Hi all,
Serial drivers used on DT platforms use the "serialN" alias in DT to
obtain the serial port index for a specific port. Drivers typically use
a fixed-size array for keeping track of all available serial ports.
However, several drivers do not perform any validation on the index
obtained from DT, which may lead to out-of-bounds accesses of these
fixed-size arrays.
While the DTB passed to the kernel might be considered trusted, some of
these out-of-bounds accesses can be triggered by a legitimate DTB:
- In some drivers the size of the array is defined by a Kconfig
symbol, so a user who doesn't need all serial ports may lower this
value rightfully,
- Tomorrow's new SoC may have more serial ports than the fixed-size
array in today's driver can accommodate, which the user may forget
to enlarge.
Hence this series fixes that by adding checks for out-of-range aliases,
logging an error message when triggered.
Tested on r8a7791/koelsch (sh-sci), all other drivers were
compile-tested only.
Thanks for your comments!
Geert Uytterhoeven (9):
serial: arc_uart: Fix out-of-bounds access through DT alias
serial: fsl_lpuart: Fix out-of-bounds access through DT alias
serial: imx: Fix out-of-bounds access through DT alias
serial: mxs-auart: Fix out-of-bounds access through DT alias
serial: pxa: Fix out-of-bounds access through DT alias
serial: samsung: Fix out-of-bounds access through DT alias
serial: sh-sci: Fix out-of-bounds access through DT alias
serial: sirf: Fix out-of-bounds access through DT alias
serial: xuartps: Fix out-of-bounds access through DT alias
drivers/tty/serial/arc_uart.c | 5 +++++
drivers/tty/serial/fsl_lpuart.c | 4 ++++
drivers/tty/serial/imx.c | 5 +++++
drivers/tty/serial/mxs-auart.c | 4 ++++
drivers/tty/serial/pxa.c | 4 ++++
drivers/tty/serial/samsung.c | 4 ++++
drivers/tty/serial/sh-sci.c | 4 ++++
drivers/tty/serial/sirfsoc_uart.c | 5 +++++
drivers/tty/serial/xilinx_uartps.c | 2 +-
9 files changed, 36 insertions(+), 1 deletion(-)
--
2.7.4
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
The s3c24xx_serial_ports[] array is indexed using a value derived from
the "serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Note that the array size is defined by a Kconfig symbol
(CONFIG_SERIAL_SAMSUNG_UARTS), so this can even be triggered using a
legitimate DTB.
Fixes: 3ac337e76a1c637b ("serial: samsung: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
drivers/tty/serial/samsung.c | 4 ++++
1 file changed, 4 insertions(+)
@@ -1818,6 +1818,10 @@ static int s3c24xx_serial_probe(struct platform_device *pdev)dbg("s3c24xx_serial_probe(%p) %d\n",pdev,index);+if(index>=CONFIG_SERIAL_SAMSUNG_UARTS){+dev_err(&pdev->dev,"serial%d out of range\n",index);+return-EINVAL;+}ourport=&s3c24xx_serial_ports[index];ourport->drv_data=s3c24xx_get_driver_data(pdev);
The sci_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Note that the array size is defined by a Kconfig symbol
(CONFIG_SERIAL_SH_SCI_NR_UARTS), so this can even be triggered using a
legitimate DTB.
Fixes: f650cdf1c115498e ("serial: sh-sci: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
drivers/tty/serial/sh-sci.c | 4 ++++
1 file changed, 4 insertions(+)
@@ -3620,6 +3620,10 @@ static struct plat_sci_port *sci_parse_dt(struct platform_device *pdev,dev_err(&pdev->dev,"failed to get alias id (%d)\n",id);returnNULL;}+if(id>=SCI_NPORTS){+dev_err(&pdev->dev,"serial%d out of range\n",id);+returnNULL;+}sp=&sci_ports[id];*dev_id=id;
The sirf_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 66c7ab1120585d18 ("serial: sirf: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
drivers/tty/serial/sirfsoc_uart.c | 5 +++++
1 file changed, 5 insertions(+)
@@ -1283,6 +1283,11 @@ static int sirfsoc_uart_probe(struct platform_device *pdev)gotoerr;}sirfport->port.line=of_alias_get_id(np,"serial");+if(sirfport->port.line>=SIRFSOC_UART_NR){+dev_err(&pdev->dev,"serial%d out of range\n",+sirfport->port.line);+return-EINVAL;+}sirf_ports[sirfport->port.line]=sirfport;sirfport->port.iotype=UPIO_MEM;sirfport->port.flags=UPF_BOOT_AUTOCONF;
The cdns_uart_port[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 1f118c02a1819856 ("serial: xuartps: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
drivers/tty/serial/xilinx_uartps.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
@@ -1110,7 +1110,7 @@ static struct uart_port *cdns_uart_get_port(int id)structuart_port*port;/* Try the given port id if failed use default method */-if(cdns_uart_port[id].mapbase!=0){+if(id<CDNS_UART_NR_PORTS&&cdns_uart_port[id].mapbase!=0){/* Find the next unused port */for(id=0;id<CDNS_UART_NR_PORTS;id++)if(cdns_uart_port[id].mapbase==0)
The lpuart_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 970416c691dc68b5 ("serial: fsl_lpuart: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
drivers/tty/serial/fsl_lpuart.c | 4 ++++
1 file changed, 4 insertions(+)
@@ -2145,6 +2145,10 @@ static int lpuart_probe(struct platform_device *pdev)dev_err(&pdev->dev,"failed to get alias id, errno %d\n",ret);returnret;}+if(ret>=UART_NR){+dev_err(&pdev->dev,"serial%d out of range\n",ret);+return-EINVAL;+}sport->port.line=ret;res=platform_get_resource(pdev,IORESOURCE_MEM,0);sport->port.membase=devm_ioremap_resource(&pdev->dev,res);
The imx_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 9206ab8a0350c3da ("serial: imx: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
drivers/tty/serial/imx.c | 5 +++++
1 file changed, 5 insertions(+)
@@ -2041,6 +2041,11 @@ static int serial_imx_probe(struct platform_device *pdev)serial_imx_probe_pdata(sport,pdev);elseif(ret<0)returnret;+if(sport->port.line>=UART_NR){+dev_err(&pdev->dev,"serial%d out of range\n",+sport->port.line);+return-EINVAL;+}res=platform_get_resource(pdev,IORESOURCE_MEM,0);base=devm_ioremap_resource(&pdev->dev,res);
The arc_uart_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Note that the array size is defined by a Kconfig symbol
(CONFIG_SERIAL_ARC_NR_PORTS), so this can even be triggered using a
legitimate DTB.
Fixes: 10640deb04b7949a ("serial: arc_uart: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
drivers/tty/serial/arc_uart.c | 5 +++++
1 file changed, 5 insertions(+)
@@ -593,6 +593,11 @@ static int arc_serial_probe(struct platform_device *pdev)if(dev_id<0)dev_id=0;+if(dev_id>=CONFIG_SERIAL_ARC_NR_PORTS){+dev_err(&pdev->dev,"serial%d out of range\n",dev_id);+return-EINVAL;+}+uart=&arc_uart_ports[dev_id];port=&uart->port;
The auart_port[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: cabf23e7aa00b145 ("serial: mxs-auart: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
drivers/tty/serial/mxs-auart.c | 4 ++++
1 file changed, 4 insertions(+)
@@ -1663,6 +1663,10 @@ static int mxs_auart_probe(struct platform_device *pdev)s->port.line=pdev->id<0?0:pdev->id;elseif(ret<0)returnret;+if(s->port.line>=MXS_AUART_PORTS){+dev_err(&pdev->dev,"serial%d out of range\n",s->port.line);+return-EINVAL;+}if(of_id){pdev->id_entry=of_id->data;
The serial_pxa_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: c8dcdc77298dde67 ("serial: pxa: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
---
drivers/tty/serial/pxa.c | 4 ++++
1 file changed, 4 insertions(+)
@@ -885,6 +885,10 @@ static int serial_pxa_probe(struct platform_device *dev)sport->port.line=dev->id;elseif(ret<0)gotoerr_clk;+if(sport->port.line>ARRAY_SIZE(serial_pxa_ports)){+dev_err(&dev->dev,"serial%d out of range\n",sport->port.line);+return-EINVAL;+}snprintf(sport->name,PXA_NAME_LEN-1,"UART%d",sport->port.line+1);sport->port.membase=ioremap(mmres->start,resource_size(mmres));
From: Michal Simek <hidden> Date: 2018-02-20 10:22:26
On 20.2.2018 10:40, Geert Uytterhoeven wrote:
The cdns_uart_port[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 1f118c02a1819856 ("serial: xuartps: Fix out-of-bounds access through DT alias")
@@ -1110,7 +1110,7 @@ static struct uart_port *cdns_uart_get_port(int id)structuart_port*port;/* Try the given port id if failed use default method */-if(cdns_uart_port[id].mapbase!=0){+if(id<CDNS_UART_NR_PORTS&&cdns_uart_port[id].mapbase!=0){/* Find the next unused port */for(id=0;id<CDNS_UART_NR_PORTS;id++)if(cdns_uart_port[id].mapbase==0)
Below should be better fix for this driver.
Thanks,
Michal
diff --git a/drivers/tty/serial/xilinx_uartps.c
b/drivers/tty/serial/xilinx_uartps.c
index b9b2bc76bcac..b77c6477ed93 100644
@@ -1109,6 +1109,9 @@ static struct uart_port *cdns_uart_get_port(int id){structuart_port*port;+if(id>=CDNS_UART_NR_PORTS)+returnNULL;+/* Try the given port id if failed use default method */if(cdns_uart_port[id].mapbase!=0){/* Find the next unused port */
@@ -1117,9 +1120,6 @@ static struct uart_port *cdns_uart_get_port(int id)break;}-if(id>=CDNS_UART_NR_PORTS)-returnNULL;-port=&cdns_uart_port[id];/* At this point, we've got an empty uart_port struct,
Hello Geert,
On Tue, Feb 20, 2018 at 10:40:18AM +0100, Geert Uytterhoeven wrote:
The imx_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 9206ab8a0350c3da ("serial: imx: Fix out-of-bounds access through DT alias")
@@ -2041,6 +2041,11 @@ static int serial_imx_probe(struct platform_device *pdev)serial_imx_probe_pdata(sport,pdev);elseif(ret<0)returnret;
I'd prefer an empty line here.
+ if (sport->port.line >= UART_NR) {
I would have used:
if (sport->port.line >= ARRAY_SIZE(imx_ports))
which IMHO is better understandable
+ dev_err(&pdev->dev, "serial%d out of range\n",
+ sport->port.line);
Note that the same overflow can happen when a device is probed using
platform data (and your commit fixes that, too). Maybe worth to point
out in the commit log?
Other than that: Good catch, thanks for your patch.
Best regards
Uwe
--
Pengutronix e.K. | Uwe Kleine-König |
Industrial Linux Solutions | http://www.pengutronix.de/ |
Hi Michal,
On Tue, Feb 20, 2018 at 11:22 AM, Michal Simek [off-list ref] wrote:
On 20.2.2018 10:40, Geert Uytterhoeven wrote:
quoted
The cdns_uart_port[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 1f118c02a1819856 ("serial: xuartps: Fix out-of-bounds access through DT alias")
I didn't find this sha1 - patch name is this one.
Bummer, I totally screwed up my scripting...
Fixes: 928e9263492069ee ("tty: xuartps: Initialize ports according to aliases")
@@ -1110,7 +1110,7 @@ static struct uart_port *cdns_uart_get_port(int id)structuart_port*port;/* Try the given port id if failed use default method */-if(cdns_uart_port[id].mapbase!=0){+if(id<CDNS_UART_NR_PORTS&&cdns_uart_port[id].mapbase!=0){/* Find the next unused port */for(id=0;id<CDNS_UART_NR_PORTS;id++)if(cdns_uart_port[id].mapbase==0)
@@ -1109,6 +1109,9 @@ static struct uart_port *cdns_uart_get_port(int id){structuart_port*port;+if(id>=CDNS_UART_NR_PORTS)+returnNULL;+/* Try the given port id if failed use default method */if(cdns_uart_port[id].mapbase!=0){/* Find the next unused port */
... the above check cannot be removed, as it is needed to support the loop
above to find an unused port.
port = &cdns_uart_port[id];
/* At this point, we've got an empty uart_port struct,
initialize it */
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
Hi Uwe,
On Tue, Feb 20, 2018 at 11:31 AM, Uwe Kleine-König
[off-list ref] wrote:
On Tue, Feb 20, 2018 at 10:40:18AM +0100, Geert Uytterhoeven wrote:
quoted
The imx_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 9206ab8a0350c3da ("serial: imx: Fix out-of-bounds access through DT alias")
@@ -2041,6 +2041,11 @@ static int serial_imx_probe(struct platform_device *pdev)serial_imx_probe_pdata(sport,pdev);elseif(ret<0)returnret;
I'd prefer an empty line here.
OK
quoted
+ if (sport->port.line >= UART_NR) {
I would have used:
if (sport->port.line >= ARRAY_SIZE(imx_ports))
which IMHO is better understandable
OK.
quoted
+ dev_err(&pdev->dev, "serial%d out of range\n",
+ sport->port.line);
Note that the same overflow can happen when a device is probed using
platform data (and your commit fixes that, too). Maybe worth to point
out in the commit log?
That's correct. But board code is tied more intimate to the kernel.
Will update.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
_______________________________________________
linux-snps-arc mailing list
linux-snps-arc@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-snps-arc
On Tue, Feb 20, 2018 at 10:40 AM, Geert Uytterhoeven
[off-list ref] wrote:
The arc_uart_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Note that the array size is defined by a Kconfig symbol
(CONFIG_SERIAL_ARC_NR_PORTS), so this can even be triggered using a
legitimate DTB.
Fixes: 10640deb04b7949a ("serial: arc_uart: Fix out-of-bounds access through DT alias")
Fixes: ea28fd56fcde69af ("serial/arc-uart: switch to devicetree based probing")
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Tue, Feb 20, 2018 at 10:40 AM, Geert Uytterhoeven
[off-list ref] wrote:
The lpuart_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 970416c691dc68b5 ("serial: fsl_lpuart: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Fixes: c9e2e946fb0ba5d2 ("tty: serial: add Freescale lpuart driver support")
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Tue, Feb 20, 2018 at 10:40 AM, Geert Uytterhoeven
[off-list ref] wrote:
The auart_port[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: cabf23e7aa00b145 ("serial: mxs-auart: Fix out-of-bounds access through DT alias")
Fixes: 1ea6607d4cdc9179 ("serial: mxs-auart: Allow device tree probing")
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Tue, Feb 20, 2018 at 10:40 AM, Geert Uytterhoeven
[off-list ref] wrote:
The serial_pxa_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: c8dcdc77298dde67 ("serial: pxa: Fix out-of-bounds access through DT alias")
Fixes: 699c20f3e6310aa2 ("serial: pxa: add OF support")
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Tue, Feb 20, 2018 at 10:40 AM, Geert Uytterhoeven
[off-list ref] wrote:
The s3c24xx_serial_ports[] array is indexed using a value derived from
the "serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Note that the array size is defined by a Kconfig symbol
(CONFIG_SERIAL_SAMSUNG_UARTS), so this can even be triggered using a
legitimate DTB.
Fixes: 3ac337e76a1c637b ("serial: samsung: Fix out-of-bounds access through DT alias")
Fixes: 13a9f6c64fdc55eb ("serial: samsung: Consider DT alias when probing po
rts")
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Tue, Feb 20, 2018 at 10:40 AM, Geert Uytterhoeven
[off-list ref] wrote:
The sci_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Note that the array size is defined by a Kconfig symbol
(CONFIG_SERIAL_SH_SCI_NR_UARTS), so this can even be triggered using a
legitimate DTB.
Fixes: f650cdf1c115498e ("serial: sh-sci: Fix out-of-bounds access through DT alias")
Fixes: 97ed9790c514066b ("serial: sh-sci: Remove unused platform data
capabilities field")
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Tue, Feb 20, 2018 at 10:40 AM, Geert Uytterhoeven
[off-list ref] wrote:
The sirf_ports[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 66c7ab1120585d18 ("serial: sirf: Fix out-of-bounds access through DT alias")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Fixes: a6ffe8966acbb66b ("serial: sirf: use dynamic method allocate
uart structure")
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
From: Michal Simek <hidden> Date: 2018-02-20 11:27:46
On 20.2.2018 11:38, Geert Uytterhoeven wrote:
Hi Michal,
On Tue, Feb 20, 2018 at 11:22 AM, Michal Simek [off-list ref] wrote:
quoted
On 20.2.2018 10:40, Geert Uytterhoeven wrote:
quoted
The cdns_uart_port[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
Fixes: 1f118c02a1819856 ("serial: xuartps: Fix out-of-bounds access through DT alias")
I didn't find this sha1 - patch name is this one.
Bummer, I totally screwed up my scripting...
Fixes: 928e9263492069ee ("tty: xuartps: Initialize ports according to aliases")
@@ -1110,7 +1110,7 @@ static struct uart_port *cdns_uart_get_port(int id)structuart_port*port;/* Try the given port id if failed use default method */-if(cdns_uart_port[id].mapbase!=0){+if(id<CDNS_UART_NR_PORTS&&cdns_uart_port[id].mapbase!=0){/* Find the next unused port */for(id=0;id<CDNS_UART_NR_PORTS;id++)if(cdns_uart_port[id].mapbase==0)
@@ -1109,6 +1109,9 @@ static struct uart_port *cdns_uart_get_port(int id){structuart_port*port;+if(id>=CDNS_UART_NR_PORTS)+returnNULL;+/* Try the given port id if failed use default method */if(cdns_uart_port[id].mapbase!=0){/* Find the next unused port */
... the above check cannot be removed, as it is needed to support the loop
above to find an unused port.
You are right.
I have checked 4 patches I have sent in past which didn't reach mainline
(probably because of RFC)
Take a look at
https://www.spinics.net/lists/linux-serial/msg27106.html
I have removed cdns_uart_port array completely there.
Thanks,
Michal
Hi Michal,
On Tue, Feb 20, 2018 at 12:27 PM, Michal Simek [off-list ref] wrote:
On 20.2.2018 11:38, Geert Uytterhoeven wrote:
quoted
On Tue, Feb 20, 2018 at 11:22 AM, Michal Simek [off-list ref] wrote:
quoted
On 20.2.2018 10:40, Geert Uytterhoeven wrote:
quoted
The cdns_uart_port[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
I have checked 4 patches I have sent in past which didn't reach mainline
(probably because of RFC)
Take a look at
https://www.spinics.net/lists/linux-serial/msg27106.html
I have removed cdns_uart_port array completely there.
Nice! I'd love to get rid of fixed arrays in serial...
However, IMHO it's still worthwhile to fix the out-of-bounds access first,
as that fix can be backported to stable kernels easily.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
From: Michal Simek <hidden> Date: 2018-02-20 12:39:44
On 20.2.2018 13:27, Geert Uytterhoeven wrote:
Hi Michal,
On Tue, Feb 20, 2018 at 12:27 PM, Michal Simek [off-list ref] wrote:
quoted
On 20.2.2018 11:38, Geert Uytterhoeven wrote:
quoted
On Tue, Feb 20, 2018 at 11:22 AM, Michal Simek [off-list ref] wrote:
quoted
On 20.2.2018 10:40, Geert Uytterhoeven wrote:
quoted
The cdns_uart_port[] array is indexed using a value derived from the
"serialN" alias in DT, which may lead to an out-of-bounds access.
Fix this by adding a range check.
quoted
I have checked 4 patches I have sent in past which didn't reach mainline
(probably because of RFC)
Take a look at
https://www.spinics.net/lists/linux-serial/msg27106.html
I have removed cdns_uart_port array completely there.
Nice! I'd love to get rid of fixed arrays in serial...
However, IMHO it's still worthwhile to fix the out-of-bounds access first,
as that fix can be backported to stable kernels easily.
I agree with you. Not a problem with your patch and for me it won't be
problem to rebase.
I would love to get rid of CDNS_UART_NR_PORTS but unfortunately this is
passed to core via .nr.
Thanks,
Michal