github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

tty: serial: mpc52xx_uart: add bounds check for psc_num array index

Browse Source 
psc_num is derived from port->mapbase bits 11:8, giving a range of
0-15, but the psc_mclk_clk and psc_ipg_clk arrays are sized to
MPC52xx_PSC_MAXNUM (12 when CONFIG_PPC_MPC512x is set). A malformed
device tree with bits 11:8 >= 12 would cause out-of-bounds writes
in mpc512x_psc_alloc_clock() and out-of-bounds reads/writes in
mpc512x_psc_relse_clock() and mpc512x_psc_endis_clock(). The same
unchecked index also appears in mpc512x_psc_handle_irq().

Add ARRAY_SIZE() bounds checks to all four functions before using
psc_num as an array index.

Assisted-by: Opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260530061025.11625-1-rosenp@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Rosen Penev 2026-05-29 23:10:25 -07:00 committed by Greg Kroah-Hartman
parent 9505146e88
commit 4d10588066
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/tty/serial/mpc52xx_uart.c
View File

@ -645,6 +645,8 @@ static irqreturn_t mpc512x_psc_handle_irq(struct uart_port *port)
/* Check if it is an interrupt for this port */
psc_num = (port->mapbase & 0xf00) >> 8;
if (psc_num >= ARRAY_SIZE(psc_mclk_clk))
return IRQ_NONE;
if (test_bit(psc_num, &fifoc_int) ||
test_bit(psc_num + 16, &fifoc_int))
return mpc5xxx_uart_process_int(port);
@ -663,6 +665,8 @@ static int mpc512x_psc_alloc_clock(struct uart_port *port)
int err;
psc_num = (port->mapbase & 0xf00) >> 8;
if (psc_num >= ARRAY_SIZE(psc_mclk_clk))
return -EINVAL;
clk = devm_clk_get(port->dev, "mclk");
if (IS_ERR(clk)) {
@ -711,6 +715,8 @@ static void mpc512x_psc_relse_clock(struct uart_port *port)
struct clk *clk;
psc_num = (port->mapbase & 0xf00) >> 8;
if (psc_num >= ARRAY_SIZE(psc_mclk_clk))
return;
clk = psc_mclk_clk[psc_num];
if (clk) {
clk_disable_unprepare(clk);
@ -733,6 +739,8 @@ static int mpc512x_psc_endis_clock(struct uart_port *port, int enable)
return 0;
psc_num = (port->mapbase & 0xf00) >> 8;
if (psc_num >= ARRAY_SIZE(psc_mclk_clk))
return -ENODEV;
psc_clk = psc_mclk_clk[psc_num];
if (!psc_clk) {
dev_err(port->dev, "Failed to get PSC clock entry!\n");