* [PATCH] serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
@ 2026-07-15 3:03 Jiangshan Yi
2026-07-15 6:10 ` Andy Shevchenko
0 siblings, 1 reply; 3+ messages in thread
From: Jiangshan Yi @ 2026-07-15 3:03 UTC (permalink / raw)
To: andy, gregkh, jirislaby
Cc: linux-serial, linux-kernel, 13667453960, Jiangshan Yi, stable,
Andy Shevchenko
Commit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected
platforms") replaced the dnv_board setup and exit callbacks with
PTR_IF(false, ...), which evaluates to NULL. However, the three call
sites in mid8250_probe() and mid8250_remove() unconditionally dereference
these function pointers without NULL checks, causing a NULL pointer
dereference (kernel oops) on any Denverton (DNV), Ice Lake Xeon D
(ICX-D/CDF), or Snowridge (SNR) platform.
Fix this by adding the missing NULL checks before calling the setup
and exit callbacks.
Fixes: b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms")
Cc: stable@kernel.org
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
drivers/tty/serial/8250/8250_mid.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c
index f88809ff370b..3c43a11ce4c9 100644
--- a/drivers/tty/serial/8250/8250_mid.c
+++ b/drivers/tty/serial/8250/8250_mid.c
@@ -318,7 +318,7 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id)
if (!uart.port.membase)
return -ENOMEM;
- ret = mid->board->setup(mid, &uart.port);
+ ret = mid->board->setup ? mid->board->setup(mid, &uart.port) : 0;
if (ret)
return ret;
@@ -336,7 +336,8 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id)
return 0;
err:
- mid->board->exit(mid);
+ if (mid->board->exit)
+ mid->board->exit(mid);
return ret;
}
@@ -346,7 +347,8 @@ static void mid8250_remove(struct pci_dev *pdev)
serial8250_unregister_port(mid->line);
- mid->board->exit(mid);
+ if (mid->board->exit)
+ mid->board->exit(mid);
}
static const struct mid8250_board pnw_board = {
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
2026-07-15 3:03 [PATCH] serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Jiangshan Yi
@ 2026-07-15 6:10 ` Andy Shevchenko
2026-07-15 7:13 ` Jiangshan Yi
0 siblings, 1 reply; 3+ messages in thread
From: Andy Shevchenko @ 2026-07-15 6:10 UTC (permalink / raw)
To: Jiangshan Yi
Cc: andy, gregkh, jirislaby, linux-serial, linux-kernel, 13667453960,
stable
On Wed, Jul 15, 2026 at 11:03:36AM +0800, Jiangshan Yi wrote:
> Commit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected
> platforms") replaced the dnv_board setup and exit callbacks with
> PTR_IF(false, ...), which evaluates to NULL. However, the three call
> sites in mid8250_probe() and mid8250_remove() unconditionally dereference
> these function pointers without NULL checks, causing a NULL pointer
> dereference (kernel oops) on any Denverton (DNV), Ice Lake Xeon D
> (ICX-D/CDF), or Snowridge (SNR) platform.
>
> Fix this by adding the missing NULL checks before calling the setup
> and exit callbacks.
Oh, thanks!
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
but I have a nit-pick below.
> Fixes: b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms")
> Cc: stable@kernel.org
> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
These two Cc may be moved either to --to option of `git format-patch` or after
the cutter '---' line to avoid unneeded noise in the commit message.
...
> - ret = mid->board->setup(mid, &uart.port);
> + ret = mid->board->setup ? mid->board->setup(mid, &uart.port) : 0;
> if (ret)
> return ret;
Likewise the rest, this can be also wrapped to the if-condition:
if (mid->board->setup) {
ret = mid->board->setup(mid, &uart.port);
if (ret)
return ret;
}
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: Re: [PATCH] serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
2026-07-15 6:10 ` Andy Shevchenko
@ 2026-07-15 7:13 ` Jiangshan Yi
0 siblings, 0 replies; 3+ messages in thread
From: Jiangshan Yi @ 2026-07-15 7:13 UTC (permalink / raw)
To: andriy.shevchenko
Cc: 13667453960, andy, gregkh, jirislaby, linux-kernel, linux-serial,
stable, yijiangshan
On Wed, Jul 15, 2026 at 11:03:36AM +0800, Andy Shevchenko wrote:
> Oh, thanks!
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> but I have a nit-pick below.
Hi Andy Shevchenko,
Thank you for the review and the suggestions!
You're right.I have updated the patch accordingly:
1. Changed the setup call from a ternary expression to an if-block
as suggested.
2. Removed the redundant Cc lines from the commit message body.
I will send the v2 version shortly.
Best regards,
Jiangshan Yi
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-15 7:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-15 3:03 [PATCH] serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Jiangshan Yi
2026-07-15 6:10 ` Andy Shevchenko
2026-07-15 7:13 ` Jiangshan Yi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox