[PATCH] serial: core: Fix a NULL pointer dereference in uart_parse_earlycon()
Xiaochun Li <[email protected]> Thu, 6 Aug 2026 14:10:11 +0800
| Newsgroups | org.kernel.vger.linux-serial,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
console=uart and console=pl011 can reach the preferred console matching
path without an options field when a comma is absent from the command
line. In that case uart_parse_earlycon() receives a NULL pointer and
immediately passes it to strncmp(), which triggers a NULL pointer
dereference during console matching.
Address this by returning -EINVAL when the options pointer is missing,
ensuring incomplete console arguments are cleanly rejected while
preserving the behavior of all valid earlycon-style command lines.
Fixes: 73abaf87f01b ("serial: earlycon: Refactor parse_options into serial core")
Signed-off-by: Xiaochun Li <[email protected]>
---
drivers/tty/serial/serial_core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index a530ad372b43..02e770bf8bf6 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2084,7 +2084,8 @@ EXPORT_SYMBOL_GPL(uart_console_write);
/**
* uart_parse_earlycon - Parse earlycon options
- * @p: ptr to 2nd field (ie., just beyond '<name>,')
+ * @p: ptr to 2nd field (ie., just beyond '<name>,'); %NULL if
+ * no console options were supplied
* @iotype: ptr for decoded iotype (out)
* @addr: ptr for decoded mapbase/iobase (out)
* @options: ptr for <options> field; %NULL if not present (out)
@@ -2104,6 +2105,9 @@ EXPORT_SYMBOL_GPL(uart_console_write);
int uart_parse_earlycon(char *p, enum uart_iotype *iotype,
resource_size_t *addr, char **options)
{
+ if (!p)
+ return -EINVAL;
+
if (strncmp(p, "mmio,", 5) == 0) {
*iotype = UPIO_MEM;
p += 5;
--
2.52.0