diff options
| author | Andi Shyti <andi.shyti@kernel.org> | 2023-12-04 17:38:03 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-12-13 18:45:31 +0100 |
| commit | c88a91ca26b102042e816fdf850fa51d10be4749 (patch) | |
| tree | b1cc9ae862d4d91cf63bc3bea2c6af54c045bcf8 | |
| parent | 977a60f0639fbeea0161e6ce516c8d2f3dbefe78 (diff) | |
| download | linux-starfive-c88a91ca26b102042e816fdf850fa51d10be4749.tar.gz linux-starfive-c88a91ca26b102042e816fdf850fa51d10be4749.tar.bz2 linux-starfive-c88a91ca26b102042e816fdf850fa51d10be4749.zip | |
serial: ma35d1: Validate console index before assignment
commit f0b9d97a77fa8f18400450713358303a435ab688 upstream.
The console is immediately assigned to the ma35d1 port without
checking its index. This oversight can lead to out-of-bounds
errors when the index falls outside the valid '0' to
MA35_UART_NR range. Such scenario trigges ran error like the
following:
UBSAN: array-index-out-of-bounds in drivers/tty/serial/ma35d1_serial.c:555:51
index -1 is out of range for type 'uart_ma35d1_port [17]
Check the index before using it and bail out with a warning.
Fixes: 930cbf92db01 ("tty: serial: Add Nuvoton ma35d1 serial driver support")
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Cc: Jacky Huang <ychuang3@nuvoton.com>
Cc: <stable@vger.kernel.org> # v6.5+
Link: https://lore.kernel.org/r/20231204163804.1331415-2-andi.shyti@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/tty/serial/ma35d1_serial.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/tty/serial/ma35d1_serial.c b/drivers/tty/serial/ma35d1_serial.c index 465b1def9e11..69da24565b99 100644 --- a/drivers/tty/serial/ma35d1_serial.c +++ b/drivers/tty/serial/ma35d1_serial.c @@ -552,11 +552,19 @@ static void ma35d1serial_console_putchar(struct uart_port *port, unsigned char c */ static void ma35d1serial_console_write(struct console *co, const char *s, u32 count) { - struct uart_ma35d1_port *up = &ma35d1serial_ports[co->index]; + struct uart_ma35d1_port *up; unsigned long flags; int locked = 1; u32 ier; + if ((co->index < 0) || (co->index >= MA35_UART_NR)) { + pr_warn("Failed to write on ononsole port %x, out of range\n", + co->index); + return; + } + + up = &ma35d1serial_ports[co->index]; + if (up->port.sysrq) locked = 0; else if (oops_in_progress) |