[PATCH] MIPS: Loongson64: env: Check UARTs passed by LEFI cautiously

[PATCH] MIPS: Loongson64: env: Check UARTs passed by LEFI cautiously

[Rong Zhang]

Some firmware does not set nr_uarts properly and passes empty items.
Iterate at most min(system->nr_uarts, MAX_UARTS) items to prevent
out-of-bounds access, and ignore UARTs with addr 0 silently.

Meanwhile, our DT only works with UPIO_MEM but theoretically firmware
may pass other IO types, so explicitly check against that.

Tested on Loongson-LS3A4000-7A1000-NUC-SE.

Fixes: 3989ed418483 ("MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI")
Cc: stable@vger.kernel.org
Signed-off-by: Rong Zhang <rongrong@oss.cipunited.com>
---
 arch/mips/loongson64/env.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/arch/mips/loongson64/env.c b/arch/mips/loongson64/env.c
index 11ddf02d6a15..c6b99b3740ea 100644
--- a/arch/mips/loongson64/env.c
+++ b/arch/mips/loongson64/env.c
@@ -17,8 +17,10 @@
 #include <linux/dma-map-ops.h>
 #include <linux/export.h>
 #include <linux/libfdt.h>
+#include <linux/minmax.h>
 #include <linux/pci_ids.h>
 #include <linux/string_choices.h>
+#include <linux/serial_core.h>
 #include <asm/bootinfo.h>
 #include <loongson.h>
 #include <boot_param.h>
@@ -106,9 +108,23 @@ static void __init lefi_fixup_fdt(struct system_loongson *system)
 
 	is_loongson64g = (read_c0_prid() & PRID_IMP_MASK) == PRID_IMP_LOONGSON_64G;
 
-	for (i = 0; i < system->nr_uarts; i++) {
+	for (i = 0; i < min(system->nr_uarts, MAX_UARTS); i++) {
 		uartdev = &system->uarts[i];
 
+		/*
+		 * Some firmware does not set nr_uarts properly and passes empty
+		 * items. Ignore them silently.
+		 */
+		if (uartdev->uart_base == 0)
+			continue;
+
+		/* Our DT only works with UPIO_MEM. */
+		if (uartdev->iotype != UPIO_MEM) {
+			pr_warn("Ignore UART 0x%llx with iotype %u passed by firmware\n",
+				uartdev->uart_base, uartdev->iotype);
+			continue;
+		}
+
 		ret = lefi_fixup_fdt_serial(fdt_buf, uartdev->uart_base,
 					    uartdev->uartclk);
 		/*

base-commit: 69237f8c1f69112cca7388af7fab6d0ee45a2525
-- 
2.53.0

Re: [PATCH] MIPS: Loongson64: env: Check UARTs passed by LEFI cautiously

[Yao Zi]

On Sun, Mar 15, 2026 at 05:13:29AM +0800, Rong Zhang wrote:
> Some firmware does not set nr_uarts properly and passes empty items.
> Iterate at most min(system->nr_uarts, MAX_UARTS) items to prevent
> out-of-bounds access, and ignore UARTs with addr 0 silently.
> 
> Meanwhile, our DT only works with UPIO_MEM but theoretically firmware
> may pass other IO types, so explicitly check against that.
> 
> Tested on Loongson-LS3A4000-7A1000-NUC-SE.
> 
> Fixes: 3989ed418483 ("MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI")
> Cc: stable@vger.kernel.org
> Signed-off-by: Rong Zhang <rongrong@oss.cipunited.com>
> ---
>  arch/mips/loongson64/env.c | 18 +++++++++++++++++-
>  1 file changed, 17 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/mips/loongson64/env.c b/arch/mips/loongson64/env.c
> index 11ddf02d6a15..c6b99b3740ea 100644
> --- a/arch/mips/loongson64/env.c
> +++ b/arch/mips/loongson64/env.c
> @@ -17,8 +17,10 @@
>  #include <linux/dma-map-ops.h>
>  #include <linux/export.h>
>  #include <linux/libfdt.h>
> +#include <linux/minmax.h>
>  #include <linux/pci_ids.h>
>  #include <linux/string_choices.h>
> +#include <linux/serial_core.h>

Maybe putting this before string_choices.h to keep the headers sorted
at least locally? Though the order is already broken, this may minimize
the diff if someone is willing to sort them later.

>  #include <asm/bootinfo.h>
>  #include <loongson.h>
>  #include <boot_param.h>

Reviewed-by: Yao Zi <me@ziyao.cc>

Thanks,
Yao Zi

[PATCH v2] MIPS: Loongson64: env: Check UARTs passed by LEFI cautiously

[Rong Zhang]

Some firmware does not set nr_uarts properly and passes empty items.
Iterate at most min(system->nr_uarts, MAX_UARTS) items to prevent
out-of-bounds access, and ignore UARTs with addr 0 silently.

Meanwhile, our DT only works with UPIO_MEM but theoretically firmware
may pass other IO types, so explicitly check against that.

Tested on Loongson-LS3A4000-7A1000-NUC-SE.

Fixes: 3989ed418483 ("MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI")
Cc: stable@vger.kernel.org
Reviewed-by: Yao Zi <me@ziyao.cc>
Signed-off-by: Rong Zhang <rongrong@oss.cipunited.com>
---
Changes in v2:
- Sort new includes alphabetically (thanks Yao Zi)
---
 arch/mips/loongson64/env.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/arch/mips/loongson64/env.c b/arch/mips/loongson64/env.c
index 11ddf02d6a15..7abcca7ab4ed 100644
--- a/arch/mips/loongson64/env.c
+++ b/arch/mips/loongson64/env.c
@@ -17,7 +17,9 @@
 #include <linux/dma-map-ops.h>
 #include <linux/export.h>
 #include <linux/libfdt.h>
+#include <linux/minmax.h>
 #include <linux/pci_ids.h>
+#include <linux/serial_core.h>
 #include <linux/string_choices.h>
 #include <asm/bootinfo.h>
 #include <loongson.h>
@@ -106,9 +108,23 @@ static void __init lefi_fixup_fdt(struct system_loongson *system)
 
 	is_loongson64g = (read_c0_prid() & PRID_IMP_MASK) == PRID_IMP_LOONGSON_64G;
 
-	for (i = 0; i < system->nr_uarts; i++) {
+	for (i = 0; i < min(system->nr_uarts, MAX_UARTS); i++) {
 		uartdev = &system->uarts[i];
 
+		/*
+		 * Some firmware does not set nr_uarts properly and passes empty
+		 * items. Ignore them silently.
+		 */
+		if (uartdev->uart_base == 0)
+			continue;
+
+		/* Our DT only works with UPIO_MEM. */
+		if (uartdev->iotype != UPIO_MEM) {
+			pr_warn("Ignore UART 0x%llx with iotype %u passed by firmware\n",
+				uartdev->uart_base, uartdev->iotype);
+			continue;
+		}
+
 		ret = lefi_fixup_fdt_serial(fdt_buf, uartdev->uart_base,
 					    uartdev->uartclk);
 		/*

base-commit: 267594792a71018788af69e836c52e34bb8054af
-- 
2.53.0

Re: [PATCH v2] MIPS: Loongson64: env: Check UARTs passed by LEFI cautiously

[Jiaxun Yang]

On Sun, 15 Mar 2026, at 5:28 PM, Rong Zhang wrote:
> Some firmware does not set nr_uarts properly and passes empty items.
> Iterate at most min(system->nr_uarts, MAX_UARTS) items to prevent
> out-of-bounds access, and ignore UARTs with addr 0 silently.
>
> Meanwhile, our DT only works with UPIO_MEM but theoretically firmware
> may pass other IO types, so explicitly check against that.
>
> Tested on Loongson-LS3A4000-7A1000-NUC-SE.
>
> Fixes: 3989ed418483 ("MIPS: Loongson64: env: Fixup serial 
> clock-frequency when using LEFI")

Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>

Sign, firmwares are always insane like this :-(

> Cc: stable@vger.kernel.org
> Reviewed-by: Yao Zi <me@ziyao.cc>
> Signed-off-by: Rong Zhang <rongrong@oss.cipunited.com>
> ---
> Changes in v2:
> - Sort new includes alphabetically (thanks Yao Zi)
> ---
>  arch/mips/loongson64/env.c | 18 +++++++++++++++++-
>  1 file changed, 17 insertions(+), 1 deletion(-)
>
> diff --git a/arch/mips/loongson64/env.c b/arch/mips/loongson64/env.c
> index 11ddf02d6a15..7abcca7ab4ed 100644
> --- a/arch/mips/loongson64/env.c
> +++ b/arch/mips/loongson64/env.c
> @@ -17,7 +17,9 @@
>  #include <linux/dma-map-ops.h>
>  #include <linux/export.h>
>  #include <linux/libfdt.h>
> +#include <linux/minmax.h>
>  #include <linux/pci_ids.h>
> +#include <linux/serial_core.h>
>  #include <linux/string_choices.h>
>  #include <asm/bootinfo.h>
>  #include <loongson.h>
> @@ -106,9 +108,23 @@ static void __init lefi_fixup_fdt(struct 
> system_loongson *system)
> 
>  	is_loongson64g = (read_c0_prid() & PRID_IMP_MASK) == PRID_IMP_LOONGSON_64G;
> 
> -	for (i = 0; i < system->nr_uarts; i++) {
> +	for (i = 0; i < min(system->nr_uarts, MAX_UARTS); i++) {
>  		uartdev = &system->uarts[i];
> 
> +		/*
> +		 * Some firmware does not set nr_uarts properly and passes empty
> +		 * items. Ignore them silently.
> +		 */
> +		if (uartdev->uart_base == 0)
> +			continue;
> +
> +		/* Our DT only works with UPIO_MEM. */
> +		if (uartdev->iotype != UPIO_MEM) {
> +			pr_warn("Ignore UART 0x%llx with iotype %u passed by firmware\n",
> +				uartdev->uart_base, uartdev->iotype);
> +			continue;
> +		}
> +
>  		ret = lefi_fixup_fdt_serial(fdt_buf, uartdev->uart_base,
>  					    uartdev->uartclk);
>  		/*
>
> base-commit: 267594792a71018788af69e836c52e34bb8054af
> -- 
> 2.53.0

-- 
- Jiaxun