Re: [PATCH v6 6/6] ARM: dts: aspeed: g6: add aspeed,vuart-over-pci prop to vuart3 and 4

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing 8250 port unregistration on the probe error path leads to a Use-After-Free of the `vuart` structure.
--

--- Patch [6]: [PATCH v6 6/6] ARM: dts: aspeed: g6: add aspeed,vuart-over-pci prop to vuart3 and 4 ---
commit f96d2931c661be3250c723d0a37aa6edf52c56a7
Author: Grégoire Layet <[email protected]>

ARM: dts: aspeed: g6: add aspeed,vuart-over-pci prop to vuart3 and 4

The VUART 3 and 4 are VUART over PCI.
Set this flag to indicate this information.
Also set the scu-syscon phandle.

> diff --git a/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi b/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi
> index c952e2075b4c8..61cdca0b3ed7e 100644
> --- a/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi
> +++ b/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi
> @@ -723,6 +723,9 @@ vuart3: serial@1e787800 {
>  				interrupts = <GIC_SPI 180 IRQ_TYPE_LEVEL_HIGH>;
>  				clocks = <&syscon ASPEED_CLK_APB2>;
>  				no-loopback-test;
> +				aspeed,scu-syscon = <&syscon>;
> +				aspeed,vuart-over-pci;

[Severity: High]
This is a pre-existing issue, but does adding these properties expose a
memory corruption risk during probe failures?

In drivers/tty/serial/8250/8250_aspeed_vuart.c:aspeed_vuart_probe(), if the
function fails after serial8250_register_8250_port() is called (for example,
if handling the newly added vuart-over-pci properties fails), it jumps
to the error path:

err_sysfs_remove:
	sysfs_remove_group(&vuart->dev->kobj, &aspeed_vuart_attr_group);
	return rc;

This skips calling serial8250_unregister_port() and timer_delete_sync(),
leaving the port registered. Because returning an error causes devres to free
the vuart structure, could a subsequent open of the leaked port cause
aspeed_vuart_startup() to dereference the freed vuart pointer?

> +
>  				status = "disabled";
>  			};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=6