Re: [PATCH 06/24] serial: 8250: add bounds check for line array in setup_serial()

[Ilpo Järvinen]

The prefix could be less generic.

On Tue, 27 Oct 2026, Greg Kroah-Hartman wrote:

> From: Joshua Rogers <linux@xxxxxxxxx>
> 
> setup_serial() writes to info->line[info->ndev] without verifying that
> ndev is within the array bounds. A malformed PCMCIA card with a large

Yeah right... Are the "malformed" ones only ones remaining... :-)

> I/O window can cause info->multi to exceed 4, leading to out-of-bounds
> writes past the line[4] array and corruption of adjacent struct members.
> 
> Cc: Jiri Slaby <jirislaby@xxxxxxxxxx>
> Cc: stable <stable@xxxxxxxxxx>
> Signed-off-by: Joshua Rogers <linux@xxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/tty/serial/8250/serial_cs.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c
> index 5dcd1544e478..8bd88f3d6d86 100644
> --- a/drivers/tty/serial/8250/serial_cs.c
> +++ b/drivers/tty/serial/8250/serial_cs.c
> @@ -349,6 +349,11 @@ static int setup_serial(struct pcmcia_device *handle, struct serial_info *info,
>  {
>  	struct uart_8250_port uart;
>  
> +	if (info->ndev >= ARRAY_SIZE(info->line)) {
> +		dev_err(&handle->dev, "no room for more serial ports\n");
> +		return -EINVAL;
> +	}
> +
>  	memset(&uart, 0, sizeof(uart));
>  	uart.port.iobase = iobase;
>  	uart.port.irq = irq;
> 
> 

-- 
 i.