]>
Commit | Line | Data |
---|---|---|
06e23a17 GKH |
1 | From foo@baz Thu May 24 11:09:34 CEST 2018 |
2 | From: Geert Uytterhoeven <geert+renesas@glider.be> | |
3 | Date: Fri, 23 Feb 2018 14:38:31 +0100 | |
4 | Subject: serial: imx: Fix out-of-bounds access through serial port index | |
5 | ||
6 | From: Geert Uytterhoeven <geert+renesas@glider.be> | |
7 | ||
8 | [ Upstream commit 5673444821406dda5fc25e4b52aca419f8065a19 ] | |
9 | ||
10 | The imx_ports[] array is indexed using a value derived from the | |
11 | "serialN" alias in DT, or from platform data, which may lead to an | |
12 | out-of-bounds access. | |
13 | ||
14 | Fix this by adding a range check. | |
15 | ||
16 | Fixes: ff05967a07225ab6 ("serial/imx: add of_alias_get_id() reference back") | |
17 | Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> | |
18 | Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> | |
19 | Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> | |
20 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
21 | --- | |
22 | drivers/tty/serial/imx.c | 6 ++++++ | |
23 | 1 file changed, 6 insertions(+) | |
24 | ||
25 | --- a/drivers/tty/serial/imx.c | |
26 | +++ b/drivers/tty/serial/imx.c | |
27 | @@ -2096,6 +2096,12 @@ static int serial_imx_probe(struct platf | |
28 | else if (ret < 0) | |
29 | return ret; | |
30 | ||
31 | + if (sport->port.line >= ARRAY_SIZE(imx_ports)) { | |
32 | + dev_err(&pdev->dev, "serial%d out of range\n", | |
33 | + sport->port.line); | |
34 | + return -EINVAL; | |
35 | + } | |
36 | + | |
37 | res = platform_get_resource(pdev, IORESOURCE_MEM, 0); | |
38 | base = devm_ioremap_resource(&pdev->dev, res); | |
39 | if (IS_ERR(base)) |