[PATCH] serial: 8250: Disallow runtime changes to nr_uarts

[Yingjie Wang]

nr_uarts is clamped to UART_NR while the initial 8250 ports are
initialized, but it is also used as the iteration bound by the remove
path. serial8250_get_port() assumes that the index is within the
serial8250_ports array.

Allowing nr_uarts to be changed through sysfs can therefore make the
remove path access beyond the end of serial8250_ports. The value also
describes the number of initialized or dynamically registered ports, so
changing it after setup is not safe even when the new value is within the
array limit.

Make the nr_uarts module parameter read-only through sysfs. Boot-time and
module-load parameter parsing remain supported and still go through the
existing clamp.

Tested on x86-64 with CONFIG_KASAN=y under QEMU:
- 8250.nr_uarts=5 is honored at boot.
- Writes to /sys/module/8250/parameters/nr_uarts are rejected.

Signed-off-by: Yingjie Wang <1075151112@xxxxxx>
---
 drivers/tty/serial/8250/8250_platform.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_platform.c b/drivers/tty/serial/8250/8250_platform.c
index 9d9dba4e0439a..2b07337407fd1 100644
--- a/drivers/tty/serial/8250/8250_platform.c
+++ b/drivers/tty/serial/8250/8250_platform.c
@@ -385,7 +385,7 @@ MODULE_DESCRIPTION("Generic 8250/16x50 serial platform driver");
 module_param_hw(share_irqs, bool, other, 0644);
 MODULE_PARM_DESC(share_irqs, "Share IRQs with other non-8250/16x50 devices (unsafe)");
 
-module_param(nr_uarts, uint, 0644);
+module_param(nr_uarts, uint, 0444);
 MODULE_PARM_DESC(nr_uarts, "Maximum number of UARTs supported. (1-" __MODULE_STRING(CONFIG_SERIAL_8250_NR_UARTS) ")");
 
 MODULE_ALIAS_CHARDEV_MAJOR(TTY_MAJOR);

base-commit: 1184f87e2790e8af9be3116f608d2e86b4792d7d
-- 
2.43.0