USB: serial: io_ti: fix div-by-zero in set_termios

[ Upstream commit 6aeb75e6adfaed16e58780309613a578fe1ee90b ]

Fix a division-by-zero in set_termios when debugging is enabled and a
high-enough speed has been requested so that the divisor value becomes
zero.

Instead of just fixing the offending debug statement, cap the baud rate
at the base as a zero divisor value also appears to crash the firmware.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>     # 2.6.12
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Orabug: 29487834
CVE: CVE-2017-18360
(cherry picked from commit 2cd394cd10465fc0878958ba99e6080ac8ead559)
Signed-off-by: Dan Duval <dan.duval@oracle.com>
Reviewed-by: Brian Maly <brian.maly@oracle.com>
Signed-off-by: Brian Maly <brian.maly@oracle.com>

diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index ddbb8fe1046d6868476cb0613068cca0cae30a15..0d0674e2cb971fa5918884dca34feb4df3528289 100644 (file)
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2204,8 +2204,11 @@ static void change_port_settings(struct tty_struct *tty,
        if (!baud) {
                /* pick a default, any default... */
                baud = 9600;
-       } else
+       } else {
+               /* Avoid a zero divisor. */
+               baud = min(baud, 461550);
                tty_encode_baud_rate(tty, baud, baud);
+       }
 
        edge_port->baud_rate = baud;
        config->wBaudRate = (__u16)((461550L + baud/2) / baud);