Re: [PATCH] serial: core: fix NULL pointer dereference in serial_core_unregister_port()

On Wed, Aug 26, 2026 at 09:32:36AM +0200, Ruslan Valiyev wrote:
> serial_core_unregister_port() dereferences port->port_dev before it has
> been checked:
> 
> 	struct serial_port_device *port_dev = port->port_dev;
> 	struct serial_ctrl_device *ctrl_dev = serial_core_get_ctrl_dev(port_dev);
> 
> serial_core_get_ctrl_dev() takes &port_dev->dev and reads dev->parent
> straight away, so a NULL port_dev faults at offset 0x40.
> 
> port_dev is NULL whenever no port device is installed:
> serial_core_remove_one_port() clears it on teardown, and it is never
> set if registration failed before serial_core_port_device_add().
> 
> serial8250_unregister_port() reaches that state. It calls
> uart_remove_one_port(), which clears port_dev, and then re-adds the
> port with uart_add_one_port() without checking the return value. When
> that re-add fails, port_dev stays NULL while port.dev still points at
> the ISA platform device, so unbinding that device once more calls
> serial8250_unregister_port() again and oopses:
> 
>   Oops: general protection fault, probably for non-canonical address
>   KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
>   RIP: 0010:serial_core_unregister_port+0xef/0x990
>   Call Trace:
>    serial8250_unregister_port+0x1e4/0x8a0
>    serial8250_remove+0x8c/0xb0
>    platform_remove+0x5f/0x80
>    device_release_driver_internal+0x46b/0x640
>    unbind_store+0xf8/0x110
>    sysfs_kf_write+0xf2/0x150
>    vfs_write+0x6ac/0x1050
> 
> Return early when there is no port device to remove, and read
> port->port_dev under port_mutex, since every other update of that
> field is serialised by it.
> 
> Also clear port->port_dev on the serial_core_register_port() error
> path. serial_base_port_device_remove() frees the port device but left
> the pointer behind, so unregistering after a failed registration read
> freed memory instead. That is the use-after-free variant of the same
> crash, and matches the title syzbot first reported this under.

It's an invalid syzbot reproducer, if root tells the kernel to unbind
from a device when it is being used, it gets to keep the pieces when
things break :(

Let me go polish off my "taint the kernel if bind/unbind runs" patch to
keep this from happening...

> Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=9f57c1b2792029198fcf
> Cc: [email protected]
> Signed-off-by: Ruslan Valiyev <[email protected]>

Did you forget an Assisted-by: tag?

thanks,

greg k-h