Re: [PATCH v2 1/2] serial: amba-pl011: unprepare console clock on unregister

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:
- [High] Missing NULL check for `uap` in `pl011_console_exit()` can lead to=
 a NULL pointer dereference.
--

--- Patch [1]: [PATCH v2 1/2] serial: amba-pl011: unprepare console clock o=
n unregister ---
commit 52f009641a6d04998b843ae51d6c555711f29559
Author: Karl Mehltretter <[email protected]>

serial: amba-pl011: unprepare console clock on unregister

This commit adds a console .exit() callback to balance the clock prepare
count. It ensures that the UART clock is unprepared when the console is
unregistered, preventing stale reference leaks.

> diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl=
011.c
> index 8ed91e1da22be..1aa43994a3cdc 100644
> --- a/drivers/tty/serial/amba-pl011.c
> +++ b/drivers/tty/serial/amba-pl011.c
> @@ -2552,6 +2552,15 @@ static int pl011_console_setup(struct console *co,=
 char *options)
>  	return uart_set_options(&uap->port, co, baud, parity, bits, flow);
>  }
> =20
> +static int pl011_console_exit(struct console *co)
> +{
> +	struct uart_amba_port *uap =3D amba_ports[co->index];
> +
> +	clk_unprepare(uap->clk);

[Severity: High]
Is it possible for uap to be NULL here in pl011_console_exit() within
drivers/tty/serial/amba-pl011.c?

During device probe, uart_add_one_port() registers the console via
uart_configure_port(). If a subsequent operation in
serial_core_add_one_port() fails (for example, allocating uport->tty_groups
returns -ENOMEM), the error path returns the error but does not unregister
the console.

The driver then cleans up by calling pl011_unregister_port(), which clears
the amba_ports array entry by setting amba_ports[co->index] =3D NULL.

The console remains globally registered. If this console is eventually
unregistered (such as when displaced by a preferred console or via sysfs
unbind), pl011_console_exit() is invoked. It unconditionally assigns uap
and dereferences it, leading to a kernel panic. Other console callbacks like
pl011_console_setup() correctly check for a NULL uap before proceeding.

> +
> +	return 0;
> +}

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260724213348.7741=
[email protected]?part=3D1