Re: [PATCH v2 1/4] uart-routing: Add common UART routing framework

[Breno Leitao <leitao@debian.org>]

On Sat, Sep 05, 2026 at 03:28:58AM -0700, Changhuang Liang wrote:
> +ssize_t uart_routing_show(struct device *dev, struct device_attribute *attr,
> +                       char *buf)
> +{
> +     const struct uart_routing_selector *sel = to_uart_routing_selector(attr);
> +     struct uart_routing *routing = uart_routing_from_dev(dev);
> +     unsigned int val, pos;
> +     int len, ret;
> +
> +     ret = regmap_read(routing->regmap, sel->reg, &val);

It seems routing can be NULL here if the file is read while the device
is being unbound, and uart_routing_store() has the same problem.

I hit this while testing v2 on arm64 (next-20261008 with KASAN), and the
code is unchanged in v3.

        d=/sys/bus/platform/devices/$DEV
        drv=/sys/bus/platform/drivers/aspeed-uart-routing
        while :; do cat $d/uart1; done >/dev/null 2>&1 &
        while :; do echo $DEV > $drv/unbind; echo $DEV > $drv/bind; done

and then got:

    KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
    Internal error: Oops: 0000000096000006 [#1]  SMP
    pc : uart_routing_show+0x64/0x288 [uart_routing]
    Call trace:
     uart_routing_show+0x64/0x288 [uart_routing] (P)
     dev_attr_show+0x64/0xc0
     sysfs_kf_seq_show+0x21c/0x380
     kernfs_seq_show+0x138/0x1c8
     seq_read_iter+0x358/0xa30
     kernfs_fop_read_iter+0x438/0x500
     vfs_read+0x484/0x6f0

--breno