Re: [PATCH 11/24] serial: 8250: cap OxSemi Tornado UART count against BAR size

[Greg Kroah-Hartman]

On Tue, Oct 27, 2026 at 12:23:14PM +0100, Jiri Slaby wrote:
> On 27. 10. 26, 12:06, Greg Kroah-Hartman wrote:
> > From: Joshua Rogers <linux@xxxxxxxxx>
> > 
> > pci_oxsemi_tornado_init() reads the UART count from device-controlled
> > BAR0 memory without validation, allowing a malicious device to report up
> > to 255 ports. Cap the device-reported count against what actually fits
> > in the BAR using the Tornado register layout.
> > 
> > Cc: Jiri Slaby <jirislaby@xxxxxxxxxx>
> > Cc: "Uwe Kleine-König (The Capable Hub)" <u.kleine-koenig@xxxxxxxxxxxx>
> > Cc: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
> > Cc: Bjorn Helgaas <bhelgaas@xxxxxxxxxx>
> > Cc: Lukas Wunner <lukas@xxxxxxxxx>
> > Cc: Marnix Rijnart <marnix.rijnart@xxxxxxxx>
> > Cc: Crescent Hsieh <crescentcy.hsieh@xxxxxxxx>
> > Cc: stable <stable@xxxxxxxxxx>
> > Signed-off-by: Joshua Rogers <linux@xxxxxxxxx>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> > ---
> >   drivers/tty/serial/8250/8250_pci.c | 10 ++++++++++
> >   1 file changed, 10 insertions(+)
> > 
> > diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
> > index 1dda63be6b89..9919504334bb 100644
> > --- a/drivers/tty/serial/8250/8250_pci.c
> > +++ b/drivers/tty/serial/8250/8250_pci.c
> > @@ -1083,6 +1083,7 @@ static int pci_oxsemi_tornado_init(struct pci_dev *dev)
> >   	u8 __iomem *p;
> >   	unsigned long deviceID;
> >   	unsigned int  number_uarts = 0;
> > +	resource_size_t bar_len;
> >   	if (!pci_oxsemi_tornado_p(dev))
> >   		return 0;
> > @@ -1095,6 +1096,15 @@ static int pci_oxsemi_tornado_init(struct pci_dev *dev)
> >   	/* Tornado device */
> >   	if (deviceID == 0x07000200) {
> >   		number_uarts = ioread8(p + 4);
> > +
> > +		/* Cap against BAR0 size (Tornado layout: 0x1000 + n * 0x200) */
> > +		bar_len = pci_resource_len(dev, 0);
> > +		if (bar_len >= 0x1000)
> > +			number_uarts = min_t(unsigned int, number_uarts,
> > +					     (bar_len - 0x1000) / 0x200);
> 
> Is the _t variant necessary? Both are unsigned (int and u64).

Ah, yes, the true tell of a LLM that was based on an "old" kernel
history.  I'll go fix this up for the next round of these patches, for
those that still need work, thanks!

greg k-h