[PATCH] early_serial_setup array bounds check

From: Bjorn Helgaas <bjorn.helgaas@hp.com>

early_serial_setup() doesn't validate the array index, so a caller could
corrupt memory after serial8250_ports[] by supplying a value of port->line
that's too large.

I haven't seen a failure related to this, but it seems fragile to rely on
callers to know how many ports the driver supports.

diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 559e8e6f3e149f31aff42a51f740e0f18f65074a..738cbc0b09b8dd0d4814b597b1cba8e8adbbf298 100644 (file)
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -2086,6 +2086,9 @@ int register_serial(struct serial_struct *req)
 
 int __init early_serial_setup(struct uart_port *port)
 {
+       if (port->line >= ARRAY_SIZE(serial8250_ports))
+               return -ENODEV;
+
        serial8250_isa_init_ports();
        serial8250_ports[port->line].port       = *port;
        serial8250_ports[port->line].port.ops   = &serial8250_pops;