Re: [PATCH v5 5/6] ARM: dts: aspeed: g6: Change vuart compatible string for ast2600

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing probe error path fails to unregister 8250 port and timer, leading to a Use-After-Free.
--

--- Patch [5]: [PATCH v5 5/6] ARM: dts: aspeed: g6: Change vuart compatible string for ast2600 ---
commit 37accadaaa3a999dc66b41b5254b8c67bb2fec88
Author: Grégoire Layet <gregoire.layet@9elements.com>

ARM: dts: aspeed: g6: Change vuart compatible string for ast2600

Use the ast2600 compatible string to enable specific ast2600 properties,
while keeping the ast2500 compatible string as a fallback.

> diff --git a/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi b/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi
> index 56bb3b0444f7e..7c02633f2bd69 100644
> --- a/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi
> +++ b/arch/arm/boot/dts/aspeed/aspeed-g6.dtsi
> @@ -707,7 +707,7 @@ emmc: sdhci@1e750100 {
>  			};
>  
>  			vuart1: serial@1e787000 {
> -				compatible = "aspeed,ast2500-vuart";
> +				compatible = "aspeed,ast2600-vuart", "aspeed,ast2500-vuart";

[Severity: High]
This is a pre-existing issue, but does enabling the ast2600-specific path 
expose a use-after-free during probe failure?

If the newly activated aspeed_ast2600_vuart_over_pci_set_enabled() fails in 
drivers/tty/serial/8250/8250_aspeed_vuart.c:aspeed_vuart_probe(), the code 
jumps to err_sysfs_remove:

drivers/tty/serial/8250/8250_aspeed_vuart.c:aspeed_vuart_probe() {
    ...
    err_sysfs_remove:
        sysfs_remove_group(&vuart->dev->kobj, &aspeed_vuart_attr_group);
        return rc;
}

This error path returns while leaving the 8250 port registered and the timer 
active. The devm-allocated vuart memory is subsequently freed, leaving a 
dangling pointer. 

Should this error path also call serial8250_unregister_port() and 
timer_delete_sync() to prevent a use-after-free if userspace interacts with 
the lingering device?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1785932211.git.gregoire.layet@9elements.com?part=5