[PATCH 12/24] serial: 8250: dfl: add bounds check for device-provided regshift

[Greg Kroah-Hartman]

From: Joshua Rogers <linux@xxxxxxxxx>

The DFL UART driver reads regshift from the FPGA feature parameters
without validating it, which can cause undefined behavior or
out-of-bounds MMIO access in the 8250 core's offset << regshift
calculations. Cap regshift at 4 to reject unreasonable values.

Cc: Jiri Slaby <jirislaby@xxxxxxxxxx>
Cc: "Uwe Kleine-König (The Capable Hub)" <u.kleine-koenig@xxxxxxxxxxxx>
Cc: Danilo Krummrich <dakr@xxxxxxxxxx>
Cc: Takashi Sakamoto <o-takashi@xxxxxxxxxxxxx>
Cc: stable <stable@xxxxxxxxxx>
Signed-off-by: Joshua Rogers <linux@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/tty/serial/8250/8250_dfl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_dfl.c b/drivers/tty/serial/8250/8250_dfl.c
index 1343375897a8..72938990ea81 100644
--- a/drivers/tty/serial/8250/8250_dfl.c
+++ b/drivers/tty/serial/8250/8250_dfl.c
@@ -84,6 +84,10 @@ static int dfl_uart_get_params(struct dfl_device *dfl_dev, struct uart_8250_port
 		return dev_err_probe(dev, ret, "missing REG_LAYOUT param\n");
 
 	uart->port.regshift = FIELD_GET(DFHv1_PARAM_REG_LAYOUT_SHIFT, reg_layout);
+	if (uart->port.regshift > 4)
+		return dev_err_probe(dev, -EINVAL, "unsupported reg-shift %u\n",
+				     uart->port.regshift);
+
 	reg_width = FIELD_GET(DFHv1_PARAM_REG_LAYOUT_WIDTH, reg_layout);
 	switch (reg_width) {
 	case 4:

-- 
2.56.0