This is a note to let you know that I've just added the patch titled
serial: ma35d1: Validate console index before assignment
to the 6.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
serial-ma35d1-validate-console-index-before-assignment.patch
and it can be found in the queue-6.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From f0b9d97a77fa8f18400450713358303a435ab688 Mon Sep 17 00:00:00 2001
From: Andi Shyti <andi.shyti@xxxxxxxxxx>
Date: Mon, 4 Dec 2023 17:38:03 +0100
Subject: serial: ma35d1: Validate console index before assignment
From: Andi Shyti <andi.shyti@xxxxxxxxxx>
commit f0b9d97a77fa8f18400450713358303a435ab688 upstream.
The console is immediately assigned to the ma35d1 port without
checking its index. This oversight can lead to out-of-bounds
errors when the index falls outside the valid '0' to
MA35_UART_NR range. Such scenario trigges ran error like the
following:
UBSAN: array-index-out-of-bounds in drivers/tty/serial/ma35d1_serial.c:555:51
index -1 is out of range for type 'uart_ma35d1_port [17]
Check the index before using it and bail out with a warning.
Fixes: 930cbf92db01 ("tty: serial: Add Nuvoton ma35d1 serial driver support")
Signed-off-by: Andi Shyti <andi.shyti@xxxxxxxxxx>
Cc: Jacky Huang <ychuang3@xxxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx> # v6.5+
Link: https://lore.kernel.org/r/20231204163804.1331415-2-andi.shyti@xxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/tty/serial/ma35d1_serial.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/ma35d1_serial.c
+++ b/drivers/tty/serial/ma35d1_serial.c
@@ -552,11 +552,19 @@ static void ma35d1serial_console_putchar
*/
static void ma35d1serial_console_write(struct console *co, const char *s, u32 count)
{
- struct uart_ma35d1_port *up = &ma35d1serial_ports[co->index];
+ struct uart_ma35d1_port *up;
unsigned long flags;
int locked = 1;
u32 ier;
+ if ((co->index < 0) || (co->index >= MA35_UART_NR)) {
+ pr_warn("Failed to write on ononsole port %x, out of range\n",
+ co->index);
+ return;
+ }
+
+ up = &ma35d1serial_ports[co->index];
+
if (up->port.sysrq)
locked = 0;
else if (oops_in_progress)
Patches currently in stable-queue which might be from andi.shyti@xxxxxxxxxx are
queue-6.6/serial-ma35d1-validate-console-index-before-assignment.patch
queue-6.6/i2c-ocores-move-system-pm-hooks-to-the-noirq-phase.patch
