Patch "serial: protect uart_port_dtr_rts() in uart_shutdown() too" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    serial: protect uart_port_dtr_rts() in uart_shutdown() too

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     serial-protect-uart_port_dtr_rts-in-uart_shutdown-to.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 8787e9d85060c7dc12d4264d49435891621c0a3e
Author: Jiri Slaby (SUSE) <jirislaby@xxxxxxxxxx>
Date:   Mon Aug 5 12:20:35 2024 +0200

    serial: protect uart_port_dtr_rts() in uart_shutdown() too
    
    [ Upstream commit 602babaa84d627923713acaf5f7e9a4369e77473 ]
    
    Commit af224ca2df29 (serial: core: Prevent unsafe uart port access, part
    3) added few uport == NULL checks. It added one to uart_shutdown(), so
    the commit assumes, uport can be NULL in there. But right after that
    protection, there is an unprotected "uart_port_dtr_rts(uport, false);"
    call. That is invoked only if HUPCL is set, so I assume that is the
    reason why we do not see lots of these reports.
    
    Or it cannot be NULL at this point at all for some reason :P.
    
    Until the above is investigated, stay on the safe side and move this
    dereference to the if too.
    
    I got this inconsistency from Coverity under CID 1585130. Thanks.
    
    Signed-off-by: Jiri Slaby (SUSE) <jirislaby@xxxxxxxxxx>
    Cc: Peter Hurley <peter@xxxxxxxxxxxxxxxxxx>
    Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240805102046.307511-3-jirislaby@xxxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 20e797c9e13ab..4187ddeeac366 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -407,14 +407,16 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
 		/*
 		 * Turn off DTR and RTS early.
 		 */
-		if (uport && uart_console(uport) && tty) {
-			uport->cons->cflag = tty->termios.c_cflag;
-			uport->cons->ispeed = tty->termios.c_ispeed;
-			uport->cons->ospeed = tty->termios.c_ospeed;
-		}
+		if (uport) {
+			if (uart_console(uport) && tty) {
+				uport->cons->cflag = tty->termios.c_cflag;
+				uport->cons->ispeed = tty->termios.c_ispeed;
+				uport->cons->ospeed = tty->termios.c_ospeed;
+			}
 
-		if (!tty || C_HUPCL(tty))
-			uart_port_dtr_rts(uport, false);
+			if (!tty || C_HUPCL(tty))
+				uart_port_dtr_rts(uport, false);
+		}
 
 		uart_port_shutdown(port);
 	}