Re: [PATCH] serial: core: Fix a NULL pointer dereference in uart_parse_earlycon()
From: Xiaochun Li
Date: Thu Aug 06 2026 - 03:17:01 EST
On 8/6/2026 2:16 PM, Greg KH wrote:
On Thu, Aug 06, 2026 at 02:10:11PM +0800, Xiaochun Li wrote:
console=uart and console=pl011 can reach the preferred console matching
path without an options field when a comma is absent from the command
line. In that case uart_parse_earlycon() receives a NULL pointer and
immediately passes it to strncmp(), which triggers a NULL pointer
dereference during console matching.
Address this by returning -EINVAL when the options pointer is missing,
ensuring incomplete console arguments are cleanly rejected while
preserving the behavior of all valid earlycon-style command lines.
Fixes: 73abaf87f01b ("serial: earlycon: Refactor parse_options into serial core")
Signed-off-by: Xiaochun Li <lixiaochun@xxxxxxxxxxxxxx>
---
drivers/tty/serial/serial_core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index a530ad372b43..02e770bf8bf6 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2084,7 +2084,8 @@ EXPORT_SYMBOL_GPL(uart_console_write);
/**
* uart_parse_earlycon - Parse earlycon options
- * @p: ptr to 2nd field (ie., just beyond '<name>,')
+ * @p: ptr to 2nd field (ie., just beyond '<name>,'); %NULL if
+ * no console options were supplied
* @iotype: ptr for decoded iotype (out)
* @addr: ptr for decoded mapbase/iobase (out)
* @options: ptr for <options> field; %NULL if not present (out)
@@ -2104,6 +2105,9 @@ EXPORT_SYMBOL_GPL(uart_console_write);
int uart_parse_earlycon(char *p, enum uart_iotype *iotype,
resource_size_t *addr, char **options)
{
+ if (!p)
+ return -EINVAL;
+
if (strncmp(p, "mmio,", 5) == 0) {
*iotype = UPIO_MEM;
p += 5;
--
2.52.0
How was this tested?
Hi Greg,
The issue can be reproduced with QEMU using the following kernel
command line:
earlyprintk=ttyS0 console=uart
Steps:
1. Build v7.2-rc6 with CONFIG_SERIAL_8250=y and
CONFIG_SERIAL_8250_CONSOLE=y
2. Boot with QEMU:
qemu-system-x86_64 -kernel bzImage -append "earlyprintk=ttyS0 console=uart" -nographic
3. Kernel panics immediately during console_init()
The "console=uart" argument has no comma, so console_setup() in
kernel/printk/printk.c sets options to NULL. When
univ8250_console_match() is called during register_console(), it
passes that NULL directly to uart_parse_earlycon(), which
dereferences it in strncmp().
Panic log below:
[ 0.000000] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 0.000000] #PF: supervisor read access in kernel mode
[ 0.000000] #PF: error_code(0x0000) - not-present page
[ 0.000000] PGD 0 P4D 0
[ 0.000000] Oops: Oops: 0000 [#1] SMP NOPTI
[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc6 #5 PREEMPT(lazy)
[ 0.000000] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.q4
[ 0.000000] RIP: 0010:strncmp+0x1a/0x40
[ 0.000000] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 85 d2 74 24 31 c0 eb 0d 84 c9
[ 0.000000] RSP: 0000:ffffffff82c03df0 EFLAGS: 00000246
[ 0.000000] RAX: 0000000000000000 RBX: ffffffff82c03e20 RCX: ffffffff82c03e20
[ 0.000000] RDX: 0000000000000005 RSI: ffffffff82acb7a1 RDI: 0000000000000000
[ 0.000000] RBP: 0000000000000000 R08: 0000000000000040 R09: 0000000000000001
[ 0.000000] R10: 00000000ffffffea R11: ffffffff82c5cb20 R12: ffffffff82c03e30
[ 0.000000] R13: ffffffff82c03e2c R14: 0000000000000001 R15: 0000000000014770
[ 0.000000] FS: 0000000000000000(0000) GS:ffff8882b4460000(0000) knlGS:0000000000000000
[ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 0.000000] CR2: 0000000000000000 CR3: 0000000002c30000 CR4: 00000000000000b0
[ 0.000000] Call Trace:
[ 0.000000] <TASK>
[ 0.000000] uart_parse_earlycon+0x27/0x140
[ 0.000000] univ8250_console_match+0x5d/0x130
[ 0.000000] ? __do_once_done+0x36/0xa0
[ 0.000000] try_enable_preferred_console+0x62/0x140
[ 0.000000] register_console+0x11a/0x5d0
[ 0.000000] ? __pfx_univ8250_console_init+0x10/0x10
[ 0.000000] univ8250_console_init+0x1f/0x30
[ 0.000000] console_init+0x31/0x110
[ 0.000000] start_kernel+0x50d/0x8b0
[ 0.000000] x86_64_start_reservations+0x18/0x30
[ 0.000000] x86_64_start_kernel+0x10d/0x120
[ 0.000000] common_startup_64+0x13e/0x158
[ 0.000000] </TASK>
[ 0.000000] Modules linked in:
[ 0.000000] CR2: 0000000000000000
[ 0.000000] ---[ end trace 0000000000000000 ]---
[ 0.000000] RIP: 0010:strncmp+0x1a/0x40
[ 0.000000] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 85 d2 74 24 31 c0 eb 0d 84 c9
[ 0.000000] RSP: 0000:ffffffff82c03df0 EFLAGS: 00000246
[ 0.000000] RAX: 0000000000000000 RBX: ffffffff82c03e20 RCX: ffffffff82c03e20
[ 0.000000] RDX: 0000000000000005 RSI: ffffffff82acb7a1 RDI: 0000000000000000
[ 0.000000] RBP: 0000000000000000 R08: 0000000000000040 R09: 0000000000000001
[ 0.000000] R10: 00000000ffffffea R11: ffffffff82c5cb20 R12: ffffffff82c03e30
[ 0.000000] R13: ffffffff82c03e2c R14: 0000000000000001 R15: 0000000000014770
[ 0.000000] FS: 0000000000000000(0000) GS:ffff8882b4460000(0000) knlGS:0000000000000000
[ 0.000000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 0.000000] CR2: 0000000000000000 CR3: 0000000002c30000 CR4: 00000000000000b0
[ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
[ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---
--
Best regards,
Xiaochun Li