[PATCH] 8250_men_mcb: port.dev unset can entail a null ptr deref

[PATCH] 8250_men_mcb: port.dev unset can entail a null ptr deref

[Filip Jensen]

The dev field of the uart_port structure is needed in the later call to
serial8250_register_8250_port and unless the port is part of the initial
registered ports (cf. CONFIG_SERIAL_8250_RUNTIME_UARTS) with a dev
already set, it will make a null pointer deref in has_acpi_companion
and could also later at uart_add_one_port call:

Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range
RIP: 0010:serial8250_register_8250_port+0xd34/0x2030
drivers/tty/serial/8250/8250_core.c

A proposal for a security check against this missing field in any driver
for the 8250_core.c will be sent in another patch.

Reviewed-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
Signed-off-by: Filip Jensen <dev-Felipe.Jensen@duagon.com>
---
 drivers/tty/serial/8250/8250_men_mcb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/tty/serial/8250/8250_men_mcb.c b/drivers/tty/serial/8250/8250_men_mcb.c
index 6373234da03d..259516078793 100644
--- a/drivers/tty/serial/8250/8250_men_mcb.c
+++ b/drivers/tty/serial/8250/8250_men_mcb.c
@@ -214,6 +214,7 @@ static int serial_8250_men_mcb_probe(struct mcb_device *mdev,
 		uart.port.iotype = UPIO_MEM;
 		uart.port.uartclk = men_lookup_uartclk(mdev);
 		uart.port.irq = mcb_get_irq(mdev);
+		uart.port.dev = &mdev->dev;
 		uart.port.mapbase = (unsigned long) mem->start
 					    + data->offset[i];
 
-- 
2.34.1

Re: [PATCH] 8250_men_mcb: port.dev unset can entail a null ptr deref

[Greg KH]

On Thu, Mar 05, 2026 at 05:28:15PM +0100, Filip Jensen wrote:
> The dev field of the uart_port structure is needed in the later call to
> serial8250_register_8250_port and unless the port is part of the initial
> registered ports (cf. CONFIG_SERIAL_8250_RUNTIME_UARTS) with a dev
> already set, it will make a null pointer deref in has_acpi_companion
> and could also later at uart_add_one_port call:
> 
> Oops: general protection fault, probably for non-canonical address
> KASAN: null-ptr-deref in range
> RIP: 0010:serial8250_register_8250_port+0xd34/0x2030
> drivers/tty/serial/8250/8250_core.c
> 
> A proposal for a security check against this missing field in any driver
> for the 8250_core.c will be sent in another patch.
> 
> Reviewed-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
> Signed-off-by: Filip Jensen <dev-Felipe.Jensen@duagon.com>
> ---
>  drivers/tty/serial/8250/8250_men_mcb.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/tty/serial/8250/8250_men_mcb.c b/drivers/tty/serial/8250/8250_men_mcb.c
> index 6373234da03d..259516078793 100644
> --- a/drivers/tty/serial/8250/8250_men_mcb.c
> +++ b/drivers/tty/serial/8250/8250_men_mcb.c
> @@ -214,6 +214,7 @@ static int serial_8250_men_mcb_probe(struct mcb_device *mdev,
>  		uart.port.iotype = UPIO_MEM;
>  		uart.port.uartclk = men_lookup_uartclk(mdev);
>  		uart.port.irq = mcb_get_irq(mdev);
> +		uart.port.dev = &mdev->dev;
>  		uart.port.mapbase = (unsigned long) mem->start
>  					    + data->offset[i];
>  
> -- 
> 2.34.1
> 

What changed to require this patch?  And can you fix up the same issues
that Jiri pointed out in your other patch like this?

thanks,

greg k-h