[PATCH 1/2] x86/boot: validate earlyprintk= baud rate

[PATCH 1/2] x86/boot: validate earlyprintk= baud rate

[Thorsten Blum]

parse_earlyprintk() parses the baud rate from the earlyprintk= boot
parameter with simple_strtoull(), stores it in an int, and passes it to
early_serial_init() without validating its range first. Large rates can
then be truncated to a non-zero int, after which early_serial_init()
computes the UART divisor from a potentially corrupted baud rate.

Validate the parsed baud rate before narrowing it to int and only accept
rates from 2 to BASE_BAUD, which fit in the 16-bit divisor written to
DLL/DLH.  Values greater than BASE_BAUD would produce divisor 0, and
baud 1 would produce divisor BASE_BAUD, which exceeds 16 bits.

Only parse the baud rate when a usable port has been selected, since
'baud' is not used otherwise.

Fall back to DEFAULT_BAUD for out-of-range values.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
 arch/x86/boot/early_serial_console.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/arch/x86/boot/early_serial_console.c b/arch/x86/boot/early_serial_console.c
index 023bf1c3de8b..fe0c8c1022f4 100644
--- a/arch/x86/boot/early_serial_console.c
+++ b/arch/x86/boot/early_serial_console.c
@@ -22,6 +22,7 @@
 #define DLH             1       /*  Divisor latch High        */
 
 #define DEFAULT_BAUD 9600
+#define BASE_BAUD (1843200/16)
 
 static void early_serial_init(int port, int baud)
 {
@@ -89,16 +90,20 @@ static void parse_earlyprintk(void)
 		if (arg[pos] == ',')
 			pos++;
 
-		baud = simple_strtoull(arg + pos, &e, 0);
-		if (baud == 0 || arg + pos == e)
-			baud = DEFAULT_BAUD;
+		/* Parse the baud rate only if a usable port is selected. */
+		if (port) {
+			unsigned long long parsed_baud;
+
+			parsed_baud = simple_strtoull(arg + pos, NULL, 0);
+			if (parsed_baud >= 2 && parsed_baud <= BASE_BAUD)
+				baud = (int)parsed_baud;
+		}
 	}
 
 	if (port)
 		early_serial_init(port, baud);
 }
 
-#define BASE_BAUD (1843200/16)
 static unsigned int probe_baud(int port)
 {
 	unsigned char lcr, dll, dlh;

[PATCH 2/2] x86/boot: use BASE_BAUD and DEFAULT_SERIAL_PORT

[Thorsten Blum]

Replace the hard-coded divisor and ttyS0 port with the existing
BASE_BAUD and DEFAULT_SERIAL_PORT macros.

In parse_earlyprintk(), assign 'port' directly and drop the redundant
index variable as well as the 'bases' array to simplify the code.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
 arch/x86/boot/early_serial_console.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/arch/x86/boot/early_serial_console.c b/arch/x86/boot/early_serial_console.c
index fe0c8c1022f4..420f50f3bd1e 100644
--- a/arch/x86/boot/early_serial_console.c
+++ b/arch/x86/boot/early_serial_console.c
@@ -34,7 +34,7 @@ static void early_serial_init(int port, int baud)
 	outb(0, port + FCR);	/* no fifo */
 	outb(0x3, port + MCR);	/* DTR + RTS */
 
-	divisor	= 115200 / baud;
+	divisor	= BASE_BAUD / baud;
 	c = inb(port + LCR);
 	outb(c | DLAB, port + LCR);
 	outb(divisor & 0xff, port + DLL);
@@ -75,16 +75,13 @@ static void parse_earlyprintk(void)
 			else
 				pos = e - arg;
 		} else if (!strncmp(arg + pos, "ttyS", 4)) {
-			static const int bases[] = { 0x3f8, 0x2f8 };
-			int idx = 0;
-
 			/* += strlen("ttyS"); */
 			pos += 4;
 
 			if (arg[pos++] == '1')
-				idx = 1;
-
-			port = bases[idx];
+				port = 0x2f8; /* ttyS1 */
+			else
+				port = DEFAULT_SERIAL_PORT;
 		}
 
 		if (arg[pos] == ',')