uart: airoha: fix out-of-bounds access in baud rate calculation

The baud rate table lookup does not check if the requested index
is within bounds before accessing the array. This can cause
out-of-bounds read when an unsupported baud rate is requested.

Signed-off-by: Wayen Yan <win847@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23783
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

diff --git a/target/linux/airoha/patches-6.18/886-uart-add-en7523-support.patch b/target/linux/airoha/patches-6.18/886-uart-add-en7523-support.patch
index 4a94fb494535404da51d875d5205e95c76721ed3..111806601314b95cdc9022be6a515ae910825f3d 100644 (file)
--- a/target/linux/airoha/patches-6.18/886-uart-add-en7523-support.patch
+++ b/target/linux/airoha/patches-6.18/886-uart-add-en7523-support.patch
@@ -1,6 +1,6 @@
 --- /dev/null
 +++ b/drivers/tty/serial/8250/8250_en7523.c
-@@ -0,0 +1,94 @@
+@@ -0,0 +1,96 @@
 +// SPDX-License-Identifier: GPL-2.0+
 +/*
 + * Airoha EN7523 driver.
@@ -84,6 +84,8 @@
 +              xyd_x = ((nom/denom) << 4);
 +              if (xyd_x < XYD_Y) break;
 +      }
++      if (i >= CLOCK_DIV_TAB_ELEMS)
++              i = CLOCK_DIV_TAB_ELEMS - 1;
 +
 +      serial_port_out(port, UART_XINCLKDR, clock_div_reg[i]);
 +      serial_port_out(port, UART_XYD, (xyd_x<<16) | XYD_Y);