Re: [PATCH v2] serial: core: Fix a NULL pointer dereference in uart_parse_earlycon()
From: Xiaochun Li
Date: Tue Aug 25 2026 - 03:29:03 EST
On 8/6/2026 4:48 PM, Xiaochun Li wrote:
console=uart and console=pl011 can reach the preferred console matching
path without an options field when a comma is absent from the command
line. In that case uart_parse_earlycon() receives a NULL pointer and
immediately passes it to strncmp(), which triggers a NULL pointer
dereference during console matching.
Address this by returning -EINVAL when the options pointer is missing,
ensuring incomplete console arguments are cleanly rejected while
preserving the behavior of all valid earlycon-style command lines.
Fixes: 73abaf87f01b ("serial: earlycon: Refactor parse_options into serial core")
Signed-off-by: Xiaochun Li <lixiaochun@xxxxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
---
Changes in v2:
- Add Cc: stable@xxxxxxxxxxxxxxx tag
drivers/tty/serial/serial_core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index a530ad372b43..02e770bf8bf6 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2084,7 +2084,8 @@ EXPORT_SYMBOL_GPL(uart_console_write);
/**
* uart_parse_earlycon - Parse earlycon options
- * @p: ptr to 2nd field (ie., just beyond '<name>,')
+ * @p: ptr to 2nd field (ie., just beyond '<name>,'); %NULL if
+ * no console options were supplied
* @iotype: ptr for decoded iotype (out)
* @addr: ptr for decoded mapbase/iobase (out)
* @options: ptr for <options> field; %NULL if not present (out)
@@ -2104,6 +2105,9 @@ EXPORT_SYMBOL_GPL(uart_console_write);
int uart_parse_earlycon(char *p, enum uart_iotype *iotype,
resource_size_t *addr, char **options)
{
+ if (!p)
+ return -EINVAL;
+
if (strncmp(p, "mmio,", 5) == 0) {
*iotype = UPIO_MEM;
p += 5;
Gentle ping on v2 of this patch. Just checking whether there are any
comments or concerns. Thanks!
Xiaochun Li