From nobody Mon Jun 8 09:48:26 2026 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 75B7F261B71 for ; Sat, 30 May 2026 06:10:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780121445; cv=none; b=UKf4uTK5I+jaVT7mkNAkK42A6sy8JeoRfRWjGntPKlPzbEiGrt6j9gy4InF6sd3S+a5G4rJABAi608lqVFHwcysg5/7KI1vXYFddYTP8CMUwIbY7S96YJ4uqcnZSay5geeGn8l3jpjWpvzyWXT7e1IozIIk5pbAhktRc0B10RhM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780121445; c=relaxed/simple; bh=4BoNj0omLorUkq0FrOs9cIK5T0toqS2TaRGY4KI7WUk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=hNgmlNA1IUN1NspZwhk21gGKq//OVcaXi5ASMmgwGj20v7sSAQyObZ/bE751gE8i/AIjg4G0gPOv1Z4P5liRjD8VBHnfaY/vWgf/4NH4z3XLPH6mrQT0bK9oYlnZn225ou8k7/6H59/cz4IW0suzo1eKvxpGT27TSudgnY44Tjk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BFc1oz6u; arc=none smtp.client-ip=209.85.210.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BFc1oz6u" Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-83f674f978fso5815327b3a.3 for ; Fri, 29 May 2026 23:10:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780121444; x=1780726244; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=67B+WOBRgupGSWBJ83j9RAvz/2qIYBW7PxYCF5qx9Sk=; b=BFc1oz6uiIwcNBBbrv4YZFB2gHmfm+CYv9bwJZ0uLycP4JzXvK873m0BUmDeETMKMU Wn89ZnqjqoSSyPp8Wkk55zZ6l1vmPGrw4CLwLIByJtXQsI9Umc+87eFK431knedXr4nV LXvrH32ChKGtapX8Lk9DRZkjLt8hGBidguMC3YTL5jTjwvsBRADoy0Fc77BAf3QUlK88 LF6/FaLAckmh5WVyo8UWTfFWdkGIh6KS/jzr20ipofO3BavA7zeC7KRBA9wn43eqPEih 0oyhNFAB90NHqy8ex+n7Zn27U8mhJ5VLiS5oZrbikHSKud6kP96QrEiFKOkz5I0wdCR/ FglA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780121444; x=1780726244; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=67B+WOBRgupGSWBJ83j9RAvz/2qIYBW7PxYCF5qx9Sk=; b=swcXhVcxvkkfctfDPjPSR135e0IxsKlbt8w8SKY8Tx2k5X7k45L1VckU7uL6L0mYPE KPqYsc3idksSGcZHxe0gKHOiPMiUOBXJQ43XjHWg3s2uHLMGN4OrjbC4Kc4hF1gQ1Ccf Yx5zlndoYCQBZDuxFJn2uX8FNPt/OtoEu7GpWzzhtYCIrtIDCpaW7P8DjUGUmN0gFKrh P86SYNrcVvc4eH0DjH54AD3MT17CY0Rckhjx5qyv9K+2dINXa7sGV6AfSV4sUeXPcVmh ZUrrRf1KJjeVxjNwg4V462UyvIY1boWeCAKQGOGLHVe5V4GQhVmPx5acIh91IZidv1gX z4ig== X-Forwarded-Encrypted: i=1; AFNElJ+FB4tAYfrtweuioVJJPztulK+Z+KDV5K/1x3JvQBH++2ovULkcckGXtWQ69SkP/6sOZJJDHs2DcPzn9II=@vger.kernel.org X-Gm-Message-State: AOJu0YzAMOoxV+gOU5ZJONZ23l6r0Dd/MotyROq3cinRJjEjR9p37qk4 jzCCyqlL5pMDrnHtwrOeiKf8t7DkFrT2qR2GSIaI9y7qPUIam8VCZ0c1 X-Gm-Gg: Acq92OHJSCFkWs8utRO3ZQzVQ9kusGfJGwUlGLFGIau0xnp7cMD4CvaERAs8hgky3Lt JelV2McO/J7eUr8/IKQjG9mjxPQje/xnZV7f9UM3/+KGVM2vDKg4oXd67V9nYRixCmKEGqvhXr8 rbXS0E9aS92da0F0AF7KrV0HXC4KrlCTsM50Zm2tSoN8DhWGdgof0SK+gzHsKmYHhu/5xLb1nld z8DVD4CWWcPOaR1IV2VA8Tky8B2tKC09keFpYknXD7rTJcuX1NOYWGAStEDEpXS7son4s2zSr7o pP1La2HG4EHCct2XQzVJ3SVdY9/cdp3byh+aVwVGKaCXTbWWTkAoEz3UjsH1Ad0B+mnNRuZyjqN rG3vACWd0tDkkdV9uCrTTNquQY7gT2iadX9Gp9ltzj5R2dLfGwBaWFuU5WSJpw04NS0BjZcCnck 6B6kC4c9WpUhZEzp/w/XZEfxCYCUEEY4+TDIJ8G+cncHwDkDUWUs06UsmuOxG/vQEPqBo+NaW4H khoeUkUClRC8p/PpniAPSXyxnnXtV3+LmfaUHZ4bi7w/g== X-Received: by 2002:a05:6a00:44ce:b0:841:71fd:60c4 with SMTP id d2e1a72fcca58-842253d0440mr2655843b3a.4.1780121443635; Fri, 29 May 2026 23:10:43 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84214ced002sm3894438b3a.56.2026.05.29.23.10.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 May 2026 23:10:42 -0700 (PDT) From: Rosen Penev To: linux-serial@vger.kernel.org Cc: Greg Kroah-Hartman , Jiri Slaby , linux-kernel@vger.kernel.org (open list:TTY LAYER AND SERIAL DRIVERS) Subject: [PATCH] tty: serial: mpc52xx_uart: add bounds check for psc_num array index Date: Fri, 29 May 2026 23:10:25 -0700 Message-ID: <20260530061025.11625-1-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" psc_num is derived from port->mapbase bits 11:8, giving a range of 0-15, but the psc_mclk_clk and psc_ipg_clk arrays are sized to MPC52xx_PSC_MAXNUM (12 when CONFIG_PPC_MPC512x is set). A malformed device tree with bits 11:8 >=3D 12 would cause out-of-bounds writes in mpc512x_psc_alloc_clock() and out-of-bounds reads/writes in mpc512x_psc_relse_clock() and mpc512x_psc_endis_clock(). The same unchecked index also appears in mpc512x_psc_handle_irq(). Add ARRAY_SIZE() bounds checks to all four functions before using psc_num as an array index. Assisted-by: Opencode:big-pickle Signed-off-by: Rosen Penev --- drivers/tty/serial/mpc52xx_uart.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/tty/serial/mpc52xx_uart.c b/drivers/tty/serial/mpc52xx= _uart.c index 37eb701b0b46..b566206f42a2 100644 --- a/drivers/tty/serial/mpc52xx_uart.c +++ b/drivers/tty/serial/mpc52xx_uart.c @@ -645,6 +645,8 @@ static irqreturn_t mpc512x_psc_handle_irq(struct uart_p= ort *port) =20 /* Check if it is an interrupt for this port */ psc_num =3D (port->mapbase & 0xf00) >> 8; + if (psc_num >=3D ARRAY_SIZE(psc_mclk_clk)) + return IRQ_NONE; if (test_bit(psc_num, &fifoc_int) || test_bit(psc_num + 16, &fifoc_int)) return mpc5xxx_uart_process_int(port); @@ -663,6 +665,8 @@ static int mpc512x_psc_alloc_clock(struct uart_port *po= rt) int err; =20 psc_num =3D (port->mapbase & 0xf00) >> 8; + if (psc_num >=3D ARRAY_SIZE(psc_mclk_clk)) + return -EINVAL; =20 clk =3D devm_clk_get(port->dev, "mclk"); if (IS_ERR(clk)) { @@ -711,6 +715,8 @@ static void mpc512x_psc_relse_clock(struct uart_port *p= ort) struct clk *clk; =20 psc_num =3D (port->mapbase & 0xf00) >> 8; + if (psc_num >=3D ARRAY_SIZE(psc_mclk_clk)) + return; clk =3D psc_mclk_clk[psc_num]; if (clk) { clk_disable_unprepare(clk); @@ -733,6 +739,8 @@ static int mpc512x_psc_endis_clock(struct uart_port *po= rt, int enable) return 0; =20 psc_num =3D (port->mapbase & 0xf00) >> 8; + if (psc_num >=3D ARRAY_SIZE(psc_mclk_clk)) + return -ENODEV; psc_clk =3D psc_mclk_clk[psc_num]; if (!psc_clk) { dev_err(port->dev, "Failed to get PSC clock entry!\n"); --=20 2.54.0