Re: [PATCH v4 5/5] serial: imx: serialize imx_uart_ports[] lifetime

On Fri, Jul 31, 2026 at 08:18:44PM +0200, Karl Mehltretter wrote:
> imx_uart_probe() publishes its devm-allocated port in imx_uart_ports[]
> before uart_add_one_port() because console setup uses the table. The entry
> is not cleared when adding the port fails or after removal, leaving a
> dangling pointer.
> 
> A sibling probe can register the shared console through that stale entry.
> This was reproduced under KASAN on QEMU mcimx6ul-evk by unbinding a
> sibling UART, unbinding the console UART and rebinding the sibling.
> 
> Keep the entry valid through uart_remove_one_port(), then clear it. Protect
> port addition and removal together with their table updates so sibling
> operations cannot interleave. Reject an occupied slot rather than
> clobbering an active port during a duplicate-line probe.
> 
> Fixes: dbff4e9ea2e8 ("IMX UART: remove statically initialized tables")
> Fixes: 9f322ad064f9 ("imx: serial: handle initialisation failure correctly")
> Reported-by: Sashiko <[email protected]>
> Link: https://lore.kernel.org/all/[email protected]
> Link: https://lore.kernel.org/all/[email protected]
> Cc: [email protected]
> Assisted-by: Claude:claude-fable-5
> Signed-off-by: Karl Mehltretter <[email protected]>
> ---
> Backport note: the removal fix is self-contained. Complete probe-failure
> coverage also requires patch 1. With patch 1, all fallible allocations
> precede console registration, so rollback can safely clear the table.
> Without it, a late allocation failure (only reachable with fault
> injection) can leave the console registered after imx_uart_ports[] is
> cleared, turning the pre-existing use-after-free into a NULL
> dereference.

None of these should probably be backported, so this should be ok :)

thanks,

greg k-h