[PATCH v2 0/4] serial: fix console lifetime bugs on failed bind and removal
Karl Mehltretter <[email protected]> Mon, 20 Jul 2026 00:10:10 +0200
| Newsgroups | org.kernel.vger.linux-serial,dev.linux.lists.imx,org.infradead.lists.linux-arm-kernel,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
This series fixes three serial/tty bind-error bugs and an i.MX console port-table lifetime bug. The fixes were found with failslab fail-nth sweeps and sysfs bind/unbind sequences under KASAN on QEMU's raspi1ap and mcimx6ul-evk machines. Patches 1-3 fix shared serial/tty core code. Patch 1 moves fallible serial core allocations before console registration; patch 2 clears serial-core pointers after uart_driver registration fails; and patch 3 makes a non-NULL tty cdev slot mean that the cdev is live. Patch 4 clears i.MX's devm-allocated port-table entry on probe failure and removal. It keeps the entry valid through console unregistration and serializes the table updates against sibling probes. Backporting note: the probe-failure half of patch 4 relies on patch 1, which ensures that uart_add_one_port() cannot fail after registering the console. For complete coverage, patches 1 and 4 should be backported together. Validation for patch 4 includes reproducing the sibling-probe race under KASAN with and without the fix, a sequential unbind/rebind regression, and the same test with CONFIG_PROVE_LOCKING=y. The fixed kernel keeps the console unregistered and survives an explicit printk in each applicable run. Changes in v2: - Patch 4: serialize port registration and removal with imx_uart_ports[] updates to close the reported sibling-probe race. - Patches 1-3 are unchanged. v1: https://lore.kernel.org/r/[email protected] Karl Mehltretter (4): serial: core: do fallible allocations before the console can be registered serial: core: clear freed pointers on uart_register_driver() failure tty: don't oops in tty_unregister_device() when no cdev is registered serial: imx: serialize imx_uart_ports[] lifetime drivers/tty/serial/imx.c | 21 ++++++++++++++++++-- drivers/tty/serial/serial_core.c | 33 ++++++++++++++++++-------------- drivers/tty/tty_io.c | 6 ++++-- 3 files changed, 42 insertions(+), 18 deletions(-) -- 2.53.0