linux-kernel - [PATCH] [media] sir_ir: infinite loop in interrupt handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 16 May 2017 09:45:55 +0100
From:   Sean Young <sean@...s.org>
To:     kernel test robot <fengguang.wu@...el.com>
Cc:     LKP <lkp@...org>, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org, linux-media@...r.kernel.org,
        Mauro Carvalho Chehab <m.chehab@...sung.com>,
        wfg@...ux.intel.com
Subject: [PATCH] [media] sir_ir: infinite loop in interrupt handler

Since this driver does no detection of hardware, it might be used with
a non-sir port. Escape out if we are spinning.

Signed-off-by: Sean Young <sean@...s.org>
---
 drivers/media/rc/sir_ir.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/media/rc/sir_ir.c b/drivers/media/rc/sir_ir.c
index e12ec50..90a5f8f 100644
--- a/drivers/media/rc/sir_ir.c
+++ b/drivers/media/rc/sir_ir.c
@@ -183,9 +183,15 @@ static irqreturn_t sir_interrupt(int irq, void *dev_id)
 	static unsigned long delt;
 	unsigned long deltintr;
 	unsigned long flags;
+	int counter = 0;
 	int iir, lsr;
 
 	while ((iir = inb(io + UART_IIR) & UART_IIR_ID)) {
+		if (++counter > 256) {
+			dev_err(&sir_ir_dev->dev, "Trapped in interrupt");
+			break;
+		}
+
 		switch (iir & UART_IIR_ID) { /* FIXME toto treba preriedit */
 		case UART_IIR_MSI:
 			(void)inb(io + UART_MSR);
-- 
2.9.4