Re: [PATCH 10/24] serial: 8250: pericom: validate port offset against BAR length

[Andy Shevchenko]

On Tue, Oct 27, 2026 at 12:06:36PM +0100, Greg Kroah-Hartman wrote:
> 
> The fourth port on 4-port Pericom devices uses offset 0x38 instead of
> the linear 0x18, but maxnr is computed assuming uniform 8-byte spacing.
> A malicious PCI device with an undersized BAR could cause I/O access
> outside the assigned resource. Check that offset + 8 fits within the BAR
> before registering each port.

...

>  		unsigned int offset = (i == 3 && nr == 4) ? 0x38 : i * 0x8;
>  
> +		if (offset + 8 > pci_resource_len(pdev, bar))

For the consistency's sake 0x8?

> +			break;
> +
>  		uart.port.iobase = pci_resource_start(pdev, bar) + offset;

-- 
With Best Regards,
Andy Shevchenko