[PATCH 13/24] serial: 8250: dfl: validate MMIO resource size and regshift

[Greg Kroah-Hartman]

From: Joshua Rogers <linux@xxxxxxxxx>

The driver passes the DFL feature's raw MMIO resource to the 8250 core
without verifying that the resource covers the full UART register
window.  Add a regshift sanity check and validate that the MMIO resource
is large enough for 8250 register accesses up to register 7 at the
configured register spacing and access width.

Cc: Jiri Slaby <jirislaby@xxxxxxxxxx>
Cc: Joshua Rogers <linux@xxxxxxxxx>
Cc: Bjorn Helgaas <bhelgaas@xxxxxxxxxx>
Cc: "Uwe Kleine-König (The Capable Hub)" <u.kleine-koenig@xxxxxxxxxxxx>
Cc: Danilo Krummrich <dakr@xxxxxxxxxx>
Cc: stable <stable@xxxxxxxxxx>
Signed-off-by: Joshua Rogers <linux@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/tty/serial/8250/8250_dfl.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_dfl.c b/drivers/tty/serial/8250/8250_dfl.c
index 72938990ea81..e9329935bc47 100644
--- a/drivers/tty/serial/8250/8250_dfl.c
+++ b/drivers/tty/serial/8250/8250_dfl.c
@@ -110,6 +110,7 @@ static int dfl_uart_probe(struct dfl_device *dfl_dev)
 {
 	struct device *dev = &dfl_dev->dev;
 	struct uart_8250_port uart = { };
+	resource_size_t min_size;
 	int ret;
 
 	uart.port.flags = UPF_IOREMAP;
@@ -120,6 +121,17 @@ static int dfl_uart_probe(struct dfl_device *dfl_dev)
 	if (ret < 0)
 		return dev_err_probe(dev, ret, "failed uart feature walk\n");
 
+	if (uart.port.regshift > 3)
+		return dev_err_probe(dev, -EINVAL,
+				     "unsupported regshift %u\n",
+				     uart.port.regshift);
+
+	min_size = (7 << uart.port.regshift) +
+		   ((uart.port.iotype == UPIO_MEM32) ? 4 : 2);
+	if (uart.port.mapsize < min_size)
+		return dev_err_probe(dev, -EINVAL,
+				     "MMIO resource too small for register layout\n");
+
 	if (dfl_dev->num_irqs == 1)
 		uart.port.irq = dfl_dev->irqs[0];
 

-- 
2.56.0