From patchwork Tue Feb 20 09:40:16 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 875462 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="XYz3Z0EI"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zlx3C2fBfz9ryy for ; Tue, 20 Feb 2018 21:01:27 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=QAorwRHgRhpn9EtgYJDhzhuY1qfXIB4IcBTUD8uGcI4=; b=XYz3Z0EISI3tSS8H3S4p0FdDXs DuZKSEO/JYTqHvLsFVFTwn5LeISg5udAHB+MPQXPXJn/5EezGkByTKPlSv12e3/g7JNOvObUl1SxT wGv754Lm7dDsIabsFN+m82n//7Y2vjSsPfzFLNvXDhg2fbKixqeRL65eBGyyYmKnAu/PfM7uIIr4v 63ktzQ0Sm9EMvN7RjSjnvqUN/nOApCefPKQrd6nsYGaHaj2LEJQ6uGI53bONMwAvptPm7O2j8WKPy H+kOfCdW6uw9jkm9MvZL6fhvmG/dMmwgW1xVxUSWsixBHQ5711+3t1US0c8ELR5RmqRD/eBkDfbqV kvcCLznQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eo4ji-0001DA-Jh; Tue, 20 Feb 2018 10:01:22 +0000 Received: from albert.telenet-ops.be ([2a02:1800:110:4::f00:1a]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eo4g6-0006QZ-Gd for linux-snps-arc@lists.infradead.org; Tue, 20 Feb 2018 09:57:47 +0000 Received: from ayla.of.borg ([84.194.111.163]) by albert.telenet-ops.be with bizsmtp id CxxL1x00u3XaVaC06xxLa6; Tue, 20 Feb 2018 10:57:25 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.86_2) (envelope-from ) id 1eo4fo-0002mu-Q5; Tue, 20 Feb 2018 10:57:20 +0100 Received: from geert by ramsan with local (Exim 4.86_2) (envelope-from ) id 1eo4PU-0000LO-7W; Tue, 20 Feb 2018 10:40:28 +0100 From: Geert Uytterhoeven To: Greg Kroah-Hartman Subject: [PATCH 1/9] serial: arc_uart: Fix out-of-bounds access through DT alias Date: Tue, 20 Feb 2018 10:40:16 +0100 Message-Id: <1519119624-1268-2-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> References: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180220_015738_849865_5DA37541 X-CRM114-Status: UNSURE ( 7.87 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.4 (--) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-2.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [2a02:1800:110:4:0:0:f00:1a listed in] [list.dnswl.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: linux-snps-arc@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux on Synopsys ARC Processors List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devicetree@vger.kernel.org, Barry Song , Geert Uytterhoeven , Vineet Gupta , Michal Simek , linux-kernel@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-serial@vger.kernel.org, Jiri Slaby , linux-snps-arc@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-snps-arc" Errors-To: linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The arc_uart_ports[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Note that the array size is defined by a Kconfig symbol (CONFIG_SERIAL_ARC_NR_PORTS), so this can even be triggered using a legitimate DTB. Fixes: 10640deb04b7949a ("serial: arc_uart: Fix out-of-bounds access through DT alias") Signed-off-by: Geert Uytterhoeven --- drivers/tty/serial/arc_uart.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c index 2599f9ecccfe7769..1cb827a6b836d0dd 100644 --- a/drivers/tty/serial/arc_uart.c +++ b/drivers/tty/serial/arc_uart.c @@ -593,6 +593,11 @@ static int arc_serial_probe(struct platform_device *pdev) if (dev_id < 0) dev_id = 0; + if (dev_id >= CONFIG_SERIAL_ARC_NR_PORTS) { + dev_err(&pdev->dev, "serial%d out of range\n", dev_id); + return -EINVAL; + } + uart = &arc_uart_ports[dev_id]; port = &uart->port; From patchwork Tue Feb 20 09:40:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 875452 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="pWK1K+Mi"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zlwzp5zvQz9ryy for ; Tue, 20 Feb 2018 20:58:30 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=rEU2SRxlHr9uzifEFX9NIOwher9joEhE9XhpAgGLiWc=; b=pWK1K+MizFqxYFHbwxMpIxUnEb A7gCmih3vVXGu1ACzO3Hkdtr4559sTnEkdzl7eyDXAYvXtNLjAM+T5YKRqkpj5i8sSL6bjjFi156O +KM8v7YA+65/5xSwPVSs14U8/7QNsv5TAzYWuv7f4B4/tUYG0l2KhMRLSlKJVXzMR704z11B44MKR OKNHvB74WPD/zcvzjZfPiEfw2R82PMle/zdzvwb9Br/xcB+kJQ2blcbLBCQwvnF4ztVx6pgBDi07T 1Fv3lRNgvB8vtcpSCJ4iAyhCWDqGhsJea6JWjYaJnAmqbdGSLbBako4pzpEujAdGiJHNoIiVGw83H zFy7hwjA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eo4gu-0006pQ-6e; Tue, 20 Feb 2018 09:58:28 +0000 Received: from albert.telenet-ops.be ([2a02:1800:110:4::f00:1a]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eo4g6-0006QV-GA for linux-snps-arc@lists.infradead.org; Tue, 20 Feb 2018 09:57:41 +0000 Received: from ayla.of.borg ([84.194.111.163]) by albert.telenet-ops.be with bizsmtp id CxxL1x00w3XaVaC06xxLa7; Tue, 20 Feb 2018 10:57:25 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.86_2) (envelope-from ) id 1eo4fo-0002mu-Qu; Tue, 20 Feb 2018 10:57:20 +0100 Received: from geert by ramsan with local (Exim 4.86_2) (envelope-from ) id 1eo4PU-0000LS-8E; Tue, 20 Feb 2018 10:40:28 +0100 From: Geert Uytterhoeven To: Greg Kroah-Hartman Subject: [PATCH 2/9] serial: fsl_lpuart: Fix out-of-bounds access through DT alias Date: Tue, 20 Feb 2018 10:40:17 +0100 Message-Id: <1519119624-1268-3-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> References: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180220_015738_823293_B6D35665 X-CRM114-Status: UNSURE ( 7.16 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.4 (--) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-2.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [2a02:1800:110:4:0:0:f00:1a listed in] [list.dnswl.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: linux-snps-arc@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux on Synopsys ARC Processors List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devicetree@vger.kernel.org, Barry Song , Geert Uytterhoeven , Vineet Gupta , Michal Simek , linux-kernel@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-serial@vger.kernel.org, Jiri Slaby , linux-snps-arc@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-snps-arc" Errors-To: linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The lpuart_ports[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Fixes: 970416c691dc68b5 ("serial: fsl_lpuart: Fix out-of-bounds access through DT alias") Signed-off-by: Geert Uytterhoeven --- drivers/tty/serial/fsl_lpuart.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c index 8cf112f2efc30707..5218e2ed1ba90a5b 100644 --- a/drivers/tty/serial/fsl_lpuart.c +++ b/drivers/tty/serial/fsl_lpuart.c @@ -2145,6 +2145,10 @@ static int lpuart_probe(struct platform_device *pdev) dev_err(&pdev->dev, "failed to get alias id, errno %d\n", ret); return ret; } + if (ret >= UART_NR) { + dev_err(&pdev->dev, "serial%d out of range\n", ret); + return -EINVAL; + } sport->port.line = ret; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); sport->port.membase = devm_ioremap_resource(&pdev->dev, res); From patchwork Tue Feb 20 09:40:18 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 875453 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="NzShpOed"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zlx1P0657z9ryy for ; Tue, 20 Feb 2018 20:59:52 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=yX7HlLieM5VEWsH+jdd0/SvO+Ip4VY3vrYmGD+RU35g=; b=NzShpOedlPWfd9CXW5wH7RWQp5 qeRxqFlxPWgZmd2L4lSiZrATXs9Mx1IPNC+e1uIUYWHkMt7J4oJ7dSbE5pqrM+m1A0Ie1Fqn55DOl cDiy/jUdYHXmhzvp2UH+/ugcURWKJUVcjCIDR2CiOfTVQN23IMwOT7IVodlY0AhKewxY7+JHn0hT+ pA/jhEG0Obj3DM772VBSZ//aEcRTwzdjPRYb+77y0rQsa8EW18q5zmIsJI9I/7yMQsRU8u0XsDhwQ IlTGv/XoUaFylBz70KdpYtvHsYnGTEasLo5pI8wOaMc7r8Kna0ciTeSw6QAsO124FxeDLZGc55yiD lFh6ncrw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eo4iC-0007YI-PI; Tue, 20 Feb 2018 09:59:48 +0000 Received: from albert.telenet-ops.be ([2a02:1800:110:4::f00:1a]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eo4g6-0006QU-GG for linux-snps-arc@lists.infradead.org; Tue, 20 Feb 2018 09:57:45 +0000 Received: from ayla.of.borg ([84.194.111.163]) by albert.telenet-ops.be with bizsmtp id CxxL1x00m3XaVaC06xxLa5; Tue, 20 Feb 2018 10:57:25 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.86_2) (envelope-from ) id 1eo4fo-0002mu-P8; Tue, 20 Feb 2018 10:57:20 +0100 Received: from geert by ramsan with local (Exim 4.86_2) (envelope-from ) id 1eo4PU-0000LW-96; Tue, 20 Feb 2018 10:40:28 +0100 From: Geert Uytterhoeven To: Greg Kroah-Hartman Subject: [PATCH 3/9] serial: imx: Fix out-of-bounds access through DT alias Date: Tue, 20 Feb 2018 10:40:18 +0100 Message-Id: <1519119624-1268-4-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> References: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180220_015738_828608_2C7E6D80 X-CRM114-Status: UNSURE ( 7.47 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.4 (--) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-2.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [2a02:1800:110:4:0:0:f00:1a listed in] [list.dnswl.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: linux-snps-arc@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux on Synopsys ARC Processors List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devicetree@vger.kernel.org, Barry Song , Geert Uytterhoeven , Vineet Gupta , Michal Simek , linux-kernel@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-serial@vger.kernel.org, Jiri Slaby , linux-snps-arc@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-snps-arc" Errors-To: linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The imx_ports[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Fixes: 9206ab8a0350c3da ("serial: imx: Fix out-of-bounds access through DT alias") Signed-off-by: Geert Uytterhoeven --- drivers/tty/serial/imx.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c index 1d7ca382bc12b238..e89e90ad87d8245c 100644 --- a/drivers/tty/serial/imx.c +++ b/drivers/tty/serial/imx.c @@ -2041,6 +2041,11 @@ static int serial_imx_probe(struct platform_device *pdev) serial_imx_probe_pdata(sport, pdev); else if (ret < 0) return ret; + if (sport->port.line >= UART_NR) { + dev_err(&pdev->dev, "serial%d out of range\n", + sport->port.line); + return -EINVAL; + } res = platform_get_resource(pdev, IORESOURCE_MEM, 0); base = devm_ioremap_resource(&pdev->dev, res); From patchwork Tue Feb 20 09:40:19 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 875460 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="lccHREh8"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zlx2C6x7jz9s01 for ; Tue, 20 Feb 2018 21:00:35 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=nj5jguBXq9E5M2eoQuzBH10W6OLO/eO6vqUi53QHG70=; b=lccHREh8IWTQTDXWWAaxmeQXVY qb1G/j/v8CTbw78wv+gYjkW1UxVjmIAZG2WAqfOyxOK1JTmpPgJKlALstoe2RDnWgeiCgynjtNz91 CQwNV+z+qOuJTc1V8MERB+99DkiC4z+SNBKOmG6JpI0NJNxom/6fZAJvuMtwnHEX+ynn32n13MVUF dAznE1waglVz7qhgiqWLwPdKX0BOjPEhjCSFgGcvQ6k6E/utWnbpurylPQZb+dJ6UG6BVI/itFWOg GIzQiPouLpF4yxLUgUCGJRsXjXq9yFIv0nzHdl9UslkONyljW7/oGQK23WVhE94CVGl9bfwaLQBuo 1swKXDYg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eo4is-0000fx-7V; Tue, 20 Feb 2018 10:00:30 +0000 Received: from albert.telenet-ops.be ([2a02:1800:110:4::f00:1a]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eo4g6-0006QW-GR for linux-snps-arc@lists.infradead.org; Tue, 20 Feb 2018 09:57:46 +0000 Received: from ayla.of.borg ([84.194.111.163]) by albert.telenet-ops.be with bizsmtp id CxxL1x00z3XaVaC06xxLa8; Tue, 20 Feb 2018 10:57:25 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.86_2) (envelope-from ) id 1eo4fo-0002mu-Rl; Tue, 20 Feb 2018 10:57:20 +0100 Received: from geert by ramsan with local (Exim 4.86_2) (envelope-from ) id 1eo4PU-0000Lb-Ad; Tue, 20 Feb 2018 10:40:28 +0100 From: Geert Uytterhoeven To: Greg Kroah-Hartman Subject: [PATCH 4/9] serial: mxs-auart: Fix out-of-bounds access through DT alias Date: Tue, 20 Feb 2018 10:40:19 +0100 Message-Id: <1519119624-1268-5-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> References: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180220_015738_835851_4AF6C3B1 X-CRM114-Status: UNSURE ( 7.46 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.4 (--) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-2.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [2a02:1800:110:4:0:0:f00:1a listed in] [list.dnswl.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: linux-snps-arc@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux on Synopsys ARC Processors List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devicetree@vger.kernel.org, Barry Song , Geert Uytterhoeven , Vineet Gupta , Michal Simek , linux-kernel@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-serial@vger.kernel.org, Jiri Slaby , linux-snps-arc@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-snps-arc" Errors-To: linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The auart_port[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Fixes: cabf23e7aa00b145 ("serial: mxs-auart: Fix out-of-bounds access through DT alias") Signed-off-by: Geert Uytterhoeven --- drivers/tty/serial/mxs-auart.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c index 079dc47aa142d8e1..7ec1298512facfc8 100644 --- a/drivers/tty/serial/mxs-auart.c +++ b/drivers/tty/serial/mxs-auart.c @@ -1663,6 +1663,10 @@ static int mxs_auart_probe(struct platform_device *pdev) s->port.line = pdev->id < 0 ? 0 : pdev->id; else if (ret < 0) return ret; + if (s->port.line >= MXS_AUART_PORTS) { + dev_err(&pdev->dev, "serial%d out of range\n", s->port.line); + return -EINVAL; + } if (of_id) { pdev->id_entry = of_id->data; From patchwork Tue Feb 20 09:40:20 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 875470 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="NqzZ8O5X"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zlxW10ZMjz9ryf for ; Tue, 20 Feb 2018 21:22:05 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=okW4QF2ytcG1JQATW4Os84DSIkgAoWTLt0KPiBJkU4A=; b=NqzZ8O5XXyrZ+PQ6HqpVwl1obO Kbhlr/X8QTgDSga8suE9DE3wzfIQ9lrnmoxf45ZgctExH6jOee6FVDvMR1VPIqqolpKHRFBVn2n84 P5Vcxe667iKqbzXAwR0nKWsa8CeIn0IVBgJ3O9fyxusoxlxgfBqgNT1XfTBVcHPP6SzcuJAdgLxHI 1WlNQJZiUBHG9iqH/ZmVU5wfdVeQmTS3YdIFw2hTWMauUBh4+5XCCiNSKQ2i93Buob2LQoEunqyCx DPiVn3QGM9ABrmvnYTNFcZVhtilCYmrINXcBXRlh2Oh/MQqVRrbFLZeG2Q7kaz38fFt/RtuIsqB2d j3Wsedeg==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eo53j-0002tf-9g; Tue, 20 Feb 2018 10:22:03 +0000 Received: from albert.telenet-ops.be ([2a02:1800:110:4::f00:1a]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eo53g-0002r4-6K for linux-snps-arc@lists.infradead.org; Tue, 20 Feb 2018 10:22:01 +0000 Received: from ayla.of.borg ([84.194.111.163]) by albert.telenet-ops.be with bizsmtp id CyMm1x0093XaVaC06yMmY8; Tue, 20 Feb 2018 11:21:48 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.86_2) (envelope-from ) id 1eo4fp-0002mu-1i; Tue, 20 Feb 2018 10:57:21 +0100 Received: from geert by ramsan with local (Exim 4.86_2) (envelope-from ) id 1eo4PU-0000Le-C5; Tue, 20 Feb 2018 10:40:28 +0100 From: Geert Uytterhoeven To: Greg Kroah-Hartman Subject: [PATCH 5/9] serial: pxa: Fix out-of-bounds access through DT alias Date: Tue, 20 Feb 2018 10:40:20 +0100 Message-Id: <1519119624-1268-6-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> References: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180220_022200_413268_8B7E4C02 X-CRM114-Status: UNSURE ( 7.61 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.4 (--) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-2.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [2a02:1800:110:4:0:0:f00:1a listed in] [list.dnswl.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: linux-snps-arc@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux on Synopsys ARC Processors List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devicetree@vger.kernel.org, Barry Song , Geert Uytterhoeven , Vineet Gupta , Michal Simek , linux-kernel@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-serial@vger.kernel.org, Jiri Slaby , linux-snps-arc@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-snps-arc" Errors-To: linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The serial_pxa_ports[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Fixes: c8dcdc77298dde67 ("serial: pxa: Fix out-of-bounds access through DT alias") Signed-off-by: Geert Uytterhoeven --- drivers/tty/serial/pxa.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/pxa.c b/drivers/tty/serial/pxa.c index baf552944d5686e8..ac25faa95baaad0e 100644 --- a/drivers/tty/serial/pxa.c +++ b/drivers/tty/serial/pxa.c @@ -885,6 +885,10 @@ static int serial_pxa_probe(struct platform_device *dev) sport->port.line = dev->id; else if (ret < 0) goto err_clk; + if (sport->port.line > ARRAY_SIZE(serial_pxa_ports)) { + dev_err(&dev->dev, "serial%d out of range\n", sport->port.line); + return -EINVAL; + } snprintf(sport->name, PXA_NAME_LEN - 1, "UART%d", sport->port.line + 1); sport->port.membase = ioremap(mmres->start, resource_size(mmres)); From patchwork Tue Feb 20 09:40:21 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 875463 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="JPuVe50i"; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=infradead.org header.i=@infradead.org header.b="AJiOuBop"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zlx3D2cH2z9s0Z for ; Tue, 20 Feb 2018 21:01:28 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=e2dM6avzP5kjXNDbw5nvqF3YcS12etS+bWW47LVBBI0=; b=JPuVe50iMo+JvW7ekKfdWMF+nX NoOo/wfPyYq50CWiQJ+jEzwvhxAf0iO0t6vgXgbQV1/aoJpIrw7P7ppUwewBzi2Hg15vJPHGrj5TN dDEA3ZHbc7qPygKXigKJSI98XlJk7BKplZ4CSzv4HG/wPVd121OZpMyLkZQw7IR3U4FKtc/dojdYn AXLreLvvhsAPSEnEFaZoli9+UtGjhKeKSqS6ZeHHHpLsIOsgSK4vNEYs0vOs1zucbHYGo8pa0Gtdf fWAXsm6LfeQqueiaqHcX5yDx7U87ITUZK3/TaMOekxv4wEWAiRvj2W0dPr+mamfwlmf4V7okejqtq U1XKvhVw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eo4jj-0001DY-9l; Tue, 20 Feb 2018 10:01:23 +0000 Received: from merlin.infradead.org ([2001:8b0:10b:1231::1]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eo4gF-0006X0-72 for linux-snps-arc@bombadil.infradead.org; Tue, 20 Feb 2018 09:57:47 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=merlin.20170209; h=References:In-Reply-To:Message-Id:Date: Subject:Cc:To:From:Sender:Reply-To:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=JmSIYhb49Tl8mCH2ki3HBJZ5qB3E13FTgpZbL7OKuZE=; b=AJiOuBopcEZsKAnYEw2ZGUCWz oydhHpoFyavi+7Tz5fRVSqjjyqyvQW3wqPIXeAJbaPZ2pWRB50EY47ECiffBszzKvaycAmIGeL241 HzDilUNCSxZOl24Cplw0YnwAm9CEo0DhdI0E5q/W9S4s0NnJ5aUVzG6tQsAEbE9hqQJCO3XZ5s69z 19ZEXehOlByPxNxaDmIOeXc7ijcCkupp0y6OtMNScjiN7hG6W8E+brIZU1dv+CRN2t1er2JRZxWNk mXwR90IOO53rv+HS1dHEPsMukk0Pk0ZgWqELJihKCKybiHsNRTHUuRzf9AKapl9JDvIAQdFw9sB87 2lZCSjmyw==; Received: from leibniz.telenet-ops.be ([195.130.137.77]) by merlin.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eo4gB-0007Jo-Hx for linux-snps-arc@lists.infradead.org; Tue, 20 Feb 2018 09:57:45 +0000 Received: from laurent.telenet-ops.be (laurent.telenet-ops.be [IPv6:2a02:1800:110:4::f00:19]) by leibniz.telenet-ops.be (Postfix) with ESMTPS id 3zlwyc1SbkzMqhLT for ; Tue, 20 Feb 2018 10:57:28 +0100 (CET) Received: from ayla.of.borg ([84.194.111.163]) by laurent.telenet-ops.be with bizsmtp id CxxL1x00r3XaVaC01xxLe8; Tue, 20 Feb 2018 10:57:24 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.86_2) (envelope-from ) id 1eo4fo-0002mu-Sg; Tue, 20 Feb 2018 10:57:20 +0100 Received: from geert by ramsan with local (Exim 4.86_2) (envelope-from ) id 1eo4PU-0000Lo-Cl; Tue, 20 Feb 2018 10:40:28 +0100 From: Geert Uytterhoeven To: Greg Kroah-Hartman Subject: [PATCH 6/9] serial: samsung: Fix out-of-bounds access through DT alias Date: Tue, 20 Feb 2018 10:40:21 +0100 Message-Id: <1519119624-1268-7-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> References: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180220_045743_723246_51288146 X-CRM114-Status: UNSURE ( 7.83 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.4 (--) X-Spam-Report: SpamAssassin version 3.4.1 on merlin.infradead.org summary: Content analysis details: (-2.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [195.130.137.77 listed in list.dnswl.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: linux-snps-arc@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux on Synopsys ARC Processors List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devicetree@vger.kernel.org, Barry Song , Geert Uytterhoeven , Vineet Gupta , Michal Simek , linux-kernel@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-serial@vger.kernel.org, Jiri Slaby , linux-snps-arc@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-snps-arc" Errors-To: linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The s3c24xx_serial_ports[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Note that the array size is defined by a Kconfig symbol (CONFIG_SERIAL_SAMSUNG_UARTS), so this can even be triggered using a legitimate DTB. Fixes: 3ac337e76a1c637b ("serial: samsung: Fix out-of-bounds access through DT alias") Signed-off-by: Geert Uytterhoeven --- drivers/tty/serial/samsung.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c index f9fecc5ed0cee826..9ea42197ceefabba 100644 --- a/drivers/tty/serial/samsung.c +++ b/drivers/tty/serial/samsung.c @@ -1818,6 +1818,10 @@ static int s3c24xx_serial_probe(struct platform_device *pdev) dbg("s3c24xx_serial_probe(%p) %d\n", pdev, index); + if (index >= CONFIG_SERIAL_SAMSUNG_UARTS) { + dev_err(&pdev->dev, "serial%d out of range\n", index); + return -EINVAL; + } ourport = &s3c24xx_serial_ports[index]; ourport->drv_data = s3c24xx_get_driver_data(pdev); From patchwork Tue Feb 20 09:40:22 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 875464 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="LCckpbqA"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zlx4f2jPZz9ryy for ; Tue, 20 Feb 2018 21:02:42 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=oFh1p9gT225RSgNLdU9v76GTaA9LVqdYdWy89o5w5Wk=; b=LCckpbqAVxu44SQbxx9B1qJZB3 SmTF7ETjgSga2en1ylPZxmf7EhrgCm0DpXififtudxwY8xL3KDewvIqGFFWwTi8pfEggiAT5pURSq bs3ZhFawp0b43IO5SplmJP5MpX7pDvI/Kg1iOK1EvLym7/n0Ko9iRE4CH3AmBxNkgiYSo1DmmWyV5 GjhKDkq5dW77EHD0Q7kAf77X3YQFNAfNYCU+NPvnSEzHgsITd4bf9mve9ICjxd/Jl9IpYUhSKzfno DJdkZGlrpoBVnqPhFOFvOSNpes8nsptu9IOavM6eGelyDBwETcnqarw5eaY4oiyUz4WoUCfeya00C VIBe/XGQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eo4kv-0001t1-37; Tue, 20 Feb 2018 10:02:37 +0000 Received: from laurent.telenet-ops.be ([2a02:1800:110:4::f00:19]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eo4g7-0006R5-Pv for linux-snps-arc@lists.infradead.org; Tue, 20 Feb 2018 09:57:54 +0000 Received: from ayla.of.borg ([84.194.111.163]) by laurent.telenet-ops.be with bizsmtp id CxxM1x0023XaVaC01xxMeF; Tue, 20 Feb 2018 10:57:24 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.86_2) (envelope-from ) id 1eo4fp-0002mu-0e; Tue, 20 Feb 2018 10:57:21 +0100 Received: from geert by ramsan with local (Exim 4.86_2) (envelope-from ) id 1eo4PU-0000Lt-E7; Tue, 20 Feb 2018 10:40:28 +0100 From: Geert Uytterhoeven To: Greg Kroah-Hartman Subject: [PATCH 7/9] serial: sh-sci: Fix out-of-bounds access through DT alias Date: Tue, 20 Feb 2018 10:40:22 +0100 Message-Id: <1519119624-1268-8-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> References: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180220_015740_091815_56172AB8 X-CRM114-Status: UNSURE ( 7.04 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.4 (--) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-2.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [2a02:1800:110:4:0:0:f00:19 listed in] [list.dnswl.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: linux-snps-arc@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux on Synopsys ARC Processors List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devicetree@vger.kernel.org, Barry Song , Geert Uytterhoeven , Vineet Gupta , Michal Simek , linux-kernel@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-serial@vger.kernel.org, Jiri Slaby , linux-snps-arc@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-snps-arc" Errors-To: linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The sci_ports[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Note that the array size is defined by a Kconfig symbol (CONFIG_SERIAL_SH_SCI_NR_UARTS), so this can even be triggered using a legitimate DTB. Fixes: f650cdf1c115498e ("serial: sh-sci: Fix out-of-bounds access through DT alias") Signed-off-by: Geert Uytterhoeven --- drivers/tty/serial/sh-sci.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c index 4d14f321cbec95e0..0fb4784860da6188 100644 --- a/drivers/tty/serial/sh-sci.c +++ b/drivers/tty/serial/sh-sci.c @@ -3620,6 +3620,10 @@ static struct plat_sci_port *sci_parse_dt(struct platform_device *pdev, dev_err(&pdev->dev, "failed to get alias id (%d)\n", id); return NULL; } + if (id >= SCI_NPORTS) { + dev_err(&pdev->dev, "serial%d out of range\n", id); + return NULL; + } sp = &sci_ports[id]; *dev_id = id; From patchwork Tue Feb 20 09:40:23 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 875467 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="s6tGo6SC"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zlxDW4J4Qz9s08 for ; Tue, 20 Feb 2018 21:09:31 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=upT9bjYTJXwzEkwRY3T9AJpwq6nPueb6Q5yQWCGQkbo=; b=s6tGo6SCLy7BE90O7o3yhGG3II FlSJTBlW1R0CXvy/uKObwitonrsx7/yuDUOLN+xh8meWKUUruh8L8lRJLIt2rOZolv6kH1ow5ZLBZ 7MEnBtbr7UCKQZ/2zCTsGJylOlxGcrxuVqSJMhrLK2F5q7ekyGC/UlX799m/41MyNn9UZJoKDs+Za 4pGeljuo+QY39DYH6vnMMtHIv+c2+sC9L9ddfyEkuGn5cAlcyN+8DIIbvkr9hg5QtQOHSAtsZOczL 9LRi5ZU7RGDxy8chUzZHH5e2yYIj/skoasJqIU1mfWNxk4+m8ULswPrPdzFz5z4bG0mACObkdXrbu J0Zp+67Q==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eo4rZ-0004L6-0Y; Tue, 20 Feb 2018 10:09:29 +0000 Received: from leibniz.telenet-ops.be ([195.130.137.77]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eo4g8-0006RN-9F for linux-snps-arc@lists.infradead.org; Tue, 20 Feb 2018 09:57:58 +0000 Received: from laurent.telenet-ops.be (laurent.telenet-ops.be [IPv6:2a02:1800:110:4::f00:19]) by leibniz.telenet-ops.be (Postfix) with ESMTPS id 3zlwyc1NxJzMqgw8 for ; Tue, 20 Feb 2018 10:57:28 +0100 (CET) Received: from ayla.of.borg ([84.194.111.163]) by laurent.telenet-ops.be with bizsmtp id CxxM1x0013XaVaC01xxMeB; Tue, 20 Feb 2018 10:57:24 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.86_2) (envelope-from ) id 1eo4fo-0002mu-Uq; Tue, 20 Feb 2018 10:57:20 +0100 Received: from geert by ramsan with local (Exim 4.86_2) (envelope-from ) id 1eo4PU-0000Lz-FG; Tue, 20 Feb 2018 10:40:28 +0100 From: Geert Uytterhoeven To: Greg Kroah-Hartman Subject: [PATCH 8/9] serial: sirf: Fix out-of-bounds access through DT alias Date: Tue, 20 Feb 2018 10:40:23 +0100 Message-Id: <1519119624-1268-9-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> References: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180220_015740_514533_E6705DF5 X-CRM114-Status: UNSURE ( 7.46 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.4 (--) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-2.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [195.130.137.77 listed in list.dnswl.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: linux-snps-arc@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux on Synopsys ARC Processors List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devicetree@vger.kernel.org, Barry Song , Geert Uytterhoeven , Vineet Gupta , Michal Simek , linux-kernel@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-serial@vger.kernel.org, Jiri Slaby , linux-snps-arc@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-snps-arc" Errors-To: linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The sirf_ports[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Fixes: 66c7ab1120585d18 ("serial: sirf: Fix out-of-bounds access through DT alias") Signed-off-by: Geert Uytterhoeven --- drivers/tty/serial/sirfsoc_uart.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/tty/serial/sirfsoc_uart.c b/drivers/tty/serial/sirfsoc_uart.c index 9925b00a97772a1b..701df3319ff7579d 100644 --- a/drivers/tty/serial/sirfsoc_uart.c +++ b/drivers/tty/serial/sirfsoc_uart.c @@ -1283,6 +1283,11 @@ static int sirfsoc_uart_probe(struct platform_device *pdev) goto err; } sirfport->port.line = of_alias_get_id(np, "serial"); + if (sirfport->port.line >= SIRFSOC_UART_NR) { + dev_err(&pdev->dev, "serial%d out of range\n", + sirfport->port.line); + return -EINVAL; + } sirf_ports[sirfport->port.line] = sirfport; sirfport->port.iotype = UPIO_MEM; sirfport->port.flags = UPF_BOOT_AUTOCONF; From patchwork Tue Feb 20 09:40:24 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Geert Uytterhoeven X-Patchwork-Id: 875466 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org; envelope-from=linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="Pw9D7Vgr"; dkim-atps=neutral Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:e::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3zlxDT3qhwz9ryf for ; Tue, 20 Feb 2018 21:09:29 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=hp86Q4aTTbG3mny2SQrME2LWfGn++0ARuxxTMQh19rM=; b=Pw9D7VgrVBFmQskQzflZq6DoYs LB74dePMnoJBhQjLSIIlVm8QRzfdZ/qqTk82KDlYgSTQdAWBKU2pPLAoSq+DrT/GFSbdz31p6Ejbu bP8T5PrM2ri36QnLj+O7T9dWymx0g8mZPkb6kC1lujG0GZImlN2Q/j56b5O712jF2OhrdAjHLmRra cal9zYTsn0nZ3D6e60oXZ8QZPWY1h6bhEfICjUxqRdTr0UESSyazmDm3W6cKkzDAeEbFNbYX1O6AX 92rUCrd1tsApsSM6IZsGMGzKMdCxSAHgCY2iH18/5+Eb14ZkIada7Kw/LU943QmjIAiMKVNbv0X4F ed4xA+JA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.89 #1 (Red Hat Linux)) id 1eo4rX-0004KW-KR; Tue, 20 Feb 2018 10:09:27 +0000 Received: from albert.telenet-ops.be ([2a02:1800:110:4::f00:1a]) by bombadil.infradead.org with esmtps (Exim 4.89 #1 (Red Hat Linux)) id 1eo4g6-0006QS-GE for linux-snps-arc@lists.infradead.org; Tue, 20 Feb 2018 09:57:41 +0000 Received: from ayla.of.borg ([84.194.111.163]) by albert.telenet-ops.be with bizsmtp id CxxM1x0053XaVaC06xxMaA; Tue, 20 Feb 2018 10:57:25 +0100 Received: from ramsan.of.borg ([192.168.97.29] helo=ramsan) by ayla.of.borg with esmtp (Exim 4.86_2) (envelope-from ) id 1eo4fo-0002mu-Vr; Tue, 20 Feb 2018 10:57:20 +0100 Received: from geert by ramsan with local (Exim 4.86_2) (envelope-from ) id 1eo4PU-0000M4-GD; Tue, 20 Feb 2018 10:40:28 +0100 From: Geert Uytterhoeven To: Greg Kroah-Hartman Subject: [PATCH 9/9] serial: xuartps: Fix out-of-bounds access through DT alias Date: Tue, 20 Feb 2018 10:40:24 +0100 Message-Id: <1519119624-1268-10-git-send-email-geert+renesas@glider.be> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> References: <1519119624-1268-1-git-send-email-geert+renesas@glider.be> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180220_015738_766967_F4F1245E X-CRM114-Status: UNSURE ( 8.91 ) X-CRM114-Notice: Please train this message. X-Spam-Score: -2.4 (--) X-Spam-Report: SpamAssassin version 3.4.1 on bombadil.infradead.org summary: Content analysis details: (-2.4 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [2a02:1800:110:4:0:0:f00:1a listed in] [list.dnswl.org] 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-BeenThere: linux-snps-arc@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Linux on Synopsys ARC Processors List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devicetree@vger.kernel.org, Barry Song , Geert Uytterhoeven , Vineet Gupta , Michal Simek , linux-kernel@vger.kernel.org, linux-renesas-soc@vger.kernel.org, linux-serial@vger.kernel.org, Jiri Slaby , linux-snps-arc@lists.infradead.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-snps-arc" Errors-To: linux-snps-arc-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org The cdns_uart_port[] array is indexed using a value derived from the "serialN" alias in DT, which may lead to an out-of-bounds access. Fix this by adding a range check. Fixes: 1f118c02a1819856 ("serial: xuartps: Fix out-of-bounds access through DT alias") Signed-off-by: Geert Uytterhoeven --- drivers/tty/serial/xilinx_uartps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c index b9b2bc76bcac606c..abcb4d09a2d866d0 100644 --- a/drivers/tty/serial/xilinx_uartps.c +++ b/drivers/tty/serial/xilinx_uartps.c @@ -1110,7 +1110,7 @@ static struct uart_port *cdns_uart_get_port(int id) struct uart_port *port; /* Try the given port id if failed use default method */ - if (cdns_uart_port[id].mapbase != 0) { + if (id < CDNS_UART_NR_PORTS && cdns_uart_port[id].mapbase != 0) { /* Find the next unused port */ for (id = 0; id < CDNS_UART_NR_PORTS; id++) if (cdns_uart_port[id].mapbase == 0)