[PATCH] serial: fix 8250 hash_mutex race and uart_get_baud_rate() divide-by-zero

[Hui Peng]

Fix two bugs in the serial subsystem:

1. In serial8250_Label / serial_link_irq_chain() and
   serial_unlink_irq_chain() (drivers/tty/serial/8250/8250_core.c), hold
   hash_mutex across the entire IRQ list manipulation and
   request_irq()/free_irq() sequence to prevent racing IRQ chain
   insertions/removals.
2. In uart_get_baud_rate() and uart_set_info()
   (drivers/tty/serial/serial_core.c), avoid unsigned overflow in
   port->uartclk = new_info->baud_base * 16 and ensure the fallback
   retry in uart_get_baud_rate() terminates cleanly when no baud rate
   lies in [min, max].

Fixes: ab4382d27412 ("tty: move drivers/serial/ to drivers/tty/serial/")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index b875d394796f..0bc810f285a4 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -134,8 +134,6 @@ static struct irq_info *serial_get_or_create_irq_info(const struct uart_8250_por
 {
 	struct irq_info *i;
 
-	guard(mutex)(&hash_mutex);
-
 	hash_for_each_possible(irq_lists, i, node, up->port.irq)
 		if (i->irq == up->port.irq)
 			return i;
@@ -156,6 +154,8 @@ static int serial_link_irq_chain(struct uart_8250_port *up)
 	struct irq_info *i;
 	int ret;
 
+	guard(mutex)(&hash_mutex);
+
 	i = serial_get_or_create_irq_info(up);
 	if (IS_ERR(i))
 		return PTR_ERR(i);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 95774b0f1484..4cd4fb0f7ee3 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -501,7 +501,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,
 		break;
 	}
 
-	for (try = 0; try < 2; try++) {
+	for (try = 0; try < 3; try++) {
 		baud = tty_termios_baud_rate(termios);
 
 		/*
@@ -965,7 +965,7 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
 	}
 
 	if ((new_info->irq >= irq_get_nr_irqs()) || (new_info->irq < 0) ||
-	    (new_info->baud_base < 9600))
+	    (new_info->baud_base < 9600) || (new_info->baud_base > UINT_MAX / 16))
 		return -EINVAL;
 
 	if (change_port || change_irq) {