termios, tty/tty_baudrate.c: fix buffer overrun

H. Peter Anvin · gregkh · commit 991a25194097 · 2018-11-08T03:36:45.000-08:00
On architectures with CBAUDEX == 0 (Alpha and PowerPC), the code in tty_baudrate.c does
not do any limit checking on the tty_baudrate[] array, and in fact a
buffer overrun is possible on both architectures. Add a limit check to
prevent that situation.

This will be followed by a much bigger cleanup/simplification patch.

Signed-off-by: H. Peter Anvin (Intel) &lt;hpa@zytor.com&gt;
Requested-by: Cc: Johan Hovold &lt;johan@kernel.org&gt;
Cc: Jiri Slaby &lt;jslaby@suse.com&gt;
Cc: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
Cc: Richard Henderson &lt;rth@twiddle.net&gt;
Cc: Ivan Kokshaysky &lt;ink@jurassic.park.msu.ru&gt;
Cc: Matt Turner &lt;mattst88@gmail.com&gt;
Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: Kate Stewart &lt;kstewart@linuxfoundation.org&gt;
Cc: Philippe Ombredanne &lt;pombredanne@nexb.com&gt;
Cc: Eugene Syromiatnikov &lt;esyr@redhat.com&gt;
Cc: Alan Cox &lt;alan@lxorguk.ukuu.org.uk&gt;
Cc: stable &lt;stable@vger.kernel.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
diff --git a/drivers/tty/tty_baudrate.c b/drivers/tty/tty_baudrate.c
@@ -77,7 +77,7 @@ speed_t tty_termios_baud_rate(struct ktermios *termios)
 		else
 			cbaud += 15;
 	}
-	return baud_table[cbaud];
+	return cbaud >= n_baud_table ? 0 : baud_table[cbaud];
 }
 EXPORT_SYMBOL(tty_termios_baud_rate);
 
@@ -113,7 +113,7 @@ speed_t tty_termios_input_baud_rate(struct ktermios *termios)
 		else
 			cbaud += 15;
 	}
-	return baud_table[cbaud];
+	return cbaud >= n_baud_table ? 0 : baud_table[cbaud];
 #else	/* IBSHIFT */
 	return tty_termios_baud_rate(termios);
 #endif	/* IBSHIFT */

Original file line number	Diff line number	Diff line change
`@@ -77,7 +77,7 @@ speed_t tty_termios_baud_rate(struct ktermios *termios)`
`77`	`77`	`else`
`78`	`78`	`cbaud += 15;`
`79`	`79`	`}`
`80`		`- return baud_table[cbaud];`
	`80`	`+ return cbaud >= n_baud_table ? 0 : baud_table[cbaud];`
`81`	`81`	`}`
`82`	`82`	`EXPORT_SYMBOL(tty_termios_baud_rate);`
`83`	`83`
`@@ -113,7 +113,7 @@ speed_t tty_termios_input_baud_rate(struct ktermios *termios)`
`113`	`113`	`else`
`114`	`114`	`cbaud += 15;`
`115`	`115`	`}`
`116`		`- return baud_table[cbaud];`
	`116`	`+ return cbaud >= n_baud_table ? 0 : baud_table[cbaud];`
`117`	`117`	`#else /* IBSHIFT */`
`118`	`118`	`return tty_termios_baud_rate(termios);`
`119`	`119`	`#endif /* IBSHIFT */`