[PATCH 06/24] serial: 8250: add bounds check for line array in setup_serial()

[Greg Kroah-Hartman]

From: Joshua Rogers <linux@xxxxxxxxx>

setup_serial() writes to info->line[info->ndev] without verifying that
ndev is within the array bounds. A malformed PCMCIA card with a large
I/O window can cause info->multi to exceed 4, leading to out-of-bounds
writes past the line[4] array and corruption of adjacent struct members.

Cc: Jiri Slaby <jirislaby@xxxxxxxxxx>
Cc: stable <stable@xxxxxxxxxx>
Signed-off-by: Joshua Rogers <linux@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/tty/serial/8250/serial_cs.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c
index 5dcd1544e478..8bd88f3d6d86 100644
--- a/drivers/tty/serial/8250/serial_cs.c
+++ b/drivers/tty/serial/8250/serial_cs.c
@@ -349,6 +349,11 @@ static int setup_serial(struct pcmcia_device *handle, struct serial_info *info,
 {
 	struct uart_8250_port uart;
 
+	if (info->ndev >= ARRAY_SIZE(info->line)) {
+		dev_err(&handle->dev, "no room for more serial ports\n");
+		return -EINVAL;
+	}
+
 	memset(&uart, 0, sizeof(uart));
 	uart.port.iobase = iobase;
 	uart.port.irq = irq;

-- 
2.56.0