Re: [PATCH] serial: core: Fix a NULL pointer dereference in uart_parse_earlycon()

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Aug 06, 2026 at 03:10:26PM +0800, Xiaochun Li wrote:
> On 8/6/2026 2:16 PM, Greg KH wrote:
> > On Thu, Aug 06, 2026 at 02:10:11PM +0800, Xiaochun Li wrote:
> > > console=uart and console=pl011 can reach the preferred console matching
> > > path without an options field when a comma is absent from the command
> > > line. In that case uart_parse_earlycon() receives a NULL pointer and
> > > immediately passes it to strncmp(), which triggers a NULL pointer
> > > dereference during console matching.
> > > 
> > > Address this by returning -EINVAL when the options pointer is missing,
> > > ensuring incomplete console arguments are cleanly rejected while
> > > preserving the behavior of all valid earlycon-style command lines.
> > > 
> > > Fixes: 73abaf87f01b ("serial: earlycon: Refactor parse_options into serial core")
> > > Signed-off-by: Xiaochun Li <lixiaochun@open-hieco.net>
> > > ---
> > >   drivers/tty/serial/serial_core.c | 6 +++++-
> > >   1 file changed, 5 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> > > index a530ad372b43..02e770bf8bf6 100644
> > > --- a/drivers/tty/serial/serial_core.c
> > > +++ b/drivers/tty/serial/serial_core.c
> > > @@ -2084,7 +2084,8 @@ EXPORT_SYMBOL_GPL(uart_console_write);
> > >   /**
> > >    * uart_parse_earlycon - Parse earlycon options
> > > - * @p:	     ptr to 2nd field (ie., just beyond '<name>,')
> > > + * @p:	     ptr to 2nd field (ie., just beyond '<name>,'); %NULL if
> > > + *	     no console options were supplied
> > >    * @iotype:  ptr for decoded iotype (out)
> > >    * @addr:    ptr for decoded mapbase/iobase (out)
> > >    * @options: ptr for <options> field; %NULL if not present (out)
> > > @@ -2104,6 +2105,9 @@ EXPORT_SYMBOL_GPL(uart_console_write);
> > >   int uart_parse_earlycon(char *p, enum uart_iotype *iotype,
> > >   			resource_size_t *addr, char **options)
> > >   {
> > > +	if (!p)
> > > +		return -EINVAL;
> > > +
> > >   	if (strncmp(p, "mmio,", 5) == 0) {
> > >   		*iotype = UPIO_MEM;
> > >   		p += 5;
> > > -- 
> > > 2.52.0
> > > 
> > > 
> > 
> > How was this tested?
> 
> Hi Greg,
> 
> The issue can be reproduced with QEMU using the following kernel
> command line:
> 
>   earlyprintk=ttyS0 console=uart
> 
> Steps:
>   1. Build v7.2-rc6 with CONFIG_SERIAL_8250=y and
>      CONFIG_SERIAL_8250_CONSOLE=y
>   2. Boot with QEMU:
>      qemu-system-x86_64 -kernel bzImage -append "earlyprintk=ttyS0 console=uart" -nographic
>   3. Kernel panics immediately during console_init()
> 
> The "console=uart" argument has no comma, so console_setup() in
> kernel/printk/printk.c sets options to NULL. When
> univ8250_console_match() is called during register_console(), it
> passes that NULL directly to uart_parse_earlycon(), which
> dereferences it in strncmp().
> 
> Panic log below:
> 
> [    0.000000] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [    0.000000] #PF: supervisor read access in kernel mode
> [    0.000000] #PF: error_code(0x0000) - not-present page
> [    0.000000] PGD 0 P4D 0
> [    0.000000] Oops: Oops: 0000 [#1] SMP NOPTI
> [    0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc6 #5 PREEMPT(lazy)
> [    0.000000] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.q4
> [    0.000000] RIP: 0010:strncmp+0x1a/0x40
> [    0.000000] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 85 d2 74 24 31 c0 eb 0d 84 c9
> [    0.000000] RSP: 0000:ffffffff82c03df0 EFLAGS: 00000246
> [    0.000000] RAX: 0000000000000000 RBX: ffffffff82c03e20 RCX: ffffffff82c03e20
> [    0.000000] RDX: 0000000000000005 RSI: ffffffff82acb7a1 RDI: 0000000000000000
> [    0.000000] RBP: 0000000000000000 R08: 0000000000000040 R09: 0000000000000001
> [    0.000000] R10: 00000000ffffffea R11: ffffffff82c5cb20 R12: ffffffff82c03e30
> [    0.000000] R13: ffffffff82c03e2c R14: 0000000000000001 R15: 0000000000014770
> [    0.000000] FS:  0000000000000000(0000) GS:ffff8882b4460000(0000) knlGS:0000000000000000
> [    0.000000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    0.000000] CR2: 0000000000000000 CR3: 0000000002c30000 CR4: 00000000000000b0
> [    0.000000] Call Trace:
> [    0.000000]  <TASK>
> [    0.000000]  uart_parse_earlycon+0x27/0x140
> [    0.000000]  univ8250_console_match+0x5d/0x130
> [    0.000000]  ? __do_once_done+0x36/0xa0
> [    0.000000]  try_enable_preferred_console+0x62/0x140
> [    0.000000]  register_console+0x11a/0x5d0
> [    0.000000]  ? __pfx_univ8250_console_init+0x10/0x10
> [    0.000000]  univ8250_console_init+0x1f/0x30
> [    0.000000]  console_init+0x31/0x110
> [    0.000000]  start_kernel+0x50d/0x8b0
> [    0.000000]  x86_64_start_reservations+0x18/0x30
> [    0.000000]  x86_64_start_kernel+0x10d/0x120
> [    0.000000]  common_startup_64+0x13e/0x158
> [    0.000000]  </TASK>
> [    0.000000] Modules linked in:
> [    0.000000] CR2: 0000000000000000
> [    0.000000] ---[ end trace 0000000000000000 ]---
> [    0.000000] RIP: 0010:strncmp+0x1a/0x40
> [    0.000000] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 85 d2 74 24 31 c0 eb 0d 84 c9
> [    0.000000] RSP: 0000:ffffffff82c03df0 EFLAGS: 00000246
> [    0.000000] RAX: 0000000000000000 RBX: ffffffff82c03e20 RCX: ffffffff82c03e20
> [    0.000000] RDX: 0000000000000005 RSI: ffffffff82acb7a1 RDI: 0000000000000000
> [    0.000000] RBP: 0000000000000000 R08: 0000000000000040 R09: 0000000000000001
> [    0.000000] R10: 00000000ffffffea R11: ffffffff82c5cb20 R12: ffffffff82c03e30
> [    0.000000] R13: ffffffff82c03e2c R14: 0000000000000001 R15: 0000000000014770
> [    0.000000] FS:  0000000000000000(0000) GS:ffff8882b4460000(0000) knlGS:0000000000000000
> [    0.000000] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    0.000000] CR2: 0000000000000000 CR3: 0000000002c30000 CR4: 00000000000000b0
> [    0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
> [    0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---

Odd that this hasn't come up in the decades since it has been present :)

thanks,

greg k-h