[PATCH v2] serial: qcom-geni: Fix off-by-one error in ida_alloc_range()

[PATCH v2] serial: qcom-geni: Fix off-by-one error in ida_alloc_range()

[Zong Jiang]

The ida_alloc_range() function expects an inclusive range, meaning both
the start and end values are valid allocation targets. Passing nr_ports
as the upper bound allows allocation of an ID equal to nr_ports, which
is out of bounds when used as an index into the port array.

Fix this by subtracting 1 from nr_ports in both calls to ida_alloc_range(),
ensuring the allocated ID stays within the valid range
[start, nr_ports - 1].

This prevents potential out-of-bounds access when the allocated ID is used
as an index.

Fixes: 9391ab1ed9b3 ("serial: qcom-geni: Make UART port count configurable via Kconfig")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202508180815.R2nDyajs-lkp@intel.com/
Signed-off-by: Zong Jiang <quic_zongjian@quicinc.com>
---
 drivers/tty/serial/qcom_geni_serial.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index 9c7b1cea7cfe..0b474d349531 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -271,9 +271,11 @@ static struct qcom_geni_serial_port *get_port_from_line(int line, bool console,
 		int max_alias_num = of_alias_get_highest_id("serial");
 
 		if (line < 0 || line >= nr_ports)
-			line = ida_alloc_range(&port_ida, max_alias_num + 1, nr_ports, GFP_KERNEL);
+			line = ida_alloc_range(&port_ida, max_alias_num + 1,
+					       nr_ports - 1, GFP_KERNEL);
 		else
-			line = ida_alloc_range(&port_ida, line, nr_ports, GFP_KERNEL);
+			line = ida_alloc_range(&port_ida, line,
+					       nr_ports - 1, GFP_KERNEL);
 
 		if (line < 0)
 			return ERR_PTR(-ENXIO);
-- 
2.34.1

Re: [PATCH v2] serial: qcom-geni: Fix off-by-one error in ida_alloc_range()

[Greg KH]

On Fri, Aug 22, 2025 at 08:05:24PM +0800, Zong Jiang wrote:
> The ida_alloc_range() function expects an inclusive range, meaning both
> the start and end values are valid allocation targets. Passing nr_ports
> as the upper bound allows allocation of an ID equal to nr_ports, which
> is out of bounds when used as an index into the port array.
> 
> Fix this by subtracting 1 from nr_ports in both calls to ida_alloc_range(),
> ensuring the allocated ID stays within the valid range
> [start, nr_ports - 1].
> 
> This prevents potential out-of-bounds access when the allocated ID is used
> as an index.
> 
> Fixes: 9391ab1ed9b3 ("serial: qcom-geni: Make UART port count configurable via Kconfig")
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/r/202508180815.R2nDyajs-lkp@intel.com/
> Signed-off-by: Zong Jiang <quic_zongjian@quicinc.com>
> ---
>  drivers/tty/serial/qcom_geni_serial.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
> index 9c7b1cea7cfe..0b474d349531 100644
> --- a/drivers/tty/serial/qcom_geni_serial.c
> +++ b/drivers/tty/serial/qcom_geni_serial.c
> @@ -271,9 +271,11 @@ static struct qcom_geni_serial_port *get_port_from_line(int line, bool console,
>  		int max_alias_num = of_alias_get_highest_id("serial");
>  
>  		if (line < 0 || line >= nr_ports)
> -			line = ida_alloc_range(&port_ida, max_alias_num + 1, nr_ports, GFP_KERNEL);
> +			line = ida_alloc_range(&port_ida, max_alias_num + 1,
> +					       nr_ports - 1, GFP_KERNEL);
>  		else
> -			line = ida_alloc_range(&port_ida, line, nr_ports, GFP_KERNEL);
> +			line = ida_alloc_range(&port_ida, line,
> +					       nr_ports - 1, GFP_KERNEL);
>  
>  		if (line < 0)
>  			return ERR_PTR(-ENXIO);
> -- 
> 2.34.1
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- This looks like a new version of a previously submitted patch, but you
  did not list below the --- line any changes from the previous version.
  Please read the section entitled "The canonical patch format" in the
  kernel file, Documentation/process/submitting-patches.rst for what
  needs to be done here to properly describe this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot