From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=198.175.65.10 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793102273; b=eekwuHXNk63Hs0QAM1trLxfk4voL9X4GsBkXix1DD08ykdT3PRQFkU/UQEe8AabNLQLt 2ZCBiYXG26dHS8bwrU2ukOK8zRH8bKam0HixfgZnrbzav2Dnyyq91+2oEzTn0a+mrn5gd 6cdvXRa6T2XJvukqxNuDGhUPudDB7e82TfwXgm1vaftKVrrND+VREpWEkiwbdI6i5F94o fbkEJ3vz4aZ3BxZPFx5fI0ewhIRC5qCCASc4dvUnzWaHb0KdXPMmE8H2KpVRm96vVkkx+ c2XkYWYQHctCKOwUotMliA0eaeMgCw6S2Nnd2KjN9n5MHMfwxNXtuKHI7BNwGoZUflA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793102273; h=DMARC-Filter:DKIM-Signature:X-CSE-ConnectionGUID:X-CSE-MsgGUID: X-IronPort-AV:X-IronPort-AV:Received:X-CSE-ConnectionGUID: X-CSE-MsgGUID:X-ExtLoop1:X-IronPort-AV:Received:From:Date:To:cc: Subject:In-Reply-To:Message-ID:References:MIME-Version:Content-Type; bh=2cu82rx5fiphikN/Vk+jUaL/N03EGA9W6I/mCSMf4Gs=; b=qZgKQn+qjIPjURJEgUFVp2wQFxs5U9UvER36i8WrQHds+6d22ofqOivqRK75ujDCbUW9 nXVvB3iOntIdTe2v8GzO2o0Q/4q1lqDKcaHyc8EiCUb7OH1DJRXnEUOP1jLg7eOrbSz4I sb3GsUe70/g5KWooQ7aCKvk0NuRjzQd00AVoPIMYiKjQu2SaUVvchRrvCpCQWDrJKjts+ l7I1emAVN75JERohBtFojKelV8+1KTiSv1OkvtHLpCN10OQTI7DbBlppxEeaYXOWlj+sm I1CBbFF7xx6wVaOuYzuvZs66HhyePNS7hEySr9XInc3KzcuNqtXb9orNu+oW8S64Xjw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=nI7kpECR; arc=none smtp.remote-ip=198.175.65.10 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.10]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14F8D606A31A; Tue, 27 Oct 2026 11:57:51 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 14F8D606A31A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=nI7kpECR DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1793102272; x=1824638272; h=from:date:to:cc:subject:in-reply-to:message-id: references:mime-version; bh=ubZAb9zJvoWNoMVwCd+QomG3MwEYUpWX4/US8bXSPVE=; b=nI7kpECRSzucyQ+LWFXQlZyW+n8MJcN540DS0N6HPLrRHpNA/2+wJcpE O/QTqVD3iFYL7PjWs/aUBtx9mDcSrqWmBTxyB7wiribwnYLwa5PmzK3SI 9YTY+aqSX8v7+LHnN2+Q/pSzTlYaRgHxIYBjCWlHzhqx5RWkmmm3Y6ZXK cvjjP4xV2M/d1j54XjShnLE1qrAPgnZ1PGjXl3OokF7ZsczdTtWXEaJQ/ tPoG2k11+YmA5FoGDKZm3KoYY99jsayWM7HSD2RGHJR8w9+P93mwx6DK/ m8fEgyMPrvAPNlq/dWvfSk5WbkEHKq7S2Zh5bezW7bY6xUq+k9A6oN7Da A==; X-CSE-ConnectionGUID: dkEPfsJwQWOz4iRjEb23Yw== X-CSE-MsgGUID: 1u27nKFLQwOooxtnNfeIHg== X-IronPort-AV: E=McAfee;i="6800,10657,11947"; a="1689543" X-IronPort-AV: E=Sophos;i="6.27,181,1787036400"; d="scan'208";a="1689543" Received: from orviesa003.jf.intel.com ([10.64.159.143]) by orvoesa102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Oct 2026 04:57:51 -0700 X-CSE-ConnectionGUID: dts9eYvHQYOuuPhdOdURHQ== X-CSE-MsgGUID: jOYaDZveRoGiaBz18PtKsA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.27,181,1787036400"; d="scan'208";a="4484504" Received: from ijarvine-mobl1.ger.corp.intel.com (HELO localhost) ([10.245.244.30]) by smtpauth.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Oct 2026 04:57:39 -0700 From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= Date: Tue, 27 Oct 2026 13:57:36 +0200 (EET) To: Greg Kroah-Hartman cc: Jiri Slaby , Joshua Rogers , Chris Mason , Josef Bacik , Tony Lindgren , Rafael Gago Castano , Florian Fainelli , Andy Shevchenko , Peter Hurley , Heikki Krogerus , Crescent Hsieh , Frank Li , Sherry Sun , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Manivannan Sadhasivam , Olof Johansson , =?ISO-8859-15?Q?Andreas_F=E4rber?= , Arnd Bergmann , Krzysztof Kozlowski , Peter Griffin , Alim Akhtar , Robert Baldyga , Thomas Abraham , Kukjin Kim , Patrice Chotard , Srinivas Kandagatla , Maxime Coquelin , Alexandre Torgue , Andy Shevchenko , Vladimir Zapolskiy , Al Cooper , LKML , linux-serial , stable Subject: Re: [PATCH 06/24] serial: 8250: add bounds check for line array in setup_serial() In-Reply-To: <20261027-tty-llm-v1-6-99b0202ae546@linuxfoundation.org> Message-ID: References: <20261027-tty-llm-v1-0-99b0202ae546@linuxfoundation.org> <20261027-tty-llm-v1-6-99b0202ae546@linuxfoundation.org> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII The prefix could be less generic. On Tue, 27 Oct 2026, Greg Kroah-Hartman wrote: > From: Joshua Rogers > > setup_serial() writes to info->line[info->ndev] without verifying that > ndev is within the array bounds. A malformed PCMCIA card with a large Yeah right... Are the "malformed" ones only ones remaining... :-) > I/O window can cause info->multi to exceed 4, leading to out-of-bounds > writes past the line[4] array and corruption of adjacent struct members. > > Cc: Jiri Slaby > Cc: stable > Signed-off-by: Joshua Rogers > Signed-off-by: Greg Kroah-Hartman > --- > drivers/tty/serial/8250/serial_cs.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c > index 5dcd1544e478..8bd88f3d6d86 100644 > --- a/drivers/tty/serial/8250/serial_cs.c > +++ b/drivers/tty/serial/8250/serial_cs.c > @@ -349,6 +349,11 @@ static int setup_serial(struct pcmcia_device *handle, struct serial_info *info, > { > struct uart_8250_port uart; > > + if (info->ndev >= ARRAY_SIZE(info->line)) { > + dev_err(&handle->dev, "no room for more serial ports\n"); > + return -EINVAL; > + } > + > memset(&uart, 0, sizeof(uart)); > uart.port.iobase = iobase; > uart.port.irq = irq; > > -- i.