Re: [PATCHv3 5/6] serial: mxs-auart: clamp RX DMA count to buffer size

[Frank Li]

On Wed, Jun 10, 2026 at 08:38:55PM -0700, Rosen Penev wrote:
> In dma_rx_callback(), the RX count from the hardware status register
> (AUART_STAT_RXCOUNT_MASK = 0xffff) is passed directly to
> tty_insert_flip_string() without any bounds check. Since rx_dma_buf
> is allocated with UART_XMIT_SIZE (4096 bytes), a hardware fault or
> compromised peripheral reporting a count larger than 4096 would cause
> an out-of-bounds read, potentially leaking kernel memory.
>
> Clamp the count to UART_XMIT_SIZE before use.
>
> Assisted-by: opencode:big-pickle
> Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>
> ---
>  drivers/tty/serial/mxs-auart.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
> index e2b656638ab3..fe48a372d022 100644
> --- a/drivers/tty/serial/mxs-auart.c
> +++ b/drivers/tty/serial/mxs-auart.c
> @@ -823,7 +823,7 @@ static void dma_rx_callback(void *arg)
>  	stat &= ~(AUART_STAT_OERR | AUART_STAT_BERR |
>  			AUART_STAT_PERR | AUART_STAT_FERR);
>
> -	count = stat & AUART_STAT_RXCOUNT_MASK;
> +	count = min_t(u32, stat & AUART_STAT_RXCOUNT_MASK, UART_XMIT_SIZE);

Now, needn't min_t(), min() should work

Frank

>  	tty_insert_flip_string(port, s->rx_dma_buf, count);
>
>  	mxs_write(stat, s, REG_STAT);
> --
> 2.54.0
>
>