[PATCH v2] serial: 8250: Fix null ptr deref has_acpi_companion

[PATCH v2] serial: 8250: Fix null ptr deref has_acpi_companion

[Filip Jensen]

uart->port.dev will have a value in serial8250_register_8250_port if the
port number is under the initial CONFIG_SERIAL_8250_RUNTIME_UARTS. If
unset, it will depend upon up->port.dev being set by the particular serial
driver. A faulty driver might not set this value and this leads to null
pointer dereferenced later in has_acpi_companion and later at
uart_add_one_port call:

Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range
RIP: 0010:serial8250_register_8250_port+0xd34/0x2030
drivers/tty/serial/8250/8250_core.c

Reviewed-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
Signed-off-by: Filip Jensen <dev-Felipe.Jensen@duagon.com>
---

Thank you very much for the revision, Jiri. As suggested, I have removed
people from the recipients list that have not made relevant changes related
to this patch recently.

V1 -> V2: Fixed that the return value was not setting an error value.
Rewriten the subject to make clear that this is a fix to a posible null
pointer deref and slightly rewriten the description for the changelog.

V1: https://lore.kernel.org/linux-serial/20260305163358.42599-1-dev-Felipe.Jensen@duagon.com/

For a case of a low level driver not setting this, cf.
Link: https://lore.kernel.org/linux-serial/20260305162815.41818-1-dev-Felipe.Jensen@duagon.com/

 drivers/tty/serial/8250/8250_core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index d2e2c5dfef99..d758f871fbbd 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -756,6 +756,8 @@ int serial8250_register_8250_port(const struct uart_8250_port *up)
 		if (ret)
 			goto err;
 	}
+	if (!uart->port.dev)
+		return -EINVAL;
 
 	if (up->port.flags & UPF_FIXED_TYPE)
 		uart->port.type = up->port.type;
-- 
2.34.1

Re: [PATCH v2] serial: 8250: Fix null ptr deref has_acpi_companion

[Jiri Slaby]

The subject is not a proper English though :). Esp. the missing 
preposition. And parens.

What about:
serial: 8250: Fix NULL pointer dereference in has_acpi_companion()
?

On 09. 03. 26, 15:28, Filip Jensen wrote:
...
> --- a/drivers/tty/serial/8250/8250_core.c
> +++ b/drivers/tty/serial/8250/8250_core.c
> @@ -756,6 +756,8 @@ int serial8250_register_8250_port(const struct uart_8250_port *up)
>   		if (ret)
>   			goto err;
>   	}
> +	if (!uart->port.dev)
> +		return -EINVAL;

Does this even compile?

thanks,
-- 
js
suse labs