From nobody Tue Apr 7 07:34:41 2026 Received: from va-2-27.ptr.blmpb.com (va-2-27.ptr.blmpb.com [209.127.231.27]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE5DC3859DB for ; Sat, 14 Mar 2026 22:00:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.127.231.27 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773525612; cv=none; b=mkhg5hSdl+eyqpYts8Oj5lAy/qMTZZZHPkGQdjeGLwOA/CtOj55wC2EJl9ehs+yEOPlmYxsGVcfO05DEXJKil/IVwx0ocFjc4BS/el+A7SRuoPlLZUyTlbXoqCecpjik7jvV3GNQyh/j4nAz9qHL/i82LvHw6KWs75OU6QkdTtw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773525612; c=relaxed/simple; bh=2l8Aq3q47mZIeyFLFz+qNp49rySAqazzEA425JL2ccY=; h=Cc:Mime-Version:Content-Type:Subject:Message-Id:To:From:Date; b=K4SZCyaEL1NJghNDyX1Zm6/1EKNER+tpUty04NRz5qXOu9kBaS1z7rPZhp51l6gDEeFW0ybg6Z+H8D9kgcRZtly525gjDHq42+8H6I6rGFFtW7Vf95bxTrqB/tBP6CIdEDG85c/k6QehOARxd12d9gd2dZnEo0MjBZVMvZ+VFdQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oss.cipunited.com; spf=pass smtp.mailfrom=oss.cipunited.com; dkim=pass (2048-bit key) header.d=oss.cipunited.com header.i=@oss.cipunited.com header.b=gir/KaIm; arc=none smtp.client-ip=209.127.231.27 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=oss.cipunited.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.cipunited.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=oss.cipunited.com header.i=@oss.cipunited.com header.b="gir/KaIm" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2303200042; d=oss.cipunited.com; t=1773522820; h=from:subject:mime-version:from:date:message-id:subject:to:cc: reply-to:content-type:mime-version:in-reply-to:message-id; bh=kdAHhY4LzOSTwrWeGlffF4IZm5AJOs7Wf+YiF6CWeho=; b=gir/KaImGq6hmyBOzgLhWX9E2p+8SjamXGrTfmKNwshlGXbLT2QcDyj/gChbqGOkwSZ6xP xIRLsmxxtHE+YcaO3RtPlUxvQrYS4nPbZR7jEia/uv+WLhqC3WDbbwM74o8Pr+jA5ZaxMG J1kBjCPeVbpRkQYGv1UXu1Y2y/TXYRa/fnLMuoh3G+t0hQGWkSMmbeUoQbxwcbeCNabsx8 xYHzXp81RHvPXiD27L6S6L/hdAU6lo+NNIBUGsDKKbmzt5ewyzwrZpb9u6NamCMlfIgHO/ AdbEA2yxlHzHjdboLuKqOhlAAcNMLdwEs1MhzEz8zRcIAbR1wax1iyL9VZfClw== Cc: "Rong Zhang" , "Yao Zi" , , , "Icenowy Zheng" , "Rong Zhang" , Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Received: from tb ([223.88.91.90]) by smtp.feishu.cn with ESMTPS; Sun, 15 Mar 2026 05:13:38 +0800 X-Original-From: Rong Zhang Subject: [PATCH] MIPS: Loongson64: env: Check UARTs passed by LEFI cautiously Message-Id: <20260314211336.408561-1-rongrong@oss.cipunited.com> To: "Huacai Chen" , "Jiaxun Yang" , "Thomas Bogendoerfer" From: "Rong Zhang" Date: Sun, 15 Mar 2026 05:13:29 +0800 X-Mailer: git-send-email 2.53.0 Content-Transfer-Encoding: quoted-printable X-Lms-Return-Path: Content-Type: text/plain; charset="utf-8" Some firmware does not set nr_uarts properly and passes empty items. Iterate at most min(system->nr_uarts, MAX_UARTS) items to prevent out-of-bounds access, and ignore UARTs with addr 0 silently. Meanwhile, our DT only works with UPIO_MEM but theoretically firmware may pass other IO types, so explicitly check against that. Tested on Loongson-LS3A4000-7A1000-NUC-SE. Fixes: 3989ed418483 ("MIPS: Loongson64: env: Fixup serial clock-frequency w= hen using LEFI") Cc: stable@vger.kernel.org Signed-off-by: Rong Zhang Reviewed-by: Yao Zi --- arch/mips/loongson64/env.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/arch/mips/loongson64/env.c b/arch/mips/loongson64/env.c index 11ddf02d6a15..c6b99b3740ea 100644 --- a/arch/mips/loongson64/env.c +++ b/arch/mips/loongson64/env.c @@ -17,8 +17,10 @@ #include #include #include +#include #include #include +#include #include #include #include @@ -106,9 +108,23 @@ static void __init lefi_fixup_fdt(struct system_loongs= on *system) =20 is_loongson64g =3D (read_c0_prid() & PRID_IMP_MASK) =3D=3D PRID_IMP_LOONG= SON_64G; =20 - for (i =3D 0; i < system->nr_uarts; i++) { + for (i =3D 0; i < min(system->nr_uarts, MAX_UARTS); i++) { uartdev =3D &system->uarts[i]; =20 + /* + * Some firmware does not set nr_uarts properly and passes empty + * items. Ignore them silently. + */ + if (uartdev->uart_base =3D=3D 0) + continue; + + /* Our DT only works with UPIO_MEM. */ + if (uartdev->iotype !=3D UPIO_MEM) { + pr_warn("Ignore UART 0x%llx with iotype %u passed by firmware\n", + uartdev->uart_base, uartdev->iotype); + continue; + } + ret =3D lefi_fixup_fdt_serial(fdt_buf, uartdev->uart_base, uartdev->uartclk); /* base-commit: 69237f8c1f69112cca7388af7fab6d0ee45a2525 --=20 2.53.0