold <[email protected]>

commit eb281683621b71ab9710d9dccbbef0c2e1769c97 upstream.

The receive_buf tty-port callback should return the number of bytes accepted and must specifically never return a negative errno (or a value larger than the buffer size) to the tty layer.

A serdev driver not providing a receive_buf callback would currently cause the flush_to_ldisc() worker to spin in a tight loop when the tty buffer pointers are incremented with -EINVAL (-22) after data has been received.

A serdev driver occasionally returning a negative errno (or a too large byte count) could cause information leaks or crashes when accessing memory outside the tty buffers in consecutive callbacks.

---
 drivers/tty/serdev/serdev-ttyport.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

@@ -35,11 +35,22 @@ static int ttyport_receive_buf(struct tt
 {
 	struct serdev_controller *ctrl = port->client_data;
 	struct serport *serport = serdev_controller_get_drvdata(ctrl);
+	int ret;
 
 	if (!test_bit(SERPORT_ACTIVE, &serport->flags))
 		return 0;
 
-	return serdev_controller_receive_buf(ctrl, cp, count);
+	ret = serdev_controller_receive_buf(ctrl, cp, count);
+
+	dev_WARN_ONCE(&ctrl->dev, ret < 0 || ret > count,
+				"receive_buf returns %d (count = %zu)\n",
+				ret, count);
+	if (ret < 0)
+		return 0;
+	else if (ret > count)
+		return count;
+
+	return ret;
 }
 
 static void ttyport_write_wakeup(struct tty_port *port)

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/serdev-ttyport-fix-null-deref-on-hangup.patch queue-4.14/serdev-ttyport-fix-tty-locking-in-close.patch queue-4.14/serdev-ttyport-add-missing-receive_buf-sanity-checks.patch