From: Wayen Yan Date: Sun, 14 Jun 2026 03:19:21 +0000 (+0800) Subject: uart: airoha: fix out-of-bounds access in baud rate calculation X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F23783%2Fhead;p=thirdparty%2Fopenwrt.git uart: airoha: fix out-of-bounds access in baud rate calculation The baud rate table lookup does not check if the requested index is within bounds before accessing the array. This can cause out-of-bounds read when an unsupported baud rate is requested. Signed-off-by: Wayen Yan Link: https://github.com/openwrt/openwrt/pull/23783 Signed-off-by: Jonas Jelonek --- diff --git a/target/linux/airoha/patches-6.18/886-uart-add-en7523-support.patch b/target/linux/airoha/patches-6.18/886-uart-add-en7523-support.patch index 4a94fb49453..11180660131 100644 --- a/target/linux/airoha/patches-6.18/886-uart-add-en7523-support.patch +++ b/target/linux/airoha/patches-6.18/886-uart-add-en7523-support.patch @@ -1,6 +1,6 @@ --- /dev/null +++ b/drivers/tty/serial/8250/8250_en7523.c -@@ -0,0 +1,94 @@ +@@ -0,0 +1,96 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Airoha EN7523 driver. @@ -84,6 +84,8 @@ + xyd_x = ((nom/denom) << 4); + if (xyd_x < XYD_Y) break; + } ++ if (i >= CLOCK_DIV_TAB_ELEMS) ++ i = CLOCK_DIV_TAB_ELEMS - 1; + + serial_port_out(port, UART_XINCLKDR, clock_div_reg[i]); + serial_port_out(port, UART_XYD, (xyd_x<<16) | XYD_Y);