Re: [PATCH 13/24] serial: 8250: dfl: validate MMIO resource size and regshift

[Ilpo Järvinen]

On Tue, 27 Oct 2026, Greg Kroah-Hartman wrote:

> From: Joshua Rogers <linux@xxxxxxxxx>
> 
> The driver passes the DFL feature's raw MMIO resource to the 8250 core
> without verifying that the resource covers the full UART register
> window.  Add a regshift sanity check and validate that the MMIO resource
> is large enough for 8250 register accesses up to register 7 at the
> configured register spacing and access width.
> 
> Cc: Jiri Slaby <jirislaby@xxxxxxxxxx>
> Cc: Joshua Rogers <linux@xxxxxxxxx>
> Cc: Bjorn Helgaas <bhelgaas@xxxxxxxxxx>
> Cc: "Uwe Kleine-König (The Capable Hub)" <u.kleine-koenig@xxxxxxxxxxxx>
> Cc: Danilo Krummrich <dakr@xxxxxxxxxx>
> Cc: stable <stable@xxxxxxxxxx>
> Signed-off-by: Joshua Rogers <linux@xxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/tty/serial/8250/8250_dfl.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/drivers/tty/serial/8250/8250_dfl.c b/drivers/tty/serial/8250/8250_dfl.c
> index 72938990ea81..e9329935bc47 100644
> --- a/drivers/tty/serial/8250/8250_dfl.c
> +++ b/drivers/tty/serial/8250/8250_dfl.c
> @@ -110,6 +110,7 @@ static int dfl_uart_probe(struct dfl_device *dfl_dev)
>  {
>  	struct device *dev = &dfl_dev->dev;
>  	struct uart_8250_port uart = { };
> +	resource_size_t min_size;
>  	int ret;
>  
>  	uart.port.flags = UPF_IOREMAP;
> @@ -120,6 +121,17 @@ static int dfl_uart_probe(struct dfl_device *dfl_dev)
>  	if (ret < 0)
>  		return dev_err_probe(dev, ret, "failed uart feature walk\n");
>  
> +	if (uart.port.regshift > 3)
> +		return dev_err_probe(dev, -EINVAL,
> +				     "unsupported regshift %u\n",
> +				     uart.port.regshift);
> +
> +	min_size = (7 << uart.port.regshift) +

Shouldn't this be based on a named register UART_xx?

> +		   ((uart.port.iotype == UPIO_MEM32) ? 4 : 2);
> +	if (uart.port.mapsize < min_size)
> +		return dev_err_probe(dev, -EINVAL,
> +				     "MMIO resource too small for register layout\n");
> +
>  	if (dfl_dev->num_irqs == 1)
>  		uart.port.irq = dfl_dev->irqs[0];
>  
> 
> 

-- 
 i.