[PATCH] 8250_men_mcb: port.dev unset can entail a null ptr deref

[Filip Jensen]

The dev field of the uart_port structure is needed in the later call to
serial8250_register_8250_port and unless the port is part of the initial
registered ports (cf. CONFIG_SERIAL_8250_RUNTIME_UARTS) with a dev
already set, it will make a null pointer deref in has_acpi_companion
and could also later at uart_add_one_port call:

Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range
RIP: 0010:serial8250_register_8250_port+0xd34/0x2030
drivers/tty/serial/8250/8250_core.c

A proposal for a security check against this missing field in any driver
for the 8250_core.c will be sent in another patch.

Reviewed-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@xxxxxxxxxx>
Signed-off-by: Filip Jensen <dev-Felipe.Jensen@xxxxxxxxxx>
---
 drivers/tty/serial/8250/8250_men_mcb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/8250/8250_men_mcb.c b/drivers/tty/serial/8250/8250_men_mcb.c
index 6373234da03d..259516078793 100644
--- a/drivers/tty/serial/8250/8250_men_mcb.c
+++ b/drivers/tty/serial/8250/8250_men_mcb.c
@@ -214,6 +214,7 @@ static int serial_8250_men_mcb_probe(struct mcb_device *mdev,
 		uart.port.iotype = UPIO_MEM;
 		uart.port.uartclk = men_lookup_uartclk(mdev);
 		uart.port.irq = mcb_get_irq(mdev);
+		uart.port.dev = &mdev->dev;
 		uart.port.mapbase = (unsigned long) mem->start
 					    + data->offset[i];
 
-- 
2.34.1