Skip to content

Commit

Permalink
serial: ma35d1: Validate console index before assignment
Browse files Browse the repository at this point in the history
The console is immediately assigned to the ma35d1 port without
checking its index. This oversight can lead to out-of-bounds
errors when the index falls outside the valid '0' to
MA35_UART_NR range. Such scenario trigges ran error like the
following:

 UBSAN: array-index-out-of-bounds in drivers/tty/serial/ma35d1_serial.c:555:51
 index -1 is out of range for type 'uart_ma35d1_port [17]

Check the index before using it and bail out with a warning.

Fixes: 930cbf9 ("tty: serial: Add Nuvoton ma35d1 serial driver support")
Signed-off-by: Andi Shyti <[email protected]>
Cc: Jacky Huang <[email protected]>
Cc: <[email protected]> # v6.5+
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
  • Loading branch information
Andi Shyti authored and gregkh committed Dec 7, 2023
1 parent 58ac1b3 commit f0b9d97
Showing 1 changed file with 9 additions and 1 deletion.
10 changes: 9 additions & 1 deletion drivers/tty/serial/ma35d1_serial.c
Original file line number Diff line number Diff line change
Expand Up @@ -552,11 +552,19 @@ static void ma35d1serial_console_putchar(struct uart_port *port, unsigned char c
*/
static void ma35d1serial_console_write(struct console *co, const char *s, u32 count)
{
struct uart_ma35d1_port *up = &ma35d1serial_ports[co->index];
struct uart_ma35d1_port *up;
unsigned long flags;
int locked = 1;
u32 ier;

if ((co->index < 0) || (co->index >= MA35_UART_NR)) {
pr_warn("Failed to write on ononsole port %x, out of range\n",
co->index);
return;
}

up = &ma35d1serial_ports[co->index];

if (up->port.sysrq)
locked = 0;
else if (oops_in_progress)
Expand Down

0 comments on commit f0b9d97

Please sign in to comment.