linux-kernel - Re: [PATCH] ACPI: SPCR: Check for table version when using precise baudrate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJZ5v0jB0ziP8RQBiLN_7s9seGqdoQAiP3t7dZg3e+Skd4JovA@mail.gmail.com>
Date: Mon, 27 Oct 2025 20:45:49 +0100
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Punit Agrawal <punit.agrawal@....qualcomm.com>
Cc: rafael@...nel.org, lenb@...nel.org, cp0613@...ux.alibaba.com, 
	linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] ACPI: SPCR: Check for table version when using precise baudrate

On Fri, Oct 24, 2025 at 2:31 PM Punit Agrawal
<punit.agrawal@....qualcomm.com> wrote:
>
> Commit 4d330fe54145 ("ACPI: SPCR: Support Precise Baud Rate field")
> added support to use the precise baud rate available since SPCR
> 1.09 (revision 4) but failed to check the version of the table
> provided by the firmware. Accessing an older version of SPCR table
> causes accesses beyond the end of the table and can lead to garbage
> data to be used for the baud rate.
>
> Check the version of the firmware provided SPCR to ensure that the
> precise baudrate is vaild before using it.
>
> Fixes: 4d330fe54145 ("ACPI: SPCR: Support Precise Baud Rate field")
> Signed-off-by: Punit Agrawal <punit.agrawal@....qualcomm.com>
> ---
>  drivers/acpi/spcr.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c
> index d4d52d5e9016..73cb933fdc89 100644
> --- a/drivers/acpi/spcr.c
> +++ b/drivers/acpi/spcr.c
> @@ -155,7 +155,7 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
>          * Baud Rate field. If this field is zero or not present, Configured
>          * Baud Rate is used.
>          */
> -       if (table->precise_baudrate)
> +       if (table->header.revision >= 4 && table->precise_baudrate)
>                 baud_rate = table->precise_baudrate;
>         else switch (table->baud_rate) {
>         case 0:
> --

Applied as 6.18-rc material, thanks!