Commit f0b9d97a authored by Andi Shyti's avatar Andi Shyti Committed by Greg Kroah-Hartman

serial: ma35d1: Validate console index before assignment

The console is immediately assigned to the ma35d1 port without
checking its index. This oversight can lead to out-of-bounds
errors when the index falls outside the valid '0' to
MA35_UART_NR range. Such scenario trigges ran error like the
following:

 UBSAN: array-index-out-of-bounds in drivers/tty/serial/ma35d1_serial.c:555:51
 index -1 is out of range for type 'uart_ma35d1_port [17]

Check the index before using it and bail out with a warning.

Fixes: 930cbf92 ("tty: serial: Add Nuvoton ma35d1 serial driver support")
Signed-off-by: default avatarAndi Shyti <andi.shyti@kernel.org>
Cc: Jacky Huang <ychuang3@nuvoton.com>
Cc: <stable@vger.kernel.org> # v6.5+
Link: https://lore.kernel.org/r/20231204163804.1331415-2-andi.shyti@kernel.orgSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 58ac1b37
...@@ -552,11 +552,19 @@ static void ma35d1serial_console_putchar(struct uart_port *port, unsigned char c ...@@ -552,11 +552,19 @@ static void ma35d1serial_console_putchar(struct uart_port *port, unsigned char c
*/ */
static void ma35d1serial_console_write(struct console *co, const char *s, u32 count) static void ma35d1serial_console_write(struct console *co, const char *s, u32 count)
{ {
struct uart_ma35d1_port *up = &ma35d1serial_ports[co->index]; struct uart_ma35d1_port *up;
unsigned long flags; unsigned long flags;
int locked = 1; int locked = 1;
u32 ier; u32 ier;
if ((co->index < 0) || (co->index >= MA35_UART_NR)) {
pr_warn("Failed to write on ononsole port %x, out of range\n",
co->index);
return;
}
up = &ma35d1serial_ports[co->index];
if (up->port.sysrq) if (up->port.sysrq)
locked = 0; locked = 0;
else if (oops_in_progress) else if (oops_in_progress)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment