| From f0b9d97a77fa8f18400450713358303a435ab688 Mon Sep 17 00:00:00 2001 |
| From: Andi Shyti <andi.shyti@kernel.org> |
| Date: Mon, 4 Dec 2023 17:38:03 +0100 |
| Subject: serial: ma35d1: Validate console index before assignment |
| |
| From: Andi Shyti <andi.shyti@kernel.org> |
| |
| commit f0b9d97a77fa8f18400450713358303a435ab688 upstream. |
| |
| The console is immediately assigned to the ma35d1 port without |
| checking its index. This oversight can lead to out-of-bounds |
| errors when the index falls outside the valid '0' to |
| MA35_UART_NR range. Such scenario trigges ran error like the |
| following: |
| |
| UBSAN: array-index-out-of-bounds in drivers/tty/serial/ma35d1_serial.c:555:51 |
| index -1 is out of range for type 'uart_ma35d1_port [17] |
| |
| Check the index before using it and bail out with a warning. |
| |
| Fixes: 930cbf92db01 ("tty: serial: Add Nuvoton ma35d1 serial driver support") |
| Signed-off-by: Andi Shyti <andi.shyti@kernel.org> |
| Cc: Jacky Huang <ychuang3@nuvoton.com> |
| Cc: <stable@vger.kernel.org> # v6.5+ |
| Link: https://lore.kernel.org/r/20231204163804.1331415-2-andi.shyti@kernel.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/tty/serial/ma35d1_serial.c | 10 +++++++++- |
| 1 file changed, 9 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/tty/serial/ma35d1_serial.c |
| +++ b/drivers/tty/serial/ma35d1_serial.c |
| @@ -552,11 +552,19 @@ static void ma35d1serial_console_putchar |
| */ |
| static void ma35d1serial_console_write(struct console *co, const char *s, u32 count) |
| { |
| - struct uart_ma35d1_port *up = &ma35d1serial_ports[co->index]; |
| + struct uart_ma35d1_port *up; |
| unsigned long flags; |
| int locked = 1; |
| u32 ier; |
| |
| + if ((co->index < 0) || (co->index >= MA35_UART_NR)) { |
| + pr_warn("Failed to write on ononsole port %x, out of range\n", |
| + co->index); |
| + return; |
| + } |
| + |
| + up = &ma35d1serial_ports[co->index]; |
| + |
| if (up->port.sysrq) |
| locked = 0; |
| else if (oops_in_progress) |
