Linux Serial subsystem development
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
Cc: linux-serial@vger.kernel.org
Subject: Re: [PATCH 06/24] serial: 8250: add bounds check for line array in setup_serial()
Date: Tue, 27 Oct 2026 11:12:13 +0000	[thread overview]
Message-ID: <sashiko-outbox-186417@kernel.org> (raw)
In-Reply-To: <20261027-tty-llm-v1-6-99b0202ae546@linuxfoundation.org>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] serial: 8250: build failure in setup_serial() due to non-existent info->line
--

commit a2e0e82dd3bc2dcce54251c9832007f4a9e30584
Author: Joshua Rogers <linux@joshua.hu>

serial: 8250: add bounds check for line array in setup_serial()

This commit adds a bounds check in setup_serial() to prevent out-of-bounds
writes when registering serial ports for a PCMCIA card.

> diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c
> index 5dcd1544e478d..8bd88f3d6d865 100644
> --- a/drivers/tty/serial/8250/serial_cs.c
> +++ b/drivers/tty/serial/8250/serial_cs.c
> @@ -349,6 +349,11 @@ static int setup_serial(struct pcmcia_device *handle, struct serial_info *info,
>  {
>  	struct uart_8250_port uart;
>  
> +	if (info->ndev >= ARRAY_SIZE(info->line)) {
> +		dev_err(&handle->dev, "no room for more serial ports\n");
> +		return -EINVAL;
> +	}

[Severity: Low]
Does this break the build when CONFIG_SERIAL_8250_CS is enabled?

Commit d6a0791098be ("serial: 8250: make port operations work on struct
uart_8250_port") replaced line[4] with uport[4] in struct serial_info in
drivers/tty/serial/8250/serial_cs.c:

struct serial_info {
	...
	struct uart_8250_port	*uport[4];
	const struct serial_quirk *quirk;
};

and updated setup_serial() to store the registered port in info->uport:

	info->uport[info->ndev] = serial8250_register_8250_port(&uart);

Because struct serial_info no longer has a member named line, referencing
info->line in ARRAY_SIZE() fails to compile. Should this check
ARRAY_SIZE(info->uport) instead?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261027-tty-llm-v1-0-99b0202ae546@linuxfoundation.org?part=6

  reply	other threads:[~2026-10-27 11:12 UTC|newest]

Thread overview: 87+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-27 11:06 [PATCH 00/24] tty/serial: a bunch of llm-found fixes Greg Kroah-Hartman
2026-10-27 11:06 ` [PATCH 01/24] vt: serialise the producers of the flip buffer Greg Kroah-Hartman
2026-10-27 11:14   ` sashiko-bot
2026-10-27 11:06 ` [PATCH 02/24] serial: core: respect runtime PM when sending x_char Greg Kroah-Hartman
2026-10-27 11:16   ` sashiko-bot
2026-10-27 11:06 ` [PATCH 03/24] serial: 8250: don't wait for the em485 timers locked Greg Kroah-Hartman
2026-10-27 11:39   ` Ilpo Järvinen
2026-10-27 11:46   ` sashiko-bot
2026-10-27 11:06 ` [PATCH 04/24] serial: 8250: don't report a wakeup to a closed tty Greg Kroah-Hartman
2026-10-27 11:16   ` sashiko-bot
2026-10-27 11:43   ` Ilpo Järvinen
2026-10-27 11:06 ` [PATCH 05/24] serial: 8250: clear subdriver state on port unregister Greg Kroah-Hartman
2026-10-27 11:16   ` Jiri Slaby
2026-10-27 15:28     ` James Hilliard
2026-10-27 11:30   ` sashiko-bot
2026-10-27 11:06 ` [PATCH 06/24] serial: 8250: add bounds check for line array in setup_serial() Greg Kroah-Hartman
2026-10-27 11:12   ` sashiko-bot [this message]
2026-10-27 11:19     ` Jiri Slaby
2026-10-27 11:57   ` Ilpo Järvinen
2026-10-27 11:06 ` [PATCH 07/24] serial: 8250: hold hash_mutex across irq_info lookup and linking Greg Kroah-Hartman
2026-10-27 11:12   ` sashiko-bot
2026-10-27 12:00   ` Ilpo Järvinen
2026-10-27 11:06 ` [PATCH 08/24] serial: 8250: cancel overrun backoff work on port shutdown and unregister Greg Kroah-Hartman
2026-10-27 11:27   ` sashiko-bot
2026-10-27 12:15   ` Ilpo Järvinen
2026-10-27 11:06 ` [PATCH 09/24] serial: 8250: 8250_bcm7271: fix DMA address truncation to 32 bits Greg Kroah-Hartman
2026-10-27 11:10   ` sashiko-bot
2026-10-27 12:18   ` Ilpo Järvinen
2026-10-27 15:10   ` Andy Shevchenko
2026-10-27 16:41     ` Florian Fainelli
2026-10-27 17:14       ` Andy Shevchenko
2026-10-27 17:19         ` Florian Fainelli
2026-10-27 18:37           ` Arnd Bergmann
2026-10-27 11:06 ` [PATCH 10/24] serial: 8250: pericom: validate port offset against BAR length Greg Kroah-Hartman
2026-10-27 11:12   ` sashiko-bot
2026-10-27 15:13   ` Andy Shevchenko
2026-10-27 11:06 ` [PATCH 11/24] serial: 8250: cap OxSemi Tornado UART count against BAR size Greg Kroah-Hartman
2026-10-27 11:18   ` sashiko-bot
2026-10-27 11:23   ` Jiri Slaby
2026-10-27 11:33     ` Greg Kroah-Hartman
2026-10-27 12:24   ` Ilpo Järvinen
2026-10-27 14:29   ` Maciej W. Rozycki
2026-10-27 15:23     ` Andy Shevchenko
2026-10-27 21:13       ` Maciej W. Rozycki
2026-10-28 10:52     ` Cameron Williams
2026-10-28 15:10       ` Maciej W. Rozycki
2026-10-27 11:06 ` [PATCH 12/24] serial: 8250: dfl: add bounds check for device-provided regshift Greg Kroah-Hartman
2026-10-27 11:17   ` sashiko-bot
2026-10-27 15:36   ` Andy Shevchenko
2026-10-27 11:06 ` [PATCH 13/24] serial: 8250: dfl: validate MMIO resource size and regshift Greg Kroah-Hartman
2026-10-27 11:26   ` sashiko-bot
2026-10-27 12:30   ` Ilpo Järvinen
2026-10-27 15:38   ` Andy Shevchenko
2026-10-27 11:06 ` [PATCH 14/24] serial: 8250: ioc3: store registered line number in driver data Greg Kroah-Hartman
2026-10-27 11:11   ` sashiko-bot
2026-10-27 11:27     ` Jiri Slaby
2026-10-27 12:38   ` Ilpo Järvinen
2026-10-27 13:10     ` Greg Kroah-Hartman
2026-10-27 11:06 ` [PATCH 15/24] serial: 8250: omap: acquire rx_dma_lock in DMA completion callback Greg Kroah-Hartman
2026-10-27 11:13   ` sashiko-bot
2026-10-27 12:52   ` Ilpo Järvinen
2026-10-27 11:06 ` [PATCH 16/24] serial: 8250_lpss: don't divide by 0 above 6.25 Mbaud Greg Kroah-Hartman
2026-10-27 11:18   ` sashiko-bot
2026-10-27 11:06 ` [PATCH 17/24] serial: 8250_mxpcie: handle hangup during break Greg Kroah-Hartman
2026-10-27 11:18   ` sashiko-bot
2026-10-27 11:06 ` [PATCH 18/24] serial: fsl_lpuart: fix tty ref of wakeup event Greg Kroah-Hartman
2026-10-27 11:11   ` sashiko-bot
2026-10-27 11:06 ` [PATCH 19/24] serial: imx: fix the tty reference of the " Greg Kroah-Hartman
2026-10-27 11:12   ` sashiko-bot
2026-10-27 11:06 ` [PATCH 20/24] serial: rda: free the interrupt on shutdown Greg Kroah-Hartman
2026-10-27 11:10   ` sashiko-bot
2026-10-27 12:38   ` Manivannan Sadhasivam
2026-10-27 11:06 ` [PATCH 21/24] serial: samsung: don't leak the tty on an RX IRQ Greg Kroah-Hartman
2026-10-27 11:11   ` sashiko-bot
2026-10-27 11:06 ` [PATCH 22/24] serial: samsung: put the previous baud clock Greg Kroah-Hartman
2026-10-27 11:13   ` sashiko-bot
2026-10-27 11:06 ` [PATCH 23/24] serial: st-asc: don't report a wakeup to a closed tty Greg Kroah-Hartman
2026-10-27 11:12   ` sashiko-bot
2026-10-27 15:51   ` Andy Shevchenko
2026-10-27 11:06 ` [PATCH 24/24] serial: stm32: " Greg Kroah-Hartman
2026-10-27 11:15   ` sashiko-bot
2026-10-27 13:02   ` Ilpo Järvinen
2026-10-29  5:54     ` Jiri Slaby
2026-10-29 11:56       ` Ilpo Järvinen
2026-10-27 15:06 ` [PATCH 00/24] tty/serial: a bunch of llm-found fixes Andy Shevchenko
2026-10-27 15:50   ` Greg Kroah-Hartman
2026-10-27 16:32     ` Andy Shevchenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=sashiko-outbox-186417@kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-serial@vger.kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox