[PATCH 0/2] tty: serial: Keep UART driver state until ports are removed

[PATCH 0/2] tty: serial: Keep UART driver state until ports are removed

[Guangshuo Li]

Keep shared UART state available until all ports have been removed.
The two independent fixes cover ip22zilog module exit and Samsung
per-port removal.

Prepared with AI assistance and reviewed by the submitter. The affected
objects were build-tested with W=1; configuration details are included
with each patch. No hardware or fault-injection tests were performed.

Guangshuo Li (2):
  tty: serial: ip22zilog: Fix potential NULL dereference on exit
  tty: serial: samsung: Fix potential NULL dereference on removal

 drivers/tty/serial/ip22zilog.c   | 2 +-
 drivers/tty/serial/samsung_tty.c | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)


base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0

[PATCH 1/2] tty: serial: ip22zilog: Fix potential NULL dereference on exit

[Guangshuo Li]

uart_unregister_driver() frees and clears the shared UART state before
platform driver removal calls uart_remove_one_port(), which still needs
that state.

Remove the ports before unregistering the UART driver.

This issue was found by our static analysis tool under development.

Fixes: 3fc36ae6abd2 ("tty: serial: ip22zilog: Use platform device for probing")
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the affected object with MIPS ip22_defconfig and LLVM
(W=1). No hardware or fault-injection testing was performed.

 drivers/tty/serial/ip22zilog.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/ip22zilog.c b/drivers/tty/serial/ip22zilog.c
index 3fb8fdf8a853..b2a9c9652924 100644
--- a/drivers/tty/serial/ip22zilog.c
+++ b/drivers/tty/serial/ip22zilog.c
@@ -1140,8 +1140,8 @@ static int __init ip22zilog_init(void)
 
 static void __exit ip22zilog_exit(void)
 {
-	uart_unregister_driver(&ip22zilog_reg);
 	platform_driver_unregister(&ip22zilog_driver);
+	uart_unregister_driver(&ip22zilog_reg);
 }
 
 module_init(ip22zilog_init);
-- 
2.43.0

Re: [PATCH 1/2] tty: serial: ip22zilog: Fix potential NULL dereference on exit

[sashiko-bot]

> uart_unregister_driver() frees and clears the shared UART state before
> platform driver removal calls uart_remove_one_port(), which still needs
> that state.
> 
> Remove the ports before unregistering the UART driver.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: 3fc36ae6abd2 ("tty: serial: ip22zilog: Use platform device for probing")
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103-cmc-tty-0-f5f5ec0841@mail.sdu.edu.cn?part=1

[PATCH 2/2] tty: serial: samsung: Fix potential NULL dereference on removal

[Guangshuo Li]

Removing one port unregisters the shared UART driver and clears its
state even when other ports remain registered. Removing another port
then dereferences the cleared state.

Keep the UART driver registered until all platform devices are removed
at module exit. Retain registration on first probe.

This issue was found by our static analysis tool under development.

Fixes: 6f134c3c7703 ("serial: samsung: Move uart_register_driver call to device probe")
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Build-tested the affected object with arm64 defconfig and LLVM
(W=1). No hardware or fault-injection testing was performed.

 drivers/tty/serial/samsung_tty.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/samsung_tty.c b/drivers/tty/serial/samsung_tty.c
index 640f85e2d636..9768effbd39f 100644
--- a/drivers/tty/serial/samsung_tty.c
+++ b/drivers/tty/serial/samsung_tty.c
@@ -2058,7 +2058,6 @@ static void s3c24xx_serial_remove(struct platform_device *dev)
 	if (port)
 		uart_remove_one_port(&s3c24xx_uart_drv, port);
 
-	uart_unregister_driver(&s3c24xx_uart_drv);
 }
 
 /* UART power management code */
@@ -2684,6 +2683,8 @@ static int __init samsung_serial_init(void)
 static void __exit samsung_serial_exit(void)
 {
 	platform_driver_unregister(&samsung_serial_driver);
+	if (s3c24xx_uart_drv.state)
+		uart_unregister_driver(&s3c24xx_uart_drv);
 	s3c24xx_serial_unregister_console();
 }
 
-- 
2.43.0

Re: [PATCH 2/2] tty: serial: samsung: Fix potential NULL dereference on removal

[sashiko-bot]

> Removing one port unregisters the shared UART driver and clears its
> state even when other ports remain registered. Removing another port
> then dereferences the cleared state.
> 
> Keep the UART driver registered until all platform devices are removed
> at module exit. Retain registration on first probe.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: 6f134c3c7703 ("serial: samsung: Move uart_register_driver call to device probe")
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103-cmc-tty-0-f5f5ec0841@mail.sdu.edu.cn?part=2