From f35f0ac0c8bcdc695b6dda9c585f1de61bdd0d80 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 20 Apr 2026 12:26:09 +0200 Subject: [PATCH] ns16550: harden name/value pair parsing strsep(), unless passed a 1st argument which itself points at a NULL pointer, won't return NULL. Instead if the separator(s) looked for isn't found, that pointed-to field would be updated to hold NULL. Hence the important check in get_token() is for token to be non-NULL after the call (which get_token()'s callers rely upon), while the checking of param_name is left there just in case. Fixes: 97fd49a7e074 ("ns16550: add support for UART parameters to be specifed with name-value pairs") Reported-by: Kamil Frankowicz Signed-off-by: Jan Beulich Acked-by: Andrew Cooper master commit: b27d3b45c75cf378f06ed72758c034a5d0f8d560 master date: 2026-04-07 13:53:49 +0200 --- xen/drivers/char/ns16550.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/drivers/char/ns16550.c b/xen/drivers/char/ns16550.c index 293fc74d63..96e837afe8 100644 --- a/xen/drivers/char/ns16550.c +++ b/xen/drivers/char/ns16550.c @@ -1472,7 +1472,7 @@ static enum __init serial_param_type get_token(char *token, char **value) unsigned int i; param_name = strsep(&token, "="); - if ( param_name == NULL ) + if ( !param_name || !token ) return num_serial_params; /* Linear search for the parameter. */