kern/60284: uart driver fails report invalid parameters to caller

[Thomas Sandford]

>Number:         60284
>Category:       kern
>Synopsis:       uart driver fails report invalid parameters to caller
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Dec 15 17:50:14 PST 2003
>Closed-Date:
>Last-Modified:
>Originator:     Thomas Sandford
>Release:        FreeBSD 5.1-CURRENT-20031116-JPSNAP i386
>Organization:
Paradise Green Technical Services
>Environment:
System: FreeBSD burs-sgs1.paradise 5.1-CURRENT-20031116-JPSNAP FreeBSD 5.1-CURRENT-20031116-JPSNAP #1: Mon Dec 15 22:15:29 GMT 2003 root at burs-sgs1.paradise:/usr/src/sys/i386/compile/UART i386


Discovered on an i386 machine with GENERIC + puc + uart devices.

However problem is system independant.
>Description:
	uart_tty_param in /sys/dev/uart/uart_tty.c calls the UART_PARAM method 
        without checking the return value. This means that invalid parameters
        (in particular impossible baud rates for the device in question) never
        get reported back to the caller.
>How-To-Repeat:
	Include the uart driver in your kernel

	stty 12345678 </dev/uart0

        [no error is reported]

>Fix:

Apply the following patch:

Index: uart_tty.c
===================================================================
RCS file: /home/ncvs/src/sys/dev/uart/uart_tty.c,v
retrieving revision 1.4
diff -u -r1.4 uart_tty.c
--- uart_tty.c	28 Sep 2003 18:20:42 -0000	1.4
+++ uart_tty.c	15 Dec 2003 22:42:48 -0000
@@ -225,7 +225,8 @@
 		    : UART_PARITY_EVEN;
 	else
 		parity = UART_PARITY_NONE;
-	UART_PARAM(sc, t->c_ospeed, databits, stopbits, parity);
+	if (UART_PARAM(sc, t->c_ospeed, databits, stopbits, parity) != 0)
+		return EINVAL;
 	UART_SETSIG(sc, UART_SIG_DDTR | UART_SIG_DTR);
 	/* Set input flow control state. */
 	if (!sc->sc_hwiflow) {


>Release-Note:
>Audit-Trail:
>Unformatted: