Re: [PATCH 12/24] serial: 8250: dfl: add bounds check for device-provided regshift

From: Andy Shevchenko

Date: Tue Oct 27 2026 - 11:46:46 EST


On Tue, Oct 27, 2026 at 12:06:38PM +0100, Greg Kroah-Hartman wrote:
>
> The DFL UART driver reads regshift from the FPGA feature parameters
> without validating it, which can cause undefined behavior or
> out-of-bounds MMIO access in the 8250 core's offset << regshift
> calculations. Cap regshift at 4 to reject unreasonable values.

8 sounds pretty reasonable to me. I think this patch is odd as it's up to FPGA
what to set there. You need to compare a maximum accessed offset (taking into
account given reg-shift) to the BAR size.

--
With Best Regards,
Andy Shevchenko