linux-kernel - [PATCH] ACPI: SPCR: Check for table version when using precise baudrate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251024123125.1081612-1-punit.agrawal@oss.qualcomm.com>
Date: Fri, 24 Oct 2025 13:31:25 +0100
From: Punit Agrawal <punit.agrawal@....qualcomm.com>
To: rafael@...nel.org
Cc: lenb@...nel.org, cp0613@...ux.alibaba.com, linux-acpi@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        Punit Agrawal <punit.agrawal@....qualcomm.com>
Subject: [PATCH] ACPI: SPCR: Check for table version when using precise baudrate

Commit 4d330fe54145 ("ACPI: SPCR: Support Precise Baud Rate field")
added support to use the precise baud rate available since SPCR
1.09 (revision 4) but failed to check the version of the table
provided by the firmware. Accessing an older version of SPCR table
causes accesses beyond the end of the table and can lead to garbage
data to be used for the baud rate.

Check the version of the firmware provided SPCR to ensure that the
precise baudrate is vaild before using it.

Fixes: 4d330fe54145 ("ACPI: SPCR: Support Precise Baud Rate field")
Signed-off-by: Punit Agrawal <punit.agrawal@....qualcomm.com>
---
 drivers/acpi/spcr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
index d4d52d5e9016..73cb933fdc89 100644
--- a/drivers/acpi/spcr.c
+++ b/drivers/acpi/spcr.c
@@ -155,7 +155,7 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
 	 * Baud Rate field. If this field is zero or not present, Configured
 	 * Baud Rate is used.
 	 */
-	if (table->precise_baudrate)
+	if (table->header.revision >= 4 && table->precise_baudrate)
 		baud_rate = table->precise_baudrate;
 	else switch (table->baud_rate) {
 	case 0:
-- 
2.34.1